If you paid through a website or app that uses Stripe (rather than using Stripe directly), Stripe acts as a service provider to that merchant and you must contact the merchant — not Stripe — to exercise most of your privacy rights.
If you are an End Customer — meaning you paid through a merchant that uses Stripe — you cannot directly request data deletion or access from Stripe and must route your request through the merchant, which may be difficult if you have no ongoing relationship with that merchant.
How other platforms handle this
Waze may offer you the option to link Waze to third party services that may be useful to you (like, Spotify). Where Waze detects an integration may be available (either because a third party service attempts to link to Waze, or Waze detects an installed service on the device which has an integration...
If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, then your Personal Information may be transferred as part of such a transaction, as permitted by law and/or contra...
The personal data is transferred to countries recognized as offering an equivalent level of protection or, One of the mechanisms offering appropriate guarantees is implemented (for example, the adoption of the standard contractual clauses of the European Commission.
Millions of consumers interact with Stripe only through third-party merchant checkouts and may not realize that to delete or access their payment data held by Stripe, they must go through the merchant who collected it, creating a practical barrier to exercising data rights.
REGULATORY FRAMEWORK: The processor/controller distinction implicates GDPR Arts. 4(7), 4(8), 26, and 28; CCPA §1798.140 definitions of 'service provider' and 'business'; and UK GDPR equivalent provisions. GDPR Art. 17 (right to erasure) and Art. 15 (right of access) are technically exercisable against the controller (merchant), not the processor (Stripe), though GDPR Art. 28(3)(e) requires processors to assist controllers in fulfilling data subject requests.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.