Stripe Privacy Policy

This document is Stripe's global Privacy Policy (last updated April 28, 2026), governing the collection, use, sharing, and retention of Personal Data across Stripe's financial infrastructure services, including payment processing, identity verification, fraud prevention, and business management tools. The policy states that Stripe collects identifiers, financial account details, government-issued ID information, transaction data, device and network information, browsing activity, geolocation data, and biometric data (where applicable), and the terms authorize sharing this data with business partners, financial partners, identity verification providers, advertising networks, and analytics providers. The policy asserts broad legitimate interests as a legal basis for certain processing activities, including fraud detection, network security, and marketing communications, which may require evaluation under GDPR Article 6 balancing tests and equivalent frameworks in other jurisdictions. The policy engages GDPR, CCPA/CPRA, and a range of other national and regional privacy frameworks, with Stripe noting its participation in the EU-U.S. Data Privacy Framework and reliance on Standard Contractual Clauses for international data transfers; compliance obligations vary materially by jurisdiction, particularly regarding consent requirements, data subject rights timelines, and cross-border transfer mechanisms.