Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
If you are an End Customer who interacted with Stripe through a merchant's checkout, your privacy rights may need to be exercised through that merchant rather than directly through Stripe, because Stripe processes your data as a service provider for the merchant.
This analysis describes what Stripe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Many consumers who encounter Stripe only through third-party merchant checkouts may not realize that their direct rights against Stripe are limited in that context, and that they must contact the merchant to exercise certain privacy rights.
Interpretive note: The precise allocation of controller versus processor responsibility for specific End Customer data flows depends on the contractual arrangements between Stripe and each Business User, which vary and are not fully described in this policy.
Introduces complexity around data subject identity and rights differentiation based on user role, potentially affecting how rights are applied to different parties.
View full change record →End Customers whose data Stripe processes on behalf of a Business User merchant may need to direct access, deletion, or correction requests to the merchant rather than to Stripe, as the policy establishes distinct roles for each data subject category.
How other platforms handle this
In certain circumstances, the right to data portability, which means that you can request that we provide certain Personal Data we hold about you in a machine-readable format
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
For data portability requests, We will select a format to provide Your personal information that is readily useable and should allow You to transmit the information from one entity to another entity without hindrance.
Monitoring
Stripe has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Depending on the context, "you" might be an End Customer, End User, Representative, or Visitor.Excerpt from Stripe's Privacy Policy
(1) REGULATORY LANDSCAPE: The End Customer rights routing framework engages GDPR Article 28 (processor obligations to assist controllers with data subject rights) and CCPA service provider provisions. Under GDPR, processors are required to assist controllers in responding to data subject rights requests. The Irish DPC and UK ICO supervise these obligations in their respective jurisdictions. (2) GOVERNANCE EXPOSURE: High. Business Users who receive data subject rights requests from End Customers must have documented procedures to relay those requests to Stripe and receive responses within applicable regulatory timeframes. Failure to establish these procedures creates liability for the Business User as data controller. (3) JURISDICTION FLAGS: EU/EEA and UK jurisdictions impose strict response timeframes (one month under GDPR, extendable to three months in complex cases) that apply to the Business User as controller and must be met even when Stripe is the processor holding the data. California's 45-day CCPA response timeframe applies similarly. (4) CONTRACT AND VENDOR IMPLICATIONS: Business Users' contracts with Stripe (including the DPA) should expressly address the procedure and timeline for relaying End Customer rights requests. The DPA should confirm that Stripe will provide sufficient information to enable the Business User to respond to data subjects within regulatory deadlines. Procurement teams should verify these provisions are current. (5) COMPLIANCE CONSIDERATIONS: Business Users should implement intake and escalation procedures for data subject rights requests from End Customers, including clear identification of whether Stripe or the Business User holds the requested data, and SLA agreements with Stripe for rights request relay and response.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
Many consumers who encounter Stripe only through third-party merchant checkouts may not realize that their direct rights against Stripe are limited in that context, and that they must contact the merchant to exercise certain privacy rights.
End Customers whose data Stripe processes on behalf of a Business User merchant may need to direct access, deletion, or correction requests to the merchant rather than to Stripe, as the policy establishes distinct roles for each data subject category.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stripe.