Depending on what you are doing with Stripe, Stripe may be responsible for your data as the primary decision-maker (controller) or as a company processing data on behalf of the business you bought from (processor). This distinction affects whether you can ask Stripe directly to access or delete your data.
This analysis describes what Stripe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
When Stripe acts as a processor on behalf of a Business User, your privacy rights requests may need to go to the merchant, not Stripe. This can make exercising rights more complex for consumers who interact with Stripe only through third-party checkouts.
Interpretive note: The practical allocation of controller versus processor responsibilities for specific data flows depends on the contractual arrangements between Stripe and individual Business Users, which are not fully disclosed in this policy.
Severity increased from medium to high; quotation marks changed from single to double quotes with no substantive content change.
View full change record →Consumers who have paid through a Stripe-powered merchant checkout may find that their access, deletion, or correction requests must be directed to the merchant rather than to Stripe, because Stripe processes that data as a service provider on the merchant's behalf rather than as a data controller in its own right.
How other platforms handle this
Where ZipRecruiter processes your Personal Data in the capacity of a service provider (data processor), and you seek access, or want to correct, amend, or delete your Personal Data...we will provide you with the data controller's contact information, so you can contact them directly.
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
"Depending on the activity, Stripe assumes the role of a "data controller" and/or "data processor" (or "service provider"). For more details about our privacy practices, including our role, the specific Stripe entity responsible under this Policy, and our legal bases for processing your Personal Data, please visit our Privacy Center.Excerpt from Stripe's Privacy Policy
(1) REGULATORY LANDSCAPE: The controller/processor distinction directly engages GDPR Articles 4, 24, and 28, which impose different obligations and liability frameworks on controllers versus processors.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
When Stripe acts as a processor on behalf of a Business User, your privacy rights requests may need to go to the merchant, not Stripe. This can make exercising rights more complex for consumers who interact with Stripe only through third-party checkouts.
Consumers who have paid through a Stripe-powered merchant checkout may find that their access, deletion, or correction requests must be directed to the merchant rather than to Stripe, because Stripe processes that data as a service provider on the merchant's behalf rather than as a data controller in its own right.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stripe.