Stripe acts as either the entity in charge of your data (controller) or as a processor acting on behalf of businesses, depending on the service — and the Policy directs you to a separate document to find out which applies to you.
Because Stripe acts as both a controller and processor in different contexts, consumers may find it unclear who is responsible for handling their data rights requests, and may be redirected between Stripe and the merchant when trying to exercise rights like deletion or access.
Cross-platform context
See how other platforms handle Stripe's Dual Role as Controller and Processor and similar clauses.
Compare across platforms →Stripe's shifting role between controller and processor affects who is responsible for your data rights and who you can hold accountable — but this Policy doesn't tell you which role applies to your situation without consulting a separate Privacy Center document.
REGULATORY FRAMEWORK: GDPR Arts. 4(7) (controller definition), 4(8) (processor definition), 28 (processor obligations), and 26 (joint controller arrangements) are directly implicated. The determination of controller vs. processor status affects which party bears primary GDPR accountability, which DPA applies, and who must respond to data subject requests. CCPA §1798.140(ag) defines 'service provider' vs. 'third party' with similar accountability implications. UK GDPR mirrors these definitions.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.