Stripe Privacy Policy

This document is Stripe's global Privacy Policy (last updated April 28, 2026), governing the collection, use, and sharing of Personal Data across Stripe's Business Services, End User Services, websites, and applications, with Stripe acting as either a data controller or data processor depending on the activity. The policy states that Stripe collects identifiers, financial information, transaction data, device and network data, location information, behavioral and usage data, and inferred characteristics, and authorizes sharing with Business Users, Financial Partners, service providers, advertising and analytics partners, and government or law enforcement authorities. The policy distinguishes between multiple data subject roles (End Customers, End Users, Representatives, and Visitors) and asserts that data collected about End Customers is primarily processed as a service provider on behalf of Business Users, which may limit direct consumer rights against Stripe in those contexts. The policy references GDPR, CCPA and the California Privacy Rights Act, the EU-US Data Privacy Framework, the UK-Switzerland frameworks, and applicable financial services regulations; it designates Stripe, Inc. (US) and Stripe Payments Europe Limited (EU/EEA/UK) as the primary responsible entities depending on jurisdiction. Material compliance considerations include the breadth of inferred data and behavioral profiling disclosed, cross-border data transfer mechanisms, the scope of Financial Partners and sub-processors with whom data is shared, and the policy's assertion that Stripe may share data with law enforcement without notice to users in some circumstances.