This is Stripe's privacy policy explaining how the company — which powers payment processing for millions of online businesses — collects and uses your personal data when you make purchases at any site using Stripe, create a Stripe account, or use products like Link. The most important thing to know is that Stripe collects your financial transaction history, device data, identity verification information, and behavioral data, and shares it with banks, payment networks, fraud-prevention services, and the businesses you buy from. You can exercise rights to access, correct, delete, or export your personal data by visiting Stripe's Privacy Center at stripe.com/legal/privacy-center or contacting privacy@stripe.com.
Stripe's Privacy Policy governs the collection, use, and sharing of Personal Data across its Business Services (payment infrastructure for merchants), End User Services (direct consumer products like Link), and its Sites, with Stripe acting as either data controller or data processor depending on context. The Policy obligates Stripe to disclose data sharing with Financial Partners, Stripe Affiliates, service providers, and third parties for fraud prevention, identity verification, and compliance purposes, while granting users rights to access, delete, correct, and port their data. Notably, Stripe collects data from third-party sources including data brokers, public databases, and social media platforms, and shares transaction-level Personal Data with Financial Partners and Business Users in ways that end consumers may not anticipate given Stripe's typically invisible role in payment flows. The Policy engages GDPR (EU/UK), CCPA/CPRA (California), and various financial services regulations applicable to payment processors, with Stripe's Privacy Center referenced repeatedly for jurisdiction-specific details that are not fully disclosed within the Policy itself. Material compliance considerations include Stripe's dual role as controller and processor creating complex accountability chains, cross-border data transfers under SCCs and the EU-U.S. Data Privacy Framework, and the use of transaction data for fraud network and machine learning purposes that may implicate automated decision-making provisions under GDPR Art. 22.
🔒 Institutional analysis locked
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.
Upgrade to Professional — $149/mo5 changes analyzed since monitoring began.
This new provision discloses a significant expansion in data sources and combination practices that was not previously explicitly mentioned, raising transparency concerns about third-party data acquisition.
This new provision explicitly details the use of personal data for machine learning model training and refinement, which is a more specific and potentially broader use case than the previous generic fraud prevention language.
This new provision explicitly articulates Stripe's dual role and legal relationship complexity, which is important for data subjects to understand their rights and which entity they should contact.
This new provision introduces explicit disclosure of biometric data collection (facial images) as part of KYC processes, representing a significant expansion in sensitive personal data categories requiring enhanced transparency.
The removal of this comprehensive enumeration of collected data categories makes the current policy less transparent about the specific types of personal data Stripe collects during normal operations.
The removal of explicit guidance routing end customer privacy rights through merchants may create confusion about who is responsible for handling data subject requests in multi-party transaction scenarios.
The removal of this high-severity provision explicitly stating the legal basis (legitimate interests) for fraud detection and automated processing eliminates important transparency about the lawful grounds for sensitive processing activities.
The removal of this data retention provision eliminates transparency about how long Stripe retains personal data and under what circumstances extended retention periods apply.
Expanded rationale for sharing to explicitly include fraud detection, prevention, and identity verification as separate purposes beyond generic legal compliance.
Removed broad language about 'other legally recognized transfer mechanisms' and added specific reference to the UK Extension to the EU-U.S. Data Privacy Framework, making the policy more precise about available legal bases.
Removed explicit mention of 'right to withdraw consent', added 'right to lodge a complaint with a supervisory authority', and removed reference to Privacy Center contact details.
Shifted focus from detailed enumeration of technical data points to functional purposes of tracking, added 'deliver relevant advertising' as explicit use case, and delegated detailed information to separate Cookies Policy.
Cross-platform context
See how other platforms handle Collection from Third-Party Data Sources and similar clauses.
Compare across platforms →Stripe's terms allow fund reserves, payout withholding, and account termination at their sole discretion. Here is what business owners need…