By using Gumroad's payment services, users consent to being bound by Stripe's and PayPal's separate privacy policies and terms of service, and authorize Gumroad, Stripe, and PayPal to share the user's information and payment instructions with third-party payment providers to the extent required to complete transactions.
This analysis describes what Gumroad's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision binds users to the terms of service and privacy policies of two separate third-party payment processors as a condition of using Gumroad's payment services, and authorizes data sharing across Gumroad, Stripe, PayPal, and additional third-party payment providers. Users are subject to the data practices of multiple entities under distinct policy frameworks.
The updated terms establish a forfeiture mechanism for unpaid earnings held in third-party payment accounts when creators change payout countries or payout methods. Under the revised language, amounts that cannot be transferred to a new connected account in a different country or a different payout method will be forfeited when the change takes effect. The agreement requires Gumroad to notify creators of the amount before processing the change and to obtain confirmation before proceeding; amounts held in Gumroad's own accounts are not subject to forfeiture. You can avoid forfeiture by ensuring you withdraw or transfer unpaid amounts before changing your payout country or method.
View change record →The updated terms establish a more permissive multi-account structure: users may now hold multiple accounts for genuinely separate brands or businesses, provided registration data is true and accurate for each account. However, the revised policy strengthens enforcement against account evasion by explicitly prohibiting multiple accounts created to evade suspension, termination, or enforcement action, or to misrepresent identity or conceal that controlled accounts are related. Users with existing multiple accounts are required to identify them to Gumroad on reasonable request; Gumroad also requires that any additional accounts created through Gumroad's account-creation feature be used to maintain account association in its records.
View change record →The updated terms authorize Gumroad to place holds on supplier earnings indefinitely based on suspected violations, elevated chargeback risk, misleading marketing, incomplete identity verification, or payment partner requirements—without specifying a maximum hold period or guaranteed release timeline. Held funds remain in account balances but do not accrue interest and are not applied to Gumroad's benefit. The company will notify suppliers where practicable, but may withhold notice if it would compromise investigations or risk controls. Suppliers retain the ability to continue selling even while funds are held, but cannot access those earnings until Gumroad determines the basis for the hold has been resolved to its reasonable satisfaction.
View change record →Under this clause, users who transact through Gumroad authorize the sharing of their personal information and payment instructions with Stripe, PayPal, and potentially additional third-party payment providers, and are bound by the separate privacy policies and terms of service of each provider.
How other platforms handle this
We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected.
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
"By through the Services, you (a) agree to be bound by, in the case of Stripe, Stripe's Privacy Policy (currently accessible at https://stripe.com/us/privacy) and its Stripe Connected Account Agreement (currently accessible at https://stripe.com/legal/connect-account); and in the case of PayPal, PayPal's Privacy Statement (currently accessible at https://www.paypal.com/us/webapps/mpp/ua/privacy-full) and its terms of service (currently accessible at https://www.paypal.com/us/webapps/mpp/ua/useragreement-full?locale.x=en_US); (b) agree to provide only true, accurate, current and complete information about you and to update such information as necessary to maintain its truth and accuracy; and (c) and you hereby consent and authorize Gumroad, Stripe and PayPal to share any information and payment instructions you provide with one or more Third-Party Payments Provider(s) to the minimum extent required to complete your transactions.Excerpt from Gumroad's Terms of Service
(1) REGULATORY LANDSCAPE: This provision implicates CCPA for California residents, GDPR and the Payment Services Directive (PSD2) for EU users, and PCI DSS standards for payment data handling across the named processors.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision binds users to the terms of service and privacy policies of two separate third-party payment processors as a condition of using Gumroad's payment services, and authorizes data sharing across Gumroad, Stripe, PayPal, and additional third-party payment providers. Users are subject to the data practices of multiple entities under distinct policy frameworks.
Under this clause, users who transact through Gumroad authorize the sharing of their personal information and payment instructions with Stripe, PayPal, and potentially additional third-party payment providers, and are bound by the separate privacy policies and terms of service of each provider.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Gumroad.