Stripe, Inc. is a privately held payments-infrastructure company dual-headquartered in San Francisco and Dublin that processed $1.9T in payment volume in 2025. Consumers rarely deal with Stripe directly: its privacy policy classifies people who pay Stripe-powered merchants as "End Customers" whose personal data — transaction history, device data, and in some flows government ID — Stripe collects for payments, fraud prevention, and AI training. Radar, its fraud product, scores transactions with AI trained on more than 70 trillion data points across the Stripe network, and Link stores consumers' payment credentials for reuse at hundreds of thousands of merchants. Stripe runs no ad-based business, holds PCI DSS Level 1 certification with a bug bounty, and has no major first-party breach on record, but consumer class actions have challenged data collection by its checkout code on merchant sites.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
13 ON FILE
COLLECTION
Link, Stripe's consumer-facing wallet product, stores consumers' payment methods with Stripe itself and makes those credentials reusable at any Link-enabled merchant; Stripe states Link reaches over 300 million consumers, meaning Stripe holds stored payment credentials and cross-merchant checkout data beyond any single merchant relationship.
As assessed by PrivacySpy on 2023-08-08 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service allow you to permanently delete your personal data? — Yes, by contacting someone.
Stripe's Privacy Policy (last updated April 28, 2026) classifies consumers who pay merchants using Stripe as "End Customers" — people whose personal data (transaction data, device information, and in some verification flows government ID and biometric comparison data) Stripe collects and processes even though they have no direct customer relationship with Stripe.
Stripe maintains a public Privacy Center that explains its dual data-protection roles for end-customer payment data — processor when facilitating payments at a merchant's direction, controller when it determines purposes such as fraud prevention — and documents how end customers can exercise data-protection and deletion rights.
Stripe is a privately held company with dual headquarters in San Francisco and Dublin that publicly names its leadership (Patrick Collison, cofounder and CEO; John Collison, cofounder and president) and discloses scale figures on its newsroom page; as a private company it files no SEC reports, so its financial and governance disclosure is voluntary.
As assessed by PrivacySpy on 2023-08-08 (see PrivacySpy's rubric entry for this product for the per-claim citation): Is the policy's history made available? — Only the date it was last modified.
Stripe Radar's product page states its fraud-scoring AI is trained on data aggregated across the entire Stripe network rather than any single merchant, and that 92% of charges come from cards Stripe has already seen — transaction data generated at one merchant's checkout informs risk decisions for every other Stripe merchant.
As assessed by PrivacySpy on 2023-08-08 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes.
Stripe's Privacy Policy (last updated April 28, 2026) permits providing end-customer personal data, including attempted transactions, to other Business Users and Financial Partners to assess fraud or loss risk, while separately stating that Stripe does not transfer personal data to third parties in exchange for payment.
Stripe publishes a security documentation page describing PCI DSS Service Provider Level 1 certification (the most stringent level in the payments industry), AES-256 encryption of card numbers at rest, annual SOC 1 and SOC 2 Type II audit reports, and a vulnerability disclosure and bug bounty program run through HackerOne.
In Silver v. Stripe, Inc. (N.D. Cal.), a putative class action claiming Stripe collected and used personal information from visitors to merchant partners' websites, the court on July 28, 2021 dismissed the wiretap claims based on consent but allowed invasion-of-privacy and Unfair Competition Law claims over Stripe's alleged dissemination of data to third parties to proceed past the pleading stage.
A class-action complaint filed May 1, 2024 against retailer Crumbl alleges that Stripe's embedded web-tracking technology collected consumers' names, addresses, IP addresses, geolocation, and payment information from Crumbl's website without consumer consent and remained on consumers' browsers after purchase; these are allegations in pending litigation, not adjudicated findings.
Stripe's Cookies Policy (effective June 20, 2024) states that stripe.com uses advertising cookies to target Stripe ads on other sites and measure engagement, and that third-party cookies on its services are set by other companies such as Google and Facebook; users can opt out via Stripe's Cookies & Consent Settings Dashboard.