Stripe privacy disclosures

What the Stripe agreement asks of merchants

The Stripe Services Agreement requires the user to obtain all necessary rights and consents sufficient to enable Stripe to lawfully collect, use, retain, and disclose the data it receives about the user's customers. In practice that means your privacy policy should tell customers that payment data is shared with Stripe and why. For Canada, section 13.4 of the agreement requires the user to disclose in its privacy policy that personal data may be transferred, processed, and stored outside of Canada. If you sell to Canadian customers, include that statement.

Card data: do not overstate what you store

When you use Stripe Checkout, Payment Links, or Stripe Elements, card numbers are entered into Stripe-hosted fields and are not stored in your database. Your policy should say that Stripe handles full card details and that you receive limited information such as the card brand, last four digits, expiry, and payment status. If you do store full card data yourself, which brings extensive security obligations, the policy must say so; the questionnaire asks this question directly.

Records you keep as a merchant

You typically retain customer name and email, billing and shipping addresses, order contents, amounts and currency, tax details, Stripe customer, payment, subscription, refund, and dispute identifiers, and payment status. These records support delivery, customer service, accounting, tax, chargeback handling, and legal obligations. State the purposes and the retention approach, for example keeping invoices for statutory accounting periods.

Fraud prevention and Stripe's own processing

Stripe uses payment, device, and behavioral information to detect fraud and to meet financial regulation, and for some of that processing it acts under its own privacy policy rather than purely on your instructions. Your policy can explain that Stripe processes information for payment processing, fraud prevention, and compliance, and link Stripe's privacy policy so customers can read how Stripe handles data in its own role. Avoid claiming that Stripe is merely your processor for every purpose.

Checkout settings that reference your policies

Stripe-hosted Checkout can display links to your terms of service and privacy policy when these are enabled in Checkout settings and the URLs are set in your account's public details. Stripe's documentation describes the privacy policy link as optional, but if you require customers to accept your terms with consent collection, you must first set a terms of service URL. Collecting consent for promotional emails at checkout is also available. Point these settings to the same stable URLs used in your site footer.

Subscriptions, invoices, and emails

Subscription businesses should explain recurring billing records, renewal and failed-payment emails, and how customers manage payment methods, for example through the Stripe customer portal. If Stripe sends receipts or invoices on your behalf, say that billing emails may come from Stripe. Marketing emails need their own consent or opt-out handling and should be described in the communications section.

International transfers and regions

Stripe processes data in multiple countries. Your transfer section should cover payment data going to Stripe and the safeguard relied on for EU and UK customers, and include the Canadian disclosure where relevant. California and other US state disclosures should list payment-related categories such as identifiers, commercial information, and financial information as collected.

Disputes, refunds, and identity checks

Chargebacks and refunds require sharing order details, delivery evidence, and customer communications with Stripe and the card networks. Some payment methods and payouts involve identity verification or sanctions screening performed by Stripe. Marketplaces and platforms using Stripe Connect also pass information about sellers to Stripe for onboarding. If any of these apply to you, describe the data involved and the purpose, and keep the retention statement consistent with how long dispute evidence is needed.

How the generator writes payment clauses

Answering yes to payments asks for the payment provider, payment types such as one-time, recurring, or marketplace, whether you store full card data, and whether an app store handles purchases. Naming Stripe activates payment clauses that describe provider card handling, merchant records, and fraud prevention without claiming card storage. The e-shop sample shows the resulting wording for a fictional store.

Common questions