Stripe Services Agreement — Service Terms

Use & Processing · Company practice

India: Stripe may serve you from systems abroad; tell Customers their data may leave India and get their consents

For Users in India, Stripe will provide the Services from systems located in India or in other countries, to the extent applicable Law permits, and will provide Payment Processing Services in compliance with the RBI circular of April 6, 2018 on 'Storage of Payment System Data'. The User must disclose to its Customers that Data may be transferred, processed and stored outside India in compliance with Law and, as set out in Stripe's Privacy Policy, may be disclosed as Laws require, and must obtain from Customers all consents applicable Laws require for this.

Supporting quotations

15.10 Provision of Services from Systems located outside of India.

Stripe will provide the Services from systems located within India or other countries outside of India (to the extent permissible under applicable Law). Without limiting the generality of the prior sentence, Stripe will provide Payment Processing Services in compliance with circular dated April 6, 2018 on ‘Storage of Payment System Data’ issued by the Reserve Bank of India. It is User’s obligation to disclose to User’s Customers that Data may be transferred, processed and stored outside of India (in compliance with applicable Law) and, as set forth in Stripe’s Privacy Policy, may be subject to disclosure as required by applicable Laws, and to obtain from User’s Customers all necessary consents under applicable Laws in relation to the foregoing.

Qualifications & exceptions

• Applies to Users in India.
• Cross-border provision is limited to what applicable Law permits.
• Stripe's Privacy Policy is referenced but not supplied.

Not stated here

• Which countries' systems are used is not stated.

Use & Processing · Procedure

You must meet network data-quality rules and keep collected data accurate; Stripe may set criteria for trusted agents

As the Payment Method Requirements require and to the extent applicable, the User must meet data quality requirements for the relevant categories of Agentic Transaction data, comply with the Agentic Payment Method Provider's technical specifications for that data, and ensure Agentic Payment Account Details and other information it collects through the Service are accurate and complete. Stripe may develop a framework for identifying trusted agents; to qualify, the User must comply with the trusted-agent criteria Stripe provides or publishes.

Supporting quotations

As required by the Payment Method Requirements and to the extent applicable to User's performance under these Agentic Commerce Agent Terms, User must: (a) meet data quality requirements for relevant categories of Agentic Transaction data (as described in the Payment Method Requirements); (b) comply with all technical specifications mandated by the relevant Agentic Payment Method Provider with respect to Agentic Transaction data; and (c) ensure that Agentic Payment Account Details, and any other information that User collects in connection with the Agentic Commerce Agent Services, is accurate and complete.

Stripe may develop a framework for identifying trusted agents. To qualify as a trusted agent, User must comply with the criteria for trusted agents that Stripe provides to User or publishes.

Qualifications & exceptions

• Data quality duties apply 'to the extent applicable to User's performance'.
• The trusted-agent framework is optional for Stripe ('may develop'); the criteria are not in these terms.

Not stated here

• What benefits or consequences attach to trusted-agent status is not stated.

Use & Processing · Restriction or exception

No training AI on catalog, personal, Radar, payment or transaction data, no profiling, no reuse of catalog data

The User must not use Agentic Catalog Data, Personal Data, Stripe Radar Data, Agentic Payment Account Details or Agentic Transaction data, even aggregated, to create, improve, train or enhance its own or any third party's machine learning or AI models, tools, technology, systems, modules or algorithms. It must not process Personal Data to evaluate, analyze or predict the characteristics or behavior of data subjects (Profiling), including behavioral profiles, predictive models or look-alike audiences, and must not subject data subjects to automated decision-making or Profiling with legal or similarly significant effects. Agentic Catalog Data, the information about an Agentic Seller's goods or services such as descriptions, pricing, images and availability, may be used only in connection with the User's use of the Service under these terms.

Supporting quotations

3. Services Restrictions.

User must not use Agentic Catalog Data, Personal Data, Stripe Radar Data, Agentic Payment Account Details, or Agentic Transaction data (including aggregated data) to create, improve, train, or enhance User Systems or any third party's machine learning or artificial intelligence models, tools, technology, systems, modules, or algorithms.

User must not process Personal Data for the purpose of evaluating, analyzing, or predicting the characteristics or behavior of data subjects ("Profiling"). This includes the creation of behavioral profiles, predictive models, or "look-alike" audiences. User must not subject data subjects to any automated decision-making or Profiling that produces legal or similarly significant effects.

User must not use Agentic Catalog Data received via Stripe for any purpose other than in connection with User's use of the Agentic Commerce Agent Services in accordance with these Agentic Commerce Agent Terms.

"Agentic Catalog Data" means information about an Agentic Seller’s goods or services, including but not limited to descriptions, disclaimers, links to terms or policies, product variants, images, pricing, availability and any additional data used to facilitate a sale to Agentic Customers.

Qualifications & exceptions

• The training ban covers aggregated data and third-party models as well as the User's own.
• Profiling is banned for any purpose, and automated decision-making with legal or similarly significant effects is banned.

Not stated here

• Personal Data is a capitalized term defined elsewhere in the Agreement, not in this packet.

Use & Processing · Restriction or exception

Stripe may give you and sellers Radar fraud data, usable only to manage fraud on agent transactions; Radar Terms prevail

Stripe may provide the User and, where applicable, Agentic Sellers with Stripe Radar Data for the purpose of managing transaction fraud on Agentic Transactions. The User must use any Stripe Radar Data solely for that purpose and in accordance with the Stripe Radar Terms. If these Agentic Commerce Agent Terms conflict with the Stripe Radar Terms, the Radar Terms prevail.

Supporting quotations

Stripe may provide User and Agentic Sellers (if applicable) Stripe Radar Data for the purpose of managing transaction fraud on Agentic Transactions. User must use any Stripe Radar Data: (a) solely for the purpose stated in this Section 3.4; and (b) in accordance with the Stripe Radar Terms. If there is a conflict between the terms of these Agentic Commerce Agent Terms and the Stripe Radar Terms, the Stripe Radar Terms prevail.

Qualifications & exceptions

• Provision of Radar Data is at Stripe's option ('may provide').
• The purpose limit is strict: solely managing transaction fraud on Agentic Transactions.
• The Stripe Radar Terms prevail over these terms on conflict.

Not stated here

• The Stripe Radar Terms are a later section of this document, analyzed in its own packets.

Use & Processing · Restriction or exception

You and your sellers manage fraud on agent sales; Radar scores Stripe shares are Stripe Radar Data under the Radar Terms

The User and any Participating Sellers will manage transaction fraud on AC Transactions. The User may use Stripe Radar Data it receives from Stripe, if any, for that purpose in accordance with the Stripe Radar Terms. Any Radar Scores and other fraud signals shared with the User about the User, Participating Sellers or AC Transactions constitute Stripe Radar Data.

Supporting quotations

User and Participating Sellers (if applicable) will manage transaction fraud on AC Transactions. User may use Stripe Radar Data received from Stripe (if any) for that purpose in accordance with the Stripe Radar Terms. Any Radar Scores and other fraud signals shared with User relating to User, Participating Sellers (if applicable), or AC Transactions, constitute Stripe Radar Data.

Qualifications & exceptions

• Radar Data may be used for fraud management only, and only under the Stripe Radar Terms.

Not stated here

• Whether Stripe shares Radar Data with a particular User is not promised ('if any').

Use & Processing · Restriction or exception

You let the agent platform create Shared Payment Tokens and start checkouts; token data is for post-sale contact only

By using the Service for AC Transactions, the User authorizes the AC Interface Provider (the entity running the agentic interface) to create a Shared Payment Token, a limited reference to a payment method shared with the User or its Participating Sellers to facilitate AC Transactions, and, for certain Integrations, to initiate a checkout session on the User's behalf. The User must not access or use payment data received via a Shared Payment Token except as necessary for post-transaction customer engagement, must not try to use a token for more than one authorization unless the Documentation expressly permits, and must not try to use expired or revoked tokens. Where the Documentation requires, the User must report token usage through the Payment Records API.

Supporting quotations

By using the Stripe Agentic Commerce Seller Services in connection with AC Transactions, User authorizes AC Interface Provider to (a) create a Shared Payment Token to facilitate User’s or its Participating Seller’s AC Transactions; and (b) for certain Integrations, initiate a checkout session on User’s behalf. User must not (x) access or use any payment data received via a Shared Payment Token except as necessary for post-transaction customer engagement; (y) attempt to use a Shared Payment Token for more than one authorization (except as expressly permitted by the Documentation); or (z) attempt to use Shared Payment Tokens that are expired or revoked.

“Shared Payment Token” means a limited reference to a payment method that is created by an AC Interface Provider and shared with User or Participating Sellers to facilitate AC Transactions.

“AC Interface Provider” means the entity providing the AC Interface.

Qualifications & exceptions

• Payment data from a Shared Payment Token may be used only as necessary for post-transaction customer engagement.
• A token supports one authorization unless the Documentation expressly permits more.

Not stated here

• Which Integrations allow the AC Interface Provider to initiate checkout sessions is in the Documentation, not supplied.

Use & Processing · Restriction or exception

No selling or renting the Data, use it only as permitted, and never be or expose Stripe to a credit-reporting regime

The User must not sell, rent or otherwise make available Data, or let others do so, for any purpose, including marketing or offering Stripe Capital Financing. It may use Data related to the Service or a financing only as this Agreement or other written agreements with Stripe expressly permit and in compliance with Laws. The User must not be a consumer credit reporting governmental agency or entity in an Approved Territory, and must ensure its data sharing under these terms does not subject Stripe to consumer credit reporting Laws there.

Supporting quotations

User must not sell, rent, or otherwise make available, or allow others to sell, rent, or otherwise make available Data for any purposes, including marketing or the issuing or offering of Stripe Capital Financing. User will use Data related to the Stripe Capital for Platforms Services or a Stripe Capital Financing only: (a) as expressly permitted by this Agreement or other written agreements between Stripe and User (or their Affiliates); and (b) in compliance with Laws. User must not be a consumer credit reporting governmental agency or entity in an Approved Territory, and User must ensure that its data sharing under these Capital for Platforms Service Terms will not subject Stripe to any consumer credit reporting Laws in an Approved Territory.

Qualifications & exceptions

• The use limit is to express permissions in the Agreement or other written Stripe agreements.

Not stated here

• 'Data' is a capitalized term defined in the General Terms, not supplied.

Use & Processing · Restriction or exception

Program Data is Stripe’s; use it only for the Service and disclose it only to process recipients’ payments or as told

Program Data is Stripe Data. The User must not use it for any purpose unrelated to its use of the Capital for Platforms Services without Stripe's express written consent, and must not disclose it to third parties except as necessary to process Transactions for Financing Recipients with Stripe, in accordance with Law and the Card Network Rules, or as Stripe otherwise directs.

Supporting quotations

4.2 Program Data.

Program Data is Stripe Data. User must not use Program Data for any purpose unrelated to User’s use of Stripe Capital for Platforms Services without Stripe’s express written consent. User must not disclose Program Data to any third parties except as necessary to process Transactions for Financing Recipients with Stripe, and in accordance with Law and Card Network Rules, or as otherwise directed by Stripe.

Qualifications & exceptions

• Other uses need Stripe's express written consent.

Not stated here

• 'Stripe Data' is defined in the General Terms, not supplied.

Use & Processing · Restriction or exception

Each side uses Connected Account Data per its consents; you secure consents, and Stripe may refuse unlawful instructions

Each party may use Connected Account Data in accordance with the Agreement and any consent or agreement it obtains from each Connected Account, which for Stripe includes the Connected Account Agreement. The User must give all notices and obtain all rights and consents needed for Stripe to lawfully process Connected Account Data as the User instructs. Stripe may refuse to process the data as instructed if it reasonably believes compliance would require it to violate Law or the Connected Account Agreement.

Supporting quotations

4.4 Data Use.

Each party may use Connected Account Data in accordance with this Agreement and any consent or agreement it obtains from each Connected Account, which, as to Stripe, includes the Connected Account Agreement. User must provide all notices and obtain all necessary rights and consents for Stripe to lawfully process Connected Account Data as User instructs. Stripe may refuse to process Connected Account Data as User instructs if Stripe reasonably believes complying with User’s instructions would require Stripe to violate Law or the Connected Account Agreement.

Qualifications & exceptions

• Stripe's refusal requires a reasonable belief that compliance would breach Law or the Connected Account Agreement.

Use & Processing · Restriction or exception

Piped Stripe Data is for accounting and analytics only; Radar and Identity data only for fraud or security; no PHI

The User must not access or use, or let anyone else access or use, the Data Pipeline Services and Stripe Data for any purpose other than the one they are provided for, or in violation of Law or any Service Terms. Stripe Data made available through the pipeline may be used only for accounting and financial reporting, business analytics or other accounting-related business purposes, unless the General Terms, these SDP Terms or other Service Terms restrict them. Stripe Radar Data and Identity Services Data (Stripe Data received through the Stripe Identity Services) delivered through the pipeline may be used only for security or fraud prevention or as Stripe agrees in writing. On request the User must demonstrate compliance to Stripe's reasonable satisfaction, and neither the User nor its Connected Accounts may use the pipeline with Protected Health Information.

Supporting quotations

2.2 Restricted Uses.

User must not, and must not enable or allow any other party to, access or use the Stripe Data Pipeline Services and Stripe Data (a) for any purpose other than the purpose for which it is provided; or (b) in violation of any Law or Service Terms. If any Stripe Data is made available through the Stripe Data Pipeline Services, User must use that Stripe Data only for accounting and financial reporting, business analytics, or other accounting-related business purposes provided those purposes are not otherwise restricted by the General Terms, these SDP Terms, or any other Service Terms. Any Stripe Radar Data and Identity Services Data made available through Stripe Data Pipeline Services may only be used for security or fraud prevention purposes or as Stripe otherwise agrees in writing. Upon Stripe’s request, User will demonstrate its compliance with this section to Stripe’s reasonable satisfaction. User must not, and will ensure that its Connected Accounts (if applicable) do not, use the Stripe Data Pipeline Services in connection with Protected Health Information.

“Identity Services Data” means any Stripe Data that User receives from Stripe in connection with the Stripe Identity Services.

Qualifications & exceptions

• General Stripe Data: accounting, financial reporting, business analytics and accounting-related purposes only.
• Radar and Identity data: security or fraud prevention only, unless Stripe agrees otherwise in writing.
• Protected Health Information is excluded for the User and its Connected Accounts.

Use & Processing · Procedure

At least 14 days before collecting account data, get Stripe’s written approval of your purpose and consent screen

At least 14 days before first collecting Connections Data, the User must submit its Proposed Purpose for collecting, using and processing the data and, if it hosts the consents itself, the Proposed Express Consent UI it will use to obtain Express Consents (a Connections End User's express, informed, opt-in consent) on behalf of the User and Stripe. Stripe reviews promptly; on written approval the purpose becomes the Authorized Purpose and the interface the Express Consent UI. Any change to either must be submitted for review and approved in writing at least 14 days before it takes effect.

Supporting quotations

2. Use of the Stripe Financial Connections Services.

2.1 Authorized Purpose and Express Consent UI.

At least 14 days before User intends to collect Connections Data for the first time, User must submit (i) its intended purpose for collecting, using, and processing Connections Data (the “Proposed Purpose”); and (ii) if User hosts the Express consents, the user interface it will use to obtain Express Consents (the “Proposed Express Consent UI”) on behalf of User and Stripe for access to Connections Data. Stripe will promptly review User's Proposed Purpose and Proposed Express Consent UI. Upon Stripe’s written approval, the Proposed Purpose will become an "Authorized Purpose” and (if applicable) the Proposed Express Consent UI will become an “Express Consent UI”.

If User wishes to change an Authorized Purpose or an Express Consent UI, User must submit the proposed change to Stripe for review and obtain Stripe’s written approval at least 14 days before the proposed change is planned to take effect.

“Express Consent” means a Connections End User’s express, informed, opt-in consent to User’s collection, use, disclosure, and processing of that Connections End User’s Connections Data for the Authorized Purpose.

“Express Consent UI” means the user interface, including the text and consent mechanism included on that user interface, through which User obtains Express Consents.

Qualifications & exceptions

• Both the initial submission and any change require 14 days' lead time and Stripe's written approval.
• The consent UI submission applies only if the User hosts the consents itself.

Use & Processing · Restriction or exception

Never use account data without the person’s Express Consent, sell it, share it for marketing, or use it unlawfully

The User must not, and must not enable or allow any third party to, use a Connections End User's Connections Data in any way without an appropriate Express Consent from that person; sell any Connections Data; share it, including with any third party for use in marketing or for the third party's marketing purposes; or use or transfer it for fraudulent purposes or otherwise in violation of Law.

Supporting quotations

3.3 Using Connections Data.

User must not, and must not enable or allow any third party to:

use a Connections End User’s Connections Data in any way if User has not obtained an appropriate Express Consent from the applicable Connections End User

sell any Connections Data

share the Connections Data, including with any third party for use in marketing or for the third party’s marketing purposes

use or transfer the Connections Data for fraudulent purposes or otherwise in violation of Law.

Qualifications & exceptions

• The prohibitions extend to enabling or allowing third parties to do these things.

Use & Processing · Restriction or exception

Stripe is not a consumer reporting agency; do not use account data as or to build a consumer report without approval

Stripe is not a consumer reporting agency as defined in the FCRA, which these terms define as the Fair Credit Reporting Act and the Equal Credit Opportunity Act, both cited as 15 U.S.C. Section 1681 et seq. (external statutes cited by name only). Except as Stripe's authorized representative approves, the User must not use Connections Data in any way as a consumer report or to generate a consumer report under the FCRA.

Supporting quotations

3.4 FCRA Compliance.

Stripe is not a consumer reporting agency as defined in the FCRA. Except as Stripe’s authorized representative approves, User must not use any Connections Data (a) in any way as a consumer report; or (b) to generate a consumer report under FCRA.

“FCRA” means Fair Credit Reporting Act, 15 U.S.C. Section 1681, et seq. and Equal Credit Opportunity Act, 15 U.S.C. Section 1681, et seq.

Qualifications & exceptions

• Consumer-report use is allowed only with approval from Stripe's authorized representative.
• The statutory citation is external; the definition's citation of the same section for both Acts is reproduced as written.

Use & Processing · Company practice

Stripe acts as your processor for account data and separately asks end users to let it use the data as its own

Stripe, and any third party it engages, acts as the User's processor (service provider) in facilitating the User's access to Connections Data. In addition, through the Financial Connections Services Stripe asks Connections End Users for consent to separately collect, use, retain, disclose and process their Connections Data as an independent controller under the Stripe Consumer Terms of Service (the terms for End Users' use of Stripe's End User Services, linked) and Stripe's Privacy Policy. 'End User' and 'End User Service' take their meanings from the Privacy Policy and the Consumer Terms respectively.

Supporting quotations

3.5 Stripe as a Service Provider and Independent Controller.

Stripe, and any third party Stripe engages, will act as User’s processor (e.g., service provider) for the purposes of facilitating User’s access to Connections Data. In addition, Stripe will request, through the Stripe Financial Connections Services, consent from Connections End Users for Stripe to separately collect, use, retain, disclose, and process Connections Data as an independent controller of that data under the

“Stripe Consumer Terms of Service” means the terms that apply to an End User’s use of Stripe’s End User Services located at

“End User” has the meaning given to it in Stripe’s Privacy Policy.

“End User Service” has the meaning given to it in the Stripe Consumer Terms of Service.

Qualifications & exceptions

• Stripe wears two hats: processor for the User and independent controller under its own consumer terms.
• The Stripe Consumer Terms of Service and Privacy Policy are linked, not supplied.

Not stated here

• What Stripe does with the data as independent controller is governed by its Privacy Policy, not this document.

Use & Processing · Restriction or exception

You may use Stripe Identity only for legal compliance, fraud and misuse prevention, safety and permitted uses

The User may use the Stripe Identity Services only to evaluate the identity of Submitted Individuals to the extent necessary to meet the User's compliance obligations under Law; to prevent fraud related to the User's goods and services; to prevent misuse of them; to improve the safety or security of the User's business, operations and services; and in compliance with the Stripe Identity Permitted Businesses list.

Supporting quotations

2. Use of the Stripe Identity Services.

2.1 Permitted Uses.

User may use the Stripe Identity Services only:

(a) to evaluate the identity of Submitted Individuals to the extent necessary to satisfy User’s compliance obligations under Law;

(b) to prevent fraud as related to User’s goods and services;

(c) to prevent misuse of User’s goods and services;

(d) to improve the safety or security of User’s business, operations and services; and

(e) in compliance with the [Stripe Identity Permitted Businesses](https://stripe.com/docs/identity/use-cases) list.

Qualifications & exceptions

• Identity evaluation for compliance is limited to the extent necessary under Law.
• Use must also comply with the Stripe Identity Permitted Businesses list, which is external Documentation.

Use & Processing · Restriction or exception

You must not alter the Identity flow, call Stripe your due-diligence agent, disclose Identity data or compete

Beyond the unsupported or prohibited use cases in the Stripe Identity Permitted Businesses list, the User must not, and must not let anyone else, modify the Stripe Identity Services, including their branding, appearance, user experience or the manner or language used to obtain consent from Submitted Individuals; represent or imply that Stripe acts as the User's agent for meeting Due Diligence Requirements (AML, KYC, KYB and CDD obligations under Law); disclose Identity Services Data to any third party except as Law requires; use the Services or Identity Services Data to build or support a competing product; or use them in a way that would violate any Law.

Supporting quotations

2.2 Restricted Uses.

Without limiting the unsupported or prohibited use cases identified in the Stripe Identity Permitted Businesses list, User must not, and must not enable or allow any other party to:

(a) modify the Stripe Identity Services in any way, including by changing (i) the branding, appearance or user experience of the Stripe Identity Services; or (ii) the manner or language used to obtain consent from Submitted Individuals;

(b) represent or imply that Stripe is acting as User’s agent or appointed by User for the purpose of conducting or meeting User’s Due Diligence Requirements;

(c) disclose Identity Services Data to any third party, except as Law requires;

(d) use the Stripe Identity Services or Identity Services Data to create or support a product that competes with the Stripe Identity Services;

(e) use the Stripe Identity Services or Identity Services Data in a manner that would violate any Law;

“Due Diligence Requirements” means requirements imposed by Law that govern, are related to, or are similar to Anti-Money Laundering (AML), Know Your Customer (KYC), Know Your Business (KYB) and Customer Due Diligence (CDD).

“Identity Services Data” means any Stripe Data that User receives from Stripe in connection with the Stripe Identity Services.

Qualifications & exceptions

• Disclosure of Identity Services Data is allowed only where Law requires it.

Use & Processing · Restriction or exception

No selling Identity data, verifying people who cannot consent, or using results for credit, insurance, housing or jobs

The User must not reuse, sell, rent, transfer, make available or communicate Identity Services Data by any means, including a 'sale' as the CCPA defines it where applicable. The User must not use the Stripe Identity Services to evaluate an individual who cannot give legally binding consent because of age or any other reason. The User must not use the Services as a factor in deciding anyone's eligibility for credit, insurance, housing or employment, or in any way that would make Stripe a 'consumer reporting agency' or make the Stripe Data the User receives a 'consumer report' under Law.

Supporting quotations

(f) reuse, sell, rent, transfer, make available, or communicate orally or through other means the Identity Services Data (including as the term “sell” is defined in the CCPA, as applicable);

(g) use the Stripe Identity Services to evaluate an individual who is incompetent to provide legally binding consent because of their age or for any other reason; or

(h) use the Stripe Identity Services as a factor in determining any person’s eligibility for credit, insurance, housing or employment, or in a manner that would cause Stripe to be a “consumer reporting agency” or cause Stripe Data User receives to constitute a “consumer report”, each as described under Law.

“CCPA” means California Consumer Privacy Act of 2018, Cal. Civ. Code Sections 1798.100-1798.199.

Qualifications & exceptions

• The CCPA definition of 'sell' applies where that statute is applicable.

Use & Processing · Procedure

Offer a non-biometric option where Law requires, handle refusals yourself, use sensitive data only as stated

Where Law requires, the User must give each individual an alternative verification method that does not process biometric information. If an individual declines Selfie Verification (verification of an ID Image using biometric identifiers and facial recognition), the User may use the Services to offer an alternative without it. If an individual refuses the User's use of the Stripe Identity Services at all, Stripe need not perform them and the User alone must provide another way to evaluate that person. Any sensitive information the User receives in Identity Services Data, including government identification numbers, may be used only for the purposes in Section 3.2 (the purposes communicated to the individuals and disclosed to Stripe at onboarding) or as Law permits.

Supporting quotations

2.3 Further Obligations.

In connection with User’s use of the Stripe Identity Services:

(a) If Law requires, User must provide each individual with an alternative method of verification that does not involve processing any biometric information.

(b) If an individual does not consent to Selfie Verification, User may use the Stripe Identity Services to offer an alternative method of verification that does not use Selfie Verification.

(c) If an individual does not consent to User’s use of the Stripe Identity Services, then Stripe is not obligated to perform the Stripe Identity Services and User is solely responsible for providing an alternative means of evaluating that individual.

(d) To the extent User receives sensitive information (including any government identification numbers) in the Identity Services Data, User will use such information only for the purposes described in Section 3.2 of these Stripe Identity Terms, or as permitted under Law.

“Selfie Verification” means the verification of an ID Image using biometric identifiers and facial recognition technology.

User may use Identity Services Data solely for the purpose (i) that User communicated to the Submitted Individuals (and obtained their consent where required by Law); and (ii) that User disclosed to Stripe during the onboarding process for Stripe Identity Services.

Qualifications & exceptions

• The non-biometric alternative is mandatory only where Law requires it.
• Sensitive-data use is limited to Section 3.2 purposes or what Law permits.

Use & Processing · Company practice

Submitted ID data is Protected Data; Stripe may return verification and OCR results, which count as Stripe Data

Submitted Data, meaning all data, information, photos, ID Images and documents submitted through the Stripe Identity Services, is Protected Data under the Agreement. Unless the Stripe Identity Services Documentation says otherwise or the User instructs Stripe not to, Stripe may generate and give the User verification results and optical character recognition results from submitted documents. Those results are Stripe Data for purposes of the Agreement.

Supporting quotations

3. Use of Data.

3.1 Stripe’s Use of Submitted Data.

Submitted Data is Protected Data for purposes of this Agreement. As part of the Stripe Identity Services, unless the Stripe Identity Services Documentation specifies otherwise, or User instructs Stripe not to do so, Stripe may generate and provide to User verification results and optical character recognition (OCR) results from any documents submitted through the Stripe Identity Services. The results for the Stripe Identity Services are Stripe Data for the purposes of this Agreement.

“Submitted Data” means all data, information, photos, ID Images, and documents (including copies of documents) submitted through the Stripe Identity Services.

Qualifications & exceptions

• The User can instruct Stripe not to generate results, and the Documentation may vary the default.

Use & Processing · Restriction or exception

You may use Identity results only for the purpose you told the individuals and disclosed to Stripe at onboarding

The User may use Identity Services Data solely for the purpose it communicated to the Submitted Individuals, obtaining their consent where Law requires, and that it disclosed to Stripe during onboarding for the Stripe Identity Services. The User may use Submitted Data solely for the purpose it notified to the Submitted Individuals, again with consent where Law requires.

Supporting quotations

3.2 User’s Use of Identity Services Data and Submitted Data.

User may use Identity Services Data solely for the purpose (i) that User communicated to the Submitted Individuals (and obtained their consent where required by Law); and (ii) that User disclosed to Stripe during the onboarding process for Stripe Identity Services. User may use Submitted Data solely for the purpose that User notified Submitted Individuals (and obtained their consent where required by Law).

Qualifications & exceptions

• Consent from the individuals is required where Law requires it.

Use & Processing · Procedure

Every verification request must pass Stripe a link to the privacy policy version that applies to that individual

For each evaluation request submitted to the Stripe Identity Services, the User must use the Stripe API to give Stripe a link to the version of the User's online Privacy Policy that applies to the Submitted Individual, meaning the person whose Verification Data is submitted.

Supporting quotations

5. Privacy and Data Protection.

5.1 Disclosing User’s Privacy Policy.

In connection with each evaluation request that is submitted to the Stripe Identity Services, User must use the Stripe API to provide to Stripe a link to the version of User’s online Privacy Policy that applies to the Submitted Individual.

“Submitted Individual” means an individual whose Verification Data is submitted through the Stripe Identity Services.

Use & Processing · Company practice

Your privacy policy cannot contradict Stripe's data rights, and Stripe may notify or obtain consent itself

The User's Privacy Policy must not contain terms that contradict the rights of Stripe or its service providers to use Submitted Data for the purposes in these terms or as the Submitted Individual otherwise authorized, for example through consent screens in the Stripe Identity Services. Depending on the User's implementation, Stripe may itself give notice to or obtain consent from Submitted Individuals as described in the Stripe Identity Services Documentation so that it can provide the Services.

Supporting quotations

5.4 No Inconsistent Terms.

User’s Privacy Policy must not contain any terms that contradict Stripe’s or any Stripe service provider’s rights to use Submitted Data for the purposes described in these Stripe Identity Terms or as otherwise authorized by the Submitted Individual (e.g., through consent screens provided through the Stripe Identity Services).

5.5 Stripe may Notify or Obtain Consent.

Depending upon User’s implementation of the Stripe Identity Services, Stripe may provide notice to or obtain consent from Submitted Individuals as described in the Stripe Identity Services Documentation for the purpose of enabling Stripe to provide the Stripe Identity Services.

“Stripe Identity Services Documentation” means the Documentation, along with other documentation that Stripe makes available to User (including via email and the Stripe Dashboard), relating to the Stripe Identity Services.

Qualifications & exceptions

• Stripe's own notices or consent prompts depend on how the User implements the Services.

Use & Processing · Restriction or exception

No use of Stripe Identity for any FCRA 'permissible purpose' or in violation of the GLBA, DPPA, HIPAA or similar laws

The User must not use the Stripe Identity Services for any 'permissible purpose' as defined in the FCRA (the Fair Credit Reporting Act and Equal Credit Opportunity Act, 15 U.S.C. Section 1681 et seq.), or in a way that would violate the GLBA (Gramm-Leach-Bliley Act, 15 U.S.C. Sections 6802-6809), the United States Driver's Privacy Protection Act, the Health Insurance Portability and Accountability Act, or any substantially similar Law.

Supporting quotations

8. Restriction.

User must not use the Stripe Identity Services for any “permissible purpose” under (and as defined in) the FCRA, or in a manner that would violate the GLBA, the United States Driver's Privacy Protection Act, the United States Health Insurance Portability and Accountability Act, or other substantially similar Law.

“FCRA” means Fair Credit Reporting Act, 15 U.S.C. Section 1681, et seq. and Equal Credit Opportunity Act, 15 U.S.C. Section 1681, et seq.

“GLBA” means Gramm-Leach Bliley Act, 15 U.S.C. Sections 6802-6809.

Use & Processing · Restriction or exception

No use of Invoicing in ways the Documentation prohibits or with Protected Health Information, even by Connected Accounts

The User must not use the Stripe Invoicing Services in ways the Documentation expressly prohibits, and must not, and must ensure its Connected Accounts (Platform Users onboarded to a Stripe Connect Platform, or Payout Recipients) do not, use the Services in connection with Protected Health Information.

Supporting quotations

3. Services Restrictions.

User must not use the Stripe Invoicing Services in ways expressly prohibited in the Documentation. User must not, and must ensure that its Connected Accounts (if applicable) do not, use the Stripe Invoicing Services in connection with Protected Health Information.

“Connected Account” means (a) a Platform User that has a Stripe Account onboarded to a Stripe Connect Platform via the Stripe Connect Services; or (b) a Payout Recipient.

Qualifications & exceptions

• The Connected Account obligation applies only where the User has Connected Accounts.

Use & Processing · Permission or license

You authorize Stripe to surface your invoicing data in, and use it to power features of, your other Stripe Services

The User authorizes Stripe to make data from the User's use of the Stripe Invoicing Services available to the User in other Services the User uses, and to use it to enable features and functionality in those other Services.

Supporting quotations

4. Data Use.

User authorizes Stripe to make data from User’s use of Stripe Invoicing Services available to User in other Services that User uses and to enable features and functionality in other Services that User uses.

Qualifications & exceptions

• The data is made available to the User within other Services the User already uses.

Use & Processing · Restriction or exception

Use Personal Data tied to your Issuing Account only for internal business purposes and your Agreement duties

The User may use Personal Data related to its Stripe Issuing Account only for its internal business purposes and to fulfil its obligations under the Agreement.

Supporting quotations

11.2 User’s Use of Personal Data.

User must only use Personal Data related to User’s Stripe Issuing Account for User’s internal business purposes and to fulfil User’s obligations under this Agreement.

Qualifications & exceptions

• The limit covers Personal Data related to the User's Stripe Issuing Account.

Use & Processing · Restriction or exception

Data use: Stripe's rights follow the Agreement; you may use Personal Data for five purposes and never sell it

Between Stripe and an accountholder, Stripe's rights to use Protected Data generated by the Stripe Issuing Program are governed by the Agreement and the Accountholder Terms. The User may process, use and disclose Personal Data only (i) in connection with its use of the Issuing Platform Services; (ii) to give accountholders access to the Accountholder Services; (iii) for its own fraud prevention and loss mitigation; (iv) to fulfil its obligations to Stripe; and (v) to comply with Law and the Card Network Rules. The User must not sell, rent, transfer, make available or communicate any Personal Data to a third party for monetary or other valuable consideration. The User must obtain and maintain all rights and consents under Law to provide the User Information it gives Stripe about its Principal Owners, employees, contractors and agents, and its Connected Accounts, accountholders and Issuing Authorized Users.

Supporting quotations

10. Data Use.

10.1 Data Use.

(a) Stripe’s Data Use. As between Stripe and a Stripe Issuing Accountholder, Stripe’s rights to use Protected Data generated by the Stripe Issuing Program are governed by the Agreement and the Stripe Issuing Accountholder Terms.

(b) User’s Data Use. User may process, use, and disclose Personal Data only for the following purposes: (i) in connection with User’s use of the Stripe Issuing Platform Services; (ii) to provide Stripe Issuing Accountholders access to the Stripe Issuing Accountholder Services; (iii) in connection with User’s own fraud prevention and loss mitigation activities; (iv) to fulfil User’s obligations to Stripe; and (v) to comply with Law and the Card Network Rules. Without limiting the previous sentence, User must not sell, rent, transfer, make available or communicate orally or through other means any Personal Data to a third party for monetary or other valuable consideration.

(c) Data Collection. User must obtain and maintain all necessary rights and consents under Law to provide the User Information that User provides to Stripe about each of User’s (i) Principal Owners and employees, independent contractors and agents; and (ii) Connected Accounts, Stripe Issuing Accountholders and Issuing Authorized Users.

Qualifications & exceptions

• The five purposes are the only permitted uses of Personal Data.
• The ban on selling covers transfer to a third party for monetary or other valuable consideration.

Not stated here

• Protected Data is a defined term outside this packet.

Use & Processing · Restriction or exception

Use Personal Data only for internal business, never as a FCRA consumer report; Stripe may use it as the bank's terms say

The User must use Personal Data related to its Stripe Issuing Account only for its internal business purposes and to fulfil its obligations under the Agreement. It must not use Personal Data or Stripe Data as part of a 'consumer report' as the FCRA defines that term, or in any manner that could subject Stripe to the FCRA or any claim of unfair or illegal decision making. Without limiting its other rights under the Agreement, Stripe may process, use and disclose Personal Data for the purposes identified in the Issuing Bank Terms.

Supporting quotations

6.2 User’s Use of Personal Data and Stripe Data.

User must only use Personal Data related to User’s Stripe Issuing Account for User’s internal business purposes and to fulfill User’s obligations under this Agreement. User must not use Personal Data or Stripe Data as part of a “consumer report” as that term is defined in the FCRA or in any manner that could subject Stripe to the FCRA or any claim of unfair or illegal decision making.

6.3 Stripe’s Use of Personal Data on behalf of Issuing Bank.

Without limiting its other rights under the Agreement, Stripe may process, use and disclose Personal Data for the purposes identified in the Issuing Bank Terms.

Qualifications & exceptions

• Stripe's additional use of Personal Data is for the purposes in the Issuing Bank Terms.

Not stated here

• The Issuing Bank Terms listing Stripe's purposes are not supplied here.
• The FCRA is cited as a defined term and its text is not supplied.

Use & Processing · Restriction or exception

Data use: Stripe's rights follow the Card Program Terms; you use Personal Data for five purposes and never sell it

Between Stripe and an accountholder, Stripe's rights to use Protected Data generated by the Stripe Issuing Programs are governed by the Card Program Terms and the Issuing Authorized User Terms. The User may process, use and disclose Personal Data only (i) in connection with its use of the Issuing Platform Services; (ii) to give accountholders access to the Accountholder Services; (iii) for its own fraud prevention and loss mitigation; (iv) to fulfill its obligations to Stripe or an Issuing Bank; and (v) to comply with Law and the Card Network Rules. The User must not sell, rent, transfer, make available or communicate any Personal Data to a third party for monetary or other valuable consideration. It must also obtain and maintain all rights and consents under Law to provide the User Information it gives Stripe and the Issuing Bank about its Principal Owners, employees, contractors and agents, and its Connected Accounts, accountholders and Issuing Authorized Users.

Supporting quotations

10. Data Use.

10.1 Data Use.

(a) Stripe’s Data Use. As between Stripe and a Stripe Issuing Accountholder, Stripe’s rights to use Protected Data generated by the Stripe Issuing Programs are governed by the Card Program Terms and the Issuing Authorized User Terms.

(b) User’s Data Use. User may process, use, and disclose Personal Data for only the following purposes: (i) in connection with User’s use of the Stripe Issuing Platform Services; (ii) to provide Stripe Issuing Accountholders access to the Stripe Issuing Accountholder Services; (iii) in connection with User’s own fraud prevention and loss mitigation activities; (iv) to fulfill User’s obligations to Stripe or an Issuing Bank; and (v) to comply with Law and the Card Network Rules. Without limiting the previous sentence, User must not sell, rent, transfer, make available or communicate orally or through other means any Personal Data to a third party for monetary or other valuable consideration.

(c) Data Collection. User must obtain and maintain all necessary rights and consents under Law to provide the User Information that User provides to Stripe and the applicable Issuing Bank about each of User’s (i) Principal Owners and employees, contractors and agents; and (ii) Connected Accounts, Stripe Issuing Accountholders and Issuing Authorized Users.

Qualifications & exceptions

• The five purposes are the only permitted uses of Personal Data.
• The ban on selling covers transfer to a third party for monetary or other valuable consideration.

Not stated here

• Protected Data and the Card Program Terms are not defined or supplied in this document.

Use & Processing · Restriction or exception

Never use Personal Data or Stripe Data as a FCRA consumer report or in a way that exposes Stripe to the FCRA

The User must not use Personal Data or Stripe Data as part of a 'consumer report' as the FCRA defines that term. It must not use any Stripe Data in any manner that could subject Stripe to the FCRA or any claim of unfair or illegal decision making.

Supporting quotations

10.4 Additional Data Restrictions.

User must not use Personal Data or Stripe Data as part of a “consumer report” as that term is defined in the FCRA. User must not use any Stripe Data in any manner that could subject Stripe to the FCRA or any claim of unfair or illegal decision making.

Qualifications & exceptions

• The restriction covers both Personal Data and Stripe Data.

Not stated here

• The FCRA is cited as a defined term and its text is not supplied.

Use & Processing · Restriction or exception

You must use the fraud tools data under Stripe's Privacy Policy and keep personal data you provide accurate and complete

The User must use Advanced Fraud Tools Data only in accordance with Stripe's Privacy Policy, and must use reasonable efforts to make sure all Personal Data it provides to Stripe is accurate and complete. The Privacy Policy is a linked document that is not part of this saved text.

Supporting quotations

3.1 Privacy Policy.

User must only use Advanced Fraud Tools Data in accordance with [Stripe’s Privacy Policy](https://stripe.com/privacy).

3.2 Personal Data.

User must use reasonable efforts to ensure that all Personal Data that User provides to Stripe is accurate and complete.

Qualifications & exceptions

• Accuracy duty is a reasonable-efforts standard.

Not stated here

• The content of Stripe's Privacy Policy is not supplied here.

Use & Processing · Restriction or exception

No use of the fraud tools for credit, insurance, housing or employment decisions, discrimination or adverse action

The User must not, and must not let any third party, use the Advanced Fraud Tools Services or Data (a) as a factor in deciding anyone's eligibility for credit, insurance, housing or employment, or in a way that could make Stripe a consumer reporting agency or make the data a consumer report under the FCRA (if applicable); or (e) to discriminate on race, gender or other protected characteristics, or to take any adverse action as the FCRA describes it (if applicable).

Supporting quotations

User must not, and must not enable or allow any third party, to:

(a) use the Advanced Fraud Tools Services or Advanced Fraud Tools Data as a factor in determining any person’s eligibility for credit, insurance, housing or employment, or in any way that could cause Stripe to be a “consumer reporting agency” or cause any part of the Advanced Fraud Tools Data to constitute a “consumer report,” as each term is described in the FCRA (if applicable);

(e) use the Advanced Fraud Tools Services or Advanced Fraud Tools Data to discriminate based on race, gender, or other protected characteristics, or take any “adverse action” as that term is described in the FCRA (if applicable);

Qualifications & exceptions

• The FCRA references apply only if the FCRA applies.
• The ban reaches third parties the User enables or allows.

Use & Processing · Restriction or exception

No building competing models or products, training your own products, or evaluating outside transactions

The User must not, and must not let a third party, (d) use the Advanced Fraud Tools Services or Data to validate, train, enhance or deploy machine learning models or algorithms derived from, a substitute for, or substantially similar to the services, or to develop or commercially offer any security or fraud detection product or service; (f) except as Section 2 allows, use them to evaluate transactions not processed through the Services; or (g) use the services provided to train or improve the User's own products and services. Section 2 allows use for card transactions processed through a Third-Party Service.

Supporting quotations

User must not, and must not enable or allow any third party, to:

(d) use the Advanced Fraud Tools Services or Advanced Fraud Tools Data to (i) validate, train, enhance or deploy any machine learning models or algorithms that are derived from, a substitute for, or substantially similar to, the Advanced Fraud Tools Services; or (ii) directly or indirectly develop or otherwise make available on a commercial basis any security or fraud detection product or service;

(f) except as allowed under Section 2 of these Issuing Fraud Tools Services Terms, use the Advanced Fraud Tools Services or Advanced Fraud Tools Data to evaluate transactions not processed through the Services; or

(g) use Advanced Fraud Tools Services provided to train or improve User products and services.

Qualifications & exceptions

• The evaluation ban has an exception for what Section 2 allows.
• The ban reaches third parties the User enables or allows.

Not stated here

• Section 2 is cited as 'these Issuing Fraud Tools Services Terms', a name that differs slightly from 'Advanced Fraud Tools Terms'.

Use & Processing · Company practice

Fraud scores, levels, rates and alerts are snapshots that do not auto-update

Authorization Risk Scores, Card Testing Risk Levels, Merchant Dispute Rates, Compromised Card Alerts and Fraud Disputability Assessments are based on data available when each is generated and do not automatically update when that data later changes. The Advanced Fraud Tools Services use data from transactions processed through the Services.

Supporting quotations

5.2 Disclaimers.

(a) Authorization Risk Scores, Card Testing Risk Levels, Merchant Dispute Rates, Compromised Card Alerts, and Fraud Disputability Assessments are based on data available to the Advanced Fraud Tools Services at the time it is generated, and they do not auto-update to reflect any subsequent changes to that data.

(b) The Advanced Fraud Tools Services use data from transactions processed through the Services.

Qualifications & exceptions

• Outputs reflect the data available at the time they are generated.

Not stated here

• The terms do not say how often outputs are regenerated.

Use & Processing · Context

Definitions: fraud risk scores, levels, rates, assessments and alerts

Advanced Fraud Tools Data is the scores, levels, rates, assessments and alerts below plus all other data the User receives through the services. An Authorization Risk Score is a risk score or level for a Card Transaction Authorization based on Stripe Data, including the Merchant Dispute Rate and Card Testing Risk Level. A Card Testing Risk Level is the likelihood an authorization is or will be affected by Card Testing Attacks. A Merchant Dispute Rate assesses the historical dispute rate of a merchant's Transactions for the period Stripe has provided Stripe Payments Services to that merchant. A Fraud Disputability Assessment is the likelihood an authorization can be disputed if fraud occurs. A Compromised Card Alert is a notification that a card may have been compromised by a Card Testing Attack.

Supporting quotations

“Advanced Fraud Tools Data” means Authorization Risk Scores, Card Testing Risk Levels, Merchant Dispute Rates, Fraud Disputability Assessments, Compromised Card Alerts, and all other data User receives through the Advanced Fraud Tools Services.

“Authorization Risk Score” means a risk score or level associated with a Card Transaction Authorization based on Stripe Data, including the Merchant Dispute Rate and the Card Testing Risk Level.

“Card Testing Risk Level” means the level assigned to a Card Transaction Authorization that represents the likelihood the Card Transaction Authorization is or will be impacted by Card Testing Attacks.

“Fraud Disputability Assessment” means, with respect to a Card Transaction Authorization, an assessment of the likelihood that the Card Transaction Authorization can be disputed in the event of fraud.

“Merchant Dispute Rate” means an assessment of the historical dispute rate of a merchant’s Transactions for the time period during which Stripe has provided Stripe Payments Services to that merchant.

“Compromised Card Alert” means a notification that a card may have been compromised by a Card Testing Attack.

Qualifications & exceptions

• The scores are assessments of likelihood, not findings of fact.
• Merchant Dispute Rate looks only at the period Stripe has served that merchant.

Not stated here

• How the scores and levels are calculated is not stated.

Use & Processing · Restriction or exception

You must not profile data subjects or subject them to significant automated decision-making

The User must not process Personal Data to evaluate, analyze or predict the characteristics or behavior of data subjects (Profiling), including by building behavioral profiles, predictive models or look-alike audiences. The User must also not subject data subjects to automated decision-making or Profiling that has legal or similarly significant effects.

Supporting quotations

(e) No Profiling. User must not process Personal Data for the purpose of evaluating, analyzing, or predicting the characteristics or behavior of data subjects ("Profiling"). This includes the creation of behavioral profiles, predictive models, or "look-alike" audiences. User must not subject data subjects to any automated decision-making or Profiling that produces legal or similarly significant effects.

Qualifications & exceptions

• Profiling is defined in the clause as evaluating, analyzing or predicting characteristics or behavior.

Use & Processing · Company practice

You and Stripe are independent data controllers for Mutual End User data, each limited by Law and its own terms

The parties act as independent Data Controllers for Mutual End Users' Personal Data in connection with the Link Agent Wallet Services. Stripe may use that Personal Data only as Law and the Link End User Terms permit, and the User only as Law and the User End User Terms permit. The Link End User Terms govern a Mutual End User's use of Link and Stripe's use of their data; the User End User Terms govern a Customer's use of the User Agentic Agent and the User's use of their data.

Supporting quotations

Data Use.

For the avoidance of doubt, the parties act as independent Data Controllers with respect to Personal Data of a Mutual End User in association with the Link Agent Wallet Services. Stripe may only use that Personal Data to the extent permitted by Law and the Link End User Terms, and User may only use that Personal Data to the extent permitted by Law and the User End User Terms.

“User End User Terms” means the terms of service, data policies, and other published terms and policies that govern a Customer’s use of User Agentic Agent, and User’s use of the Customer’s Personal Data in connection therewith.

Qualifications & exceptions

• Each party is limited by Law and by its own end user terms.

Not stated here

• Neither set of end user terms is part of this saved text.

Use & Processing · Permission or license

Stripe includes SMP for privacy terms and may use Personal Data to run the service and ancillary activities

For the Privacy and Data Use section of the General Terms, references to Stripe also include SMP. By using the Service the User authorizes Stripe and its Affiliates to process Personal Data under applicable DP Law and the Data Processing Agreement. The User also authorizes them to use Personal Data, as Stripe determines, to provide the Service and for ancillary activities including customer support, order management, facilitating order fulfillment, managing tax remittance and ensuring legal compliance, in line with DP Law and the Data Processing Agreement.

Supporting quotations

6. Data Privacy.

6.1 Generally.

For purposes of the Privacy and Data Use section of the General Terms, references to Stripe also include SMP. By using the Stripe Managed Payments Service, User authorizes Stripe and its Affiliates to process Personal Data in accordance with applicable DP Law and the Data Processing Agreement. User also authorizes Stripe and its Affiliates to use Personal Data, as determined by Stripe, in connection with providing Stripe Managed Payments Service and for activities ancillary to the Stripe Managed Payments Service, including customer support, order management, facilitating order fulfillment, managing tax remittance, and ensuring compliance with applicable Law, in accordance with applicable DP Law and the Data Processing Agreement.

Qualifications & exceptions

• Use is under applicable DP Law and the Data Processing Agreement.
• Use covers the Service and ancillary activities, as Stripe determines.

Not stated here

• The Data Processing Agreement and the General Terms' privacy section are not in this saved text.

Use & Processing · Context

Orchestrated Services Terms add to the General Terms (last modified September 28, 2026)

These Stripe Orchestrated Services Terms, last modified September 28, 2026, supplement the General Terms, which they incorporate by reference, and govern use of the Stripe Orchestrated Services. Capitalized terms not defined here take their General Terms meaning.

Supporting quotations

Last modified: September 28, 2026

These terms (“Stripe Orchestrated Services Terms”) supplement the General Terms which are incorporated into these terms by this reference, and govern the use of the Stripe Orchestrated Services. Capitalized terms that are not defined in these terms have the same meanings given to them in the General Terms.

Use & Processing · Restriction or exception

Input Data you give Stripe must be accurate, complete and current, and supplied after payment where required

The User must (i) make sure Orchestrated Input Data is accurate, complete and current, and (ii) promptly give Stripe Orchestrated Input Data after a payment is processed where the Documentation requires. Orchestrated Input Data is any data the User gives Stripe so Stripe can perform the Orchestrated Services, including third party data in a Standalone 3DS request.

Supporting quotations

(c) Data. User must:

(i) ensure that Orchestrated Input Data is accurate, complete, and current;

(ii) promptly provide Stripe with Orchestrated Input Data after a payment is processed where required in the Documentation;

“Orchestrated Input Data” means any data provided by User to Stripe to enable Stripe to perform the Orchestrated Services, including (i) any third party data included in a Standalone 3DS request as described in the Documentation or otherwise envisaged by the Stripe Orchestrated Services, including without limitation acquirer BIN, merchant ID, and requestor ID and (ii) the results of previously-provided Orchestrated Input Data, which may include accuracy rate, outcome of the payment, User’s decision to process or decline the transaction, updates to the payment status, dispute rate, and dispute code, among other things.

Qualifications & exceptions

• Post-payment delivery applies where the Documentation requires it.

Not stated here

• The Documentation's requirements are not supplied.

Use & Processing · Restriction or exception

Output Data may not be used to train substitute models, be reverse engineered, or be used for marketing

The User must not (iii) use Orchestrated Output Data to develop, test, validate, train, enhance or deploy machine learning models or algorithms that substitute for or are substantially similar to the Services; (iv) modify it, create derivative works from it, disassemble, decompile or otherwise reverse engineer it, or try to derive source code or underlying structure, ideas or algorithms from it; or (v) use it for marketing purposes. Orchestrated Output Data is data the User receives through the Orchestrated Services that a proprietary Stripe model produced.

Supporting quotations

(c) Data. User must:

(iii) not use the Orchestrated Output Data to develop, test, validate, train, enhance, or deploy any machine learning models or algorithms that are a substitute for, or substantially similar to, the Services;

(iv) not modify, create derivative works from, disassemble, decompile, or otherwise reverse engineer or attempt to derive any source code or underlying structure, ideas, or algorithms from the Orchestrated Output Data; and

(v) not use the Orchestrated Output Data for marketing purposes.

“Orchestrated Output Data” means any data User receives through the Stripe Orchestrated Services which has been produced by a proprietary Stripe model.

Qualifications & exceptions

• Applies to Orchestrated Output Data produced by a proprietary Stripe model.

Use & Processing · Restriction or exception

You must hold the rights, consents and Customer disclosures that let Stripe lawfully process Orchestrated Data

The User must obtain and maintain all necessary rights, consents, approvals and authorizations, and give Customers all disclosures required, so that Stripe and its Affiliates can lawfully (i) provide the Orchestrated Services; (ii) store and use the User's Security Credentials (its or its Affiliate's API license keys and other credentials for Third-Party PSPs), related data and any Orchestrated Input Data as the Agreement and Documentation describe; and (iii) collect, use, retain and disclose the Orchestrated Data Stripe sends or receives, as the Agreement, Stripe's Privacy Policy and the Documentation describe. Orchestrated Data is data the User sends to or receives from Stripe through the services, including Third-Party PSP response data Stripe receives on the User's behalf, and may include Personal Data.

Supporting quotations

(d) General Obligations.

(ii) User must obtain and maintain all necessary rights, consents, approvals, and authorizations, and provide all disclosures to Customers, as required to enable Stripe and its Affiliates to lawfully: (i) provide the Stripe Orchestrated Services; (ii) store and use User's Security Credentials and any related data, and any Orchestrated Input Data as described in the Agreement and in the Documentation; and (iii) collect, use, retain and disclose the Orchestrated Data Stripe sends or receives in connection with the Stripe Orchestrated Services, as the Agreement, Stripe’s Privacy Policy and the Documentation describe.

“Security Credentials” means User's (or if applicable, User's Affiliate’s) API license keys and other security credentials for Third-Party PSPs.

“Orchestrated Data” means data that User sends to or receives from Stripe using the Stripe Orchestrated Services, which include response data that Stripe receives from Third-Party PSPs on User’s behalf, and may include Orchestrated Output Data, Orchestrated Input Data, and Personal Data.

Qualifications & exceptions

• The duty is framed as what Stripe needs to lawfully do its processing.

Not stated here

• The Privacy Policy and Documentation are linked and not supplied.

Use & Processing · Context

Definitions: Orchestrated Data, Orchestrated Input Data and Orchestrated Output Data

Orchestrated Data is data the User sends to or receives from Stripe using the Orchestrated Services, including response data Stripe receives from Third-Party PSPs on the User's behalf, and it may include Output Data, Input Data and Personal Data. Orchestrated Input Data is any data the User gives Stripe so it can perform the services, including third party data in a Standalone 3DS request (such as acquirer BIN, merchant ID and requestor ID) and results of previously provided Input Data (such as accuracy rate, payment outcome, the User's decision to process or decline, payment status updates, dispute rate and dispute code), among other things. Orchestrated Output Data is data the User receives through the services that a proprietary Stripe model produced.

Supporting quotations

“Orchestrated Data” means data that User sends to or receives from Stripe using the Stripe Orchestrated Services, which include response data that Stripe receives from Third-Party PSPs on User’s behalf, and may include Orchestrated Output Data, Orchestrated Input Data, and Personal Data.

“Orchestrated Input Data” means any data provided by User to Stripe to enable Stripe to perform the Orchestrated Services, including (i) any third party data included in a Standalone 3DS request as described in the Documentation or otherwise envisaged by the Stripe Orchestrated Services, including without limitation acquirer BIN, merchant ID, and requestor ID and (ii) the results of previously-provided Orchestrated Input Data, which may include accuracy rate, outcome of the payment, User’s decision to process or decline the transaction, updates to the payment status, dispute rate, and dispute code, among other things.

“Orchestrated Output Data” means any data User receives through the Stripe Orchestrated Services which has been produced by a proprietary Stripe model.

Qualifications & exceptions

• Input Data includes “among other things”, so the examples are not exhaustive.
• Orchestrated Data may include Personal Data.

Use & Processing · Context

Definitions: Orchestrated Services, Third-Party PSP and its agreement, Sub-users and Security Credentials

The Stripe Orchestrated Services let the User (a) receive Output Data from Stripe for specified purposes, (b) send certain Orchestrated Data to Third-Party PSPs, (c) capture and store Orchestrated Data from Third-Party PSPs, (d) send User Input Data to Stripe, and (e) otherwise carry out certain activities related to its business and transactions processed through Custom Payment Methods or Third-Party PSPs. A Third-Party PSP is the User's or its Affiliate's third-party payment services provider, such as a provider of payments processing, orchestration or token management, to which the User routes Orchestrated Data directly or indirectly. A Third-Party-PSP Agreement is the service agreement with it governing routing, processing, settlement or ancillary services. Sub-users are users of the User's or its Affiliate's platform services whom the user entity has enabled to accept card payments. Security Credentials are the User's (or Affiliate's) API license keys and other credentials for Third-Party PSPs.

Supporting quotations

“Stripe Orchestrated Services” means the Services that enable User to (a) receive Output Data from Stripe for specified purposes; (b) send certain Orchestrated Data to Third-Party PSPs; (c) capture and store Orchestrated Data from Third-Party PSPs; (d) send the User Input Data to Stripe; and (e) otherwise conduct certain activities related to User’s business and transactions processed through Custom Payment Methods or Third-Party PSPs.

“Third-Party PSP” means User or User's Affiliate’s third-party payment services provider (such as a provider of payments processing, payments orchestration services, or token management services) to whom User directly or indirectly routes Orchestrated Data.

“Third-Party-PSP Agreement” means a service agreement between User (or if applicable, a User’s Affiliate) and a Third-Party PSP governing the routing, processing, settlement, or other ancillary services, for payment card transactions, which are being accessed in connection with the Stripe Orchestrated Services.

“Sub-users” means the users of User's or User's Affiliate’s platform services that the applicable user entity has enabled to accept card payments.

“Security Credentials” means User's (or if applicable, User's Affiliate’s) API license keys and other security credentials for Third-Party PSPs.

Use & Processing · Restriction or exception

No use of Radar for credit, insurance, housing or employment decisions, discrimination or adverse action

The User must not, and must not let any third party, use the Radar Services or Radar Data (a) as a factor in deciding anyone's eligibility for credit, insurance, housing or employment, or in a way that could make Stripe a consumer reporting agency or make the Radar Data a consumer report under the FCRA (as applicable); or (e) to discriminate on race, gender or other protected characteristics, or to take any adverse action as the FCRA describes it (as applicable).

Supporting quotations

4. Services Restrictions.

User must not, and must not enable or allow any third party to:

(a) use the Stripe Radar Services or Stripe Radar Data as a factor in determining a person’s eligibility for credit, insurance, housing or employment, or in any way that could cause Stripe to be a “consumer reporting agency” or cause the Stripe Radar Data to constitute a “consumer report,” in each case as described in the FCRA (as applicable);

(e) use the Stripe Radar Services or Stripe Radar Data to discriminate based on race, gender, or other protected characteristics, or take any “adverse action” as that term is described in the FCRA (as applicable);

Qualifications & exceptions

• The FCRA references apply only as applicable.
• The ban reaches third parties the User enables or allows.

Use & Processing · Restriction or exception

No building competing models or products, marketing use, or evaluating transactions outside the Services

The User must not, and must not let a third party, (d) use the Radar Services or Data to develop, test, validate, train, enhance or deploy machine learning models or algorithms that substitute for or are substantially similar to the Services, or to develop or commercially offer any security or fraud detection product or service; (f) use them for marketing purposes; or (h) except as Section 3 permits, use them to evaluate transactions not processed through the Services. Section 3 permits use for the User's transactions processed through Third-Party PSPs, for the Radar API Service only.

Supporting quotations

User must not, and must not enable or allow any third party to:

(d) use the Stripe Radar Services or Stripe Radar Data to: (i) develop, test, validate, train, enhance or deploy any machine learning models or algorithms that are a substitute for, or substantially similar to, the Services; or (ii) otherwise directly or indirectly develop or otherwise make available on a commercial basis any security or fraud detection product or service;

(f) use the Stripe Radar Services or Stripe Radar Data for marketing purposes;

(h) except as Section 3 of the Stripe Radar Terms permits, use the Stripe Radar Services or Stripe Radar Data to evaluate transactions not processed through the Services.

3. Permitted Use.

Qualifications & exceptions

• The evaluation ban has an exception for what Section 3 permits.

Use & Processing · Restriction or exception

Radar for Platforms: no test data use, and not the sole input into decisions about Connected Accounts

The User must not use the Stripe Radar for Platforms Service (i) for any purpose not tied to a live Transaction, such as test or dummy Account Features, or (ii) as the sole input into any decision-making process, such as automated decision-making or profiling, the User applies when deciding to begin, cease or refrain from a business relationship with any Connected Account. Account Features means Stripe's merchant level fraud protection system.

Supporting quotations

User must not, and must not enable or allow any third party to:

(g) use the Stripe Radar for Platforms Service: (i) for any purpose not associated with a live Transaction (e.g. test or dummy Account Features); or (ii) as the sole input into any decision making process (e.g. automated decision making, profiling) User applies when deciding to begin engaging, cease engaging, or refrain from engaging in a business relationship with any Connected Accounts; or

“Account Features” means Stripe’s merchant level fraud protection system.

Qualifications & exceptions

• Applies to the Radar for Platforms Service only.

Use & Processing · Restriction or exception

You choose your Radar rules, added rules may slow settlement, and Stripe may change rules without notice

The User is solely responsible for choosing which rules, default or custom, it uses with the Radar Services. Choosing to add and use additional rules may lengthen settlement times for applicable Transactions. Without further notice to the User, Stripe may make general or specific changes to the rules that may alter the Radar Services.

Supporting quotations

(b) Stripe Radar Services Rules. User is solely responsible for choosing which rules (default or custom) User uses with the Stripe Radar Services. User’s choice to input and use additional rules with the Stripe Radar Services may result in longer settlement times for applicable Transactions. Without further notice to User, Stripe may make general or specific changes to the rules that may alter the Stripe Radar Services.

Qualifications & exceptions

• Longer settlement is a possibility tied to added rules.
• Stripe's rule changes need no further notice.

Not stated here

• The terms give no figure for how much longer settlement may take.

Use & Processing · Restriction or exception

You must offer Connected Accounts human review and pass on reported Radar for Platforms errors to Stripe

The User will give Connected Accounts the chance to seek human review of any decision where the Radar for Platforms Service was an input. If a Connected Account gives the User additional information that the User believes shows imprecision, inaccuracies or errors in the Service or its operation, the User will give Stripe that information in the manner the Documentation prescribes.

Supporting quotations

(c) Connected Accounts. User will provide Connected Accounts with the opportunity to seek human review of any decisions User makes where the Stripe Radar for Platforms Service was used as an input into that decision. If a Connected Account provides User with any additional information that indicates what User believes to be imprecision, inaccuracies, or errors in the Stripe Radar for Platforms Service and/or in the operation of the Stripe Radar for Platforms Service, User will provide Stripe with this additional information in a manner prescribed in the Documentation.

Qualifications & exceptions

• Applies to decisions where Radar for Platforms was used as an input.

Not stated here

• The Documentation's prescribed manner is not supplied.

Use & Processing · Company practice

Radar Scores are snapshots that do not auto-update, built from data on transactions through Stripe services

Each Radar Score is based on data available to the Radar Services when it is generated and does not automatically update when that data later changes. A Radar Score is a numerical risk score or level for a transaction, Connected Account or other related activity. The Radar Services use data from transactions processed through the Stripe services, which may include the User's Transactions.

Supporting quotations

5.2 Disclaimers.

(a) Radar Scores. Each Radar Score is based on data available to the Stripe Radar Services at the time it is generated, and the Radar Score does not auto-update to reflect a subsequent change to data that was used to generate that Radar Score.

(b) Data from Transactions. The Stripe Radar Services use data from transactions processed through the Stripe services, which may include User Transactions.

“Radar Score” means a numerical risk score or level associated with a transaction, Connected Account, or other related activity that the Stripe Radar Services provides.

Qualifications & exceptions

• A score reflects the data available at the time it was generated.

Not stated here

• The terms do not say how often scores are regenerated.

Use & Processing · Context

Definitions: Radar Score, Radar Data, Radar Services, Radar API Service and Radar for Platforms Service

A Radar Score is a numerical risk score or level for a transaction, Connected Account or other activity that the Radar Services provide. Radar Data is the Radar Scores and other data the User receives through the Radar Services and, as applicable, the Orchestrated Services. The Radar Services are the Services designed to let the User detect and evaluate the risk that a transaction, Connected Account or other activity is fraudulent. The Radar API Service includes an API through which the User sends Stripe Orchestrated Input Data and accesses the Radar Services and Orchestrated Output Data, to help detect and prevent fraud or unauthorized transactions in its business processed through other payment service providers. The Radar for Platforms Service helps detect and investigate whether Connected Accounts may be engaging in fraud.

Supporting quotations

“Radar Score” means a numerical risk score or level associated with a transaction, Connected Account, or other related activity that the Stripe Radar Services provides.

“Stripe Radar Data” means the Radar Scores and other data User receives through the Stripe Radar Services, and the Stripe Orchestrated Services (as applicable).

“Stripe Radar Services” means the Services that are designed to enable User to detect and evaluate the risk that a transaction, Connected Account, or other related activity is fraudulent.

“Stripe Radar API Service” means the Services, including an API, that (a) provide User with a means of sending to Stripe the Orchestrated Input Data and access to the Stripe Radar Services and the Orchestrated Output Data, and (b) is designed to enable User to help detect and prevent actual or potential fraud, or unauthorized transactions, related to User’s business and transactions processed through other payment service providers.

“Stripe Radar for Platforms Service” means the Services that are designed to enable User to help detect and investigate whether Connected Accounts may be engaging in actual or potential fraudulent behavior, in each case in connection with the Services.

“Orchestrated Input Data” means any data provided by User to Stripe to enable Stripe to perform the Orchestrated Services, including (i) any third party data included in a Standalone 3DS request as described in the Documentation or otherwise envisaged by the Stripe Orchestrated Services, including without limitation acquirer BIN, merchant ID, and requestor ID and (ii) the results of previously-provided Orchestrated Input Data, which may include accuracy rate, outcome of the payment, User’s decision to process or decline the transaction, updates to the payment status, dispute rate, and dispute code, among other things.

“Orchestrated Output Data” means any data User receives through the Stripe Orchestrated Services which has been produced by a proprietary Stripe model.

Use & Processing · Context

Definitions: Account Features and Connected Account

Account Features means Stripe's merchant level fraud protection system. A Connected Account is either a Platform User with a Stripe Account onboarded to a Stripe Connect Platform through the Stripe Connect Services, or a Payout Recipient.

Supporting quotations

“Account Features” means Stripe’s merchant level fraud protection system.

“Connected Account” means (a) a Platform User that has a Stripe Account onboarded to a Stripe Connect Platform via the Stripe Connect Services; or (b) a Payout Recipient.

Use & Processing · Restriction or exception

Where Law requires, you must tell your customers and counterparties that the Stablecoin Partner may process their data

Where Law requires, the User must make sure its customers and counterparties are told that it uses Stripe and the Stablecoin Partner for Stablecoin-related services, and that their data may be processed by the Stablecoin Partner under the Partner's privacy policy, as made available in the applicable Stablecoin Partner Terms.

Supporting quotations

User must ensure that, where required by Law, User's customers and counterparties are informed that User uses Stripe and the Stablecoin Partner in connection with Stablecoin-related services, and that their data may be processed by the Stablecoin Partner in accordance with the Stablecoin Partner's privacy policy, as made available in the applicable Stablecoin Partner Terms.

Qualifications & exceptions

• Applies where Law requires the notice.

Not stated here

• The Stablecoin Partner's privacy policy is in the Partner Terms and is not supplied.

Use & Processing · Company practice

Outside the US, UK and EEA: Stripe Global Technology, LLC provides the services; the DPA treats you as in the Americas

For Users outside the United States, European Economic Area and United Kingdom, the Stablecoin Treasury Services are provided by Stripe Global Technology, LLC, and references to Stripe in these terms mean that entity for these services. For purposes of the Data Processing Agreement, the User is treated as if its Stripe Account were located in North or South America.

Supporting quotations

6.2 Modifications.

For Users outside the United States, European Economic Area, and United Kingdom, the Stripe Stablecoin Treasury Services are provided by Stripe Global Technology, LLC. References to "Stripe" in these Stripe Stablecoin Treasury Terms mean Stripe Global Technology, LLC with respect to the Stripe Stablecoin Treasury Services. However, for purposes of the Data Processing Agreement, User will be treated as if its Stripe Account were located in North or South America.

Qualifications & exceptions

• Applies to Users outside the United States, European Economic Area and United Kingdom.
• The Americas treatment applies for the Data Processing Agreement only.

Use & Processing · Company practice

Global VAT Compliance B.V. may process Personal Data as an independent controller under its own privacy policy

When Global VAT Compliance B.V. (GVC) acts as a subcontractor of the Stripe Tax Services, it may process Personal Data as an independent Data Controller to meet its obligations under Law, in line with GVC's privacy policy.

Supporting quotations

(b) GVC. When Global VAT Compliance B.V. (“GVC”) is acting as a subcontractor of Stripe Tax Services, GVC may process Personal Data as an independent Data Controller in order to comply with GVC’s obligations under Law, in accordance with [GVC’s Privacy Policy](https://www.globalvatcompliance.com/privacy-policy/).

Qualifications & exceptions

• Applies when GVC is acting as a subcontractor of Stripe Tax Services.
• Processing is to comply with GVC's obligations under Law.

Not stated here

• GVC's privacy policy is linked and not supplied.

Use & Processing · Restriction or exception

You and your Connected Accounts may not use Stripe Tax with Protected Health Information

The User must not, and must make sure its Connected Accounts (if applicable) do not, use the Stripe Tax Services in connection with Protected Health Information.

Supporting quotations

5.2 Protected Health Information.

User must not, and must ensure that its Connected Accounts (if applicable) do not, use the Stripe Tax Services in connection with Protected Health Information.

Qualifications & exceptions

• The ban extends to the User's Connected Accounts, if applicable.

Not stated here

• Protected Health Information is not defined in this document.

Use & Processing · Restriction or exception

You must get the rights and consents, and give the disclosures, for Stripe and the bank to use Personal Data

The User must get all necessary rights and consents from each actual and prospective Accountholder and Authorized User to (a) provide Personal Data to Stripe and its Affiliates; (b) let them collect, use, retain and disclose it; and (c) let them exercise their rights and perform their obligations under the Platform Terms and under Stripe's Privacy Policy and any Treasury for Platforms Bank's Privacy Policy. When onboarding Accountholders, the User must disclose that it may give Personal Data to Stripe, its Affiliates and the applicable banks, and that they may collect, use, retain and disclose it. A Treasury for Platforms Bank is a bank through which a Stripe Entity holds Accountholder funds.

Supporting quotations

6.4 Stripe Treasury for Platforms Accountholder Consents.

User must obtain all necessary rights and consents from each actual and prospective Stripe Treasury for Platforms Accountholder and Treasury for Platforms Authorized User to (a) provide Personal Data to Stripe and its Affiliates; (b) allow Stripe and its Affiliates to collect, use, retain and disclose that Personal Data; and (c) allow Stripe and its Affiliates to exercise their rights and perform their obligations under these Stripe Treasury for Platforms - Platform Terms and according to Stripe’s Privacy Policy and any Treasury for Platforms Bank’s Privacy Policy (as applicable). User must, when onboarding Stripe Treasury for Platforms Accountholders, disclose to them that User may provide Personal Data to Stripe, its Affiliates, and applicable Treasury for Platforms Banks, and that Stripe, its Affiliates and applicable Treasury for Platforms Banks may collect, use, retain and disclose Personal Data.

"Treasury for Platforms Authorized User" means an individual that a Stripe Treasury for Platforms Accountholder authorizes to use the Stripe Treasury for Platforms Services.

“Treasury for Platforms Bank” means a bank through which a Stripe Entity holds Treasury for Platforms Accountholder funds.

Qualifications & exceptions

• Covers prospective as well as actual Accountholders and Authorized Users.

Not stated here

• The Privacy Policies are not supplied.

Use & Processing · Restriction or exception

UK: you must get the rights and consents, and give the disclosures, for Stripe and its Affiliates to use Personal Data

The User must get all necessary rights and consents from each actual and prospective Accountholder to (a) provide Personal Data to Stripe and its Affiliates; (b) let them collect, use, retain and disclose it; and (c) let them exercise their rights and perform their obligations under the UK Platform Terms and under Stripe's Privacy Policy. When onboarding Accountholders, the User must disclose that it may give Personal Data to Stripe and its Affiliates, and that they may collect, use, retain and disclose it under Stripe's Privacy Policy.

Supporting quotations

6.4 Stripe Treasury for Platforms Accountholder Consents.

User must obtain all necessary rights and consents from each actual and prospective Stripe Treasury for Platforms Accountholder to (a) provide Personal Data to Stripe and its Affiliates; (b) allow Stripe and its Affiliates to collect, use, retain and disclose that Personal Data; and (c) allow Stripe and its Affiliates to exercise their rights and perform their obligations under these Stripe Treasury for Platforms (United Kingdom) - Platform Terms and according to Stripe’s Privacy Policy. User must, when onboarding Stripe Treasury for Platforms Accountholders, (a) disclose to them that User may provide Personal Data to Stripe, and its Affiliates, and that Stripe and its Affiliates may collect, use, retain and disclose Personal Data in accordance with Stripe’s Privacy Policy.

Qualifications & exceptions

• Covers prospective as well as actual Accountholders.

Not stated here

• Stripe's Privacy Policy is not supplied.