107 Total
22 High severity
76 Medium severity
9 Low severity

Key Facts

What does Stripe use Personal Data to train?
Stripe uses Personal Data to train artificial intelligence models to power its Services and protect against fraud and other harm.
What does Stripe use Personal Data to do?
Stripe uses Personal Data to train artificial intelligence models to power its Services and protect against fraud and other harm.
What does Stripe use and share Representatives' Personal Data to conduct?
Stripe uses and shares Representatives' Personal Data to conduct due diligence, including anti-money laundering and sanctions screening, in accordance with applicable law.
What does Stripe permit users to separately consent to?
Stripe permits users to separately consent to the use of their biometric data to enhance Stripe's verification technology, with the option to revoke that consent at any time.
Can users revoke their consent to the use of their biometric data?
Stripe permits users to separately consent to the use of their biometric data to enhance Stripe's verification technology, with the option to revoke that consent at any time.
What is Stripe's responsibility on Business Users?
Stripe places responsibility on Business Users for ensuring that the privacy rights of their End Customers are respected, including obtaining appropriate consents and making disclosures about their own data collection and use.
What information may Stripe collect from a checkout form?
Stripe may collect information entered into a checkout form even if the user opts not to complete the form or transaction with the Business User.
When may Stripe collect information entered into a checkout form?
Stripe may collect information entered into a checkout form even if the user opts not to complete the form or transaction with the Business User.
With whom does Stripe share End Customer Personal Data?
Stripe shares End Customer Personal Data with the Business User in connection with the provision of its Services when the End Customer initiates a purchasing process, even if the purchase is not completed.
When does Stripe share End Customer Personal Data with the Business User?
Stripe shares End Customer Personal Data with the Business User in connection with the provision of its Services when the End Customer initiates a purchasing process, even if the purchase is not completed.
Stay ahead of the changes
Track Stripe and get the diff the day its terms change.
Summary

This policy explains what data Stripe collects about you, how it uses and shares that data, and what rights you have. Stripe can collect information you type into a checkout form even if you never finish the transaction, and may share that data with the business whose form you used. US users can opt out of targeted advertising and related data sharing, and users can separately consent to — and later revoke — the use of their biometric data.

Analysis

Stripe's Privacy Policy establishes the terms under which Stripe collects, uses, retains, and shares Personal Data across its roles serving Business Users, End Customers, and End Users. Notably, Stripe may collect data entered into checkout forms even when a transaction is not completed, and shares End Customer Personal Data with Business Users upon initiation of a purchasing process regardless of completion. Personal Data is used to train AI models, to conduct automated fraud-risk evaluation, and to power interest-based advertising through third-party partners — though Stripe commits that it does not transfer Personal Data to third parties in exchange for payment. Stripe retains Personal Data after service cessation for legal, regulatory, and fraud-monitoring purposes, and allocates responsibility for End Customer privacy compliance — including consent and disclosure obligations — to Business Users rather than assuming that responsibility itself.

What this means for you

As an individual user, your Personal Data may be collected the moment you begin entering information into a checkout form, even if you abandon it, and that data may be shared with the relevant Business User. Your data is also used to train Stripe's AI models and to evaluate fraud risk through automated technology. Stripe may retain your Personal Data after you stop using its services for compliance and fraud-monitoring purposes. Two concrete actions are available to you: you can opt out of targeted advertising and related data sales or sharing for behavioral advertising, and if you have separately consented to biometric data use, you can revoke that consent at any time.

Institutional Analysis
Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

4 important changes detected

7 versions captured · Last updated: May 2026

What changed Stripe updated its privacy policy on May 19, 2026 to replace all references to its payment service 'Link' with 'Onelink.' This is a product rebranding change that affects how the policy describes End User Services, account creation, transaction data collection, and bank account integration. No changes were made to what data Stripe collects, how it processes personal data, or users' rights and obligations.
Why this matters Stripe updated its privacy policy to reflect the rebranding of its Link product to Onelink. This is purely a naming change. All references to Link—including how account creation, payment transactions, and bank account integration work—now refer to Onelink instead. The policy's substantive provisions governing what data Stripe collects, how it uses personal data, and what rights users have remain unchanged.
View full change record →
What changed Stripe updated its Privacy Policy on April 29, 2026 with four minor editorial changes. The policy's last-updated date was changed from February 23, 2026 to April 28, 2026. Stripe's legal entity name was simplified from 'Stripe Inc., now known as Stripe, LLC' to 'Stripe, LLC' in the Data Privacy Framework compliance statement. The reference to learning more about the Data Privacy Framework was expanded from a generic 'Learn More' link to explicit text stating 'You can learn and read Stripe's Data Privacy Framework Policy here'. These are formatting and organizational updates with no material changes to substantive privacy rights or data-handling practices.
Why this matters Stripe's Privacy Policy was updated with editorial revisions that do not substantively alter consumer privacy rights or data practices. The policy continues to state Stripe's compliance with the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework. The clarified link to Stripe's Data Privacy Framework Policy provides more direct access to supplementary framework information, but this is a disclosure improvement rather than a change to how Stripe collects, uses, or shares personal data.
View full change record →

April 25, 2026 low

Stripe updated its privacy policy on April 25, 2026 with minor editorial changes. Three contact email addresses for exercising privacy rights had trailing spaces added after the email addresses. The …

View change record →
April 23, 2026 low

Stripe updated its privacy policy on April 23, 2026, but the substantive changes detected are minimal. The update date listed in the document was revised from February 23, 2026 to …

View change record →
Featured, High severity
Featured, Medium severity

Complete Provision Index

Every distinct legal provision identified in this document. Featured provisions appear above with analysis.

107 provisions
12 featured
17 clause types
22 high severity
Data Sharing 25 3 high
Show all 25 data sharing provisions
Export Controls & Sanctions 1 1 high
Restricted or Prohibited Content/Industries 1
Stay ahead of the changes

Monitoring

Stripe has updated this document before. Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.

Stay ahead of the changes

Governance Intelligence

Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.

Cross-platform context

See how other platforms handle AI model training using Personal Data and similar clauses.

Compare across platforms →

Related Analysis

Consumer Rights · April 21, 2026
Stripe's Reserve and Hold Authority: What the Terms Authorize

Stripe's terms authorize fund reserves, payout withholding, and account termination. Here is what the agreement states and what business ow…

Dependency Governance · May 27, 2026
When Infrastructure Providers Govern Platforms

The Kickstarter-Stripe controversy reveals how payment processors, cloud providers, and AI platforms quietly shape downstream policy decisi…

Dependency Governance · June 11, 2026
When AI Agents Start Paying for Things: Who Governs Machine-to-Machine Commerce?

Mastercard, Stripe, and Cloudflare are building payment infrastructure for autonomous AI agents. The governance layer is not keeping pace.

Archival ProvenanceSource & Archival Record
Last Captured May 19, 2026 00:11 UTC
Capture Method Automated scheduled archival capture
Document ID CA-D-000106
Version ID CA-V-002714
SHA-256 75784d548ae312ef3404c433596e9ade4f9edc9f3d5ae3ade71e1a6f105c97c7
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Hash verified

Governance Monitoring

Monitor governance changes across the platforms you rely on.

Structured alerts for policy changes, governance events, and provision updates across 352+ platforms.

Start monitoring → Compare plans