If you are an End Customer who interacted with Stripe through a merchant's checkout, your privacy rights may need to be exercised through that merchant rather than directly through Stripe, because Stripe processes your data as a service provider for the merchant.
This analysis describes what Stripe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Many consumers who encounter Stripe only through third-party merchant checkouts may not realize that their direct rights against Stripe are limited in that context, and that they must contact the merchant to exercise certain privacy rights.
Interpretive note: The precise allocation of controller versus processor responsibility for specific End Customer data flows depends on the contractual arrangements between Stripe and each Business User, which vary and are not fully described in this policy.
Introduces complexity around data subject identity and rights differentiation based on user role, potentially affecting how rights are applied to different parties.
View full change record →End Customers whose data Stripe processes on behalf of a Business User merchant may need to direct access, deletion, or correction requests to the merchant rather than to Stripe, as the policy establishes distinct roles for each data subject category.
How other platforms handle this
If you are an end user in a Workspace not owned by you and wish to update, delete, or receive any information we have about you, you may do so by contacting the organization who owns your ClickUp Workspace.
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
to request that your data be transferred to a third party (data portability)
"Depending on the context, "you" might be an End Customer, End User, Representative, or Visitor.Excerpt from Stripe's Privacy Policy
(1) REGULATORY LANDSCAPE: The End Customer rights routing framework engages GDPR Article 28 (processor obligations to assist controllers with data subject rights) and CCPA service provider provisions.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Many consumers who encounter Stripe only through third-party merchant checkouts may not realize that their direct rights against Stripe are limited in that context, and that they must contact the merchant to exercise certain privacy rights.
End Customers whose data Stripe processes on behalf of a Business User merchant may need to direct access, deletion, or correction requests to the merchant rather than to Stripe, as the policy establishes distinct roles for each data subject category.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stripe.