Brazil: you may pledge card receivables only as Law allows; Stripe shares related data with registration offices
For Users in Brazil, Payment Card Receivables are card receivables from card charges that Stripe captures, processes and settles on the User's behalf. The User may grant or assign a lien on or interest in them to a third party only as Law authorizes; if it does, further conditions apply. In accordance with Law, Stripe will share data related to Payment Card Receivables with Card Receivables Registration Offices. The User must tell Stripe about any negotiation of Payment Card Receivables with third-party beneficiaries that are non-financial institutions within 10 business days of the negotiation starting, and must give Stripe accurate and complete information about those negotiations. Stripe's role in communicating with the registration offices continues in the next clause.
Supporting quotations
5.5 Lien or Interest in Payment Card Receivables.
“Payment Card Receivables” means card receivables generated from card charges that Stripe captures, processes and settles on User’s behalf. User may only grant or assign to any third party a lien on or interest in Payment Card Receivables as authorized by Law. If User does so, then the following applies:
In accordance with Law, Stripe will share data related to Payment Card Receivables with Card Receivables Registration Offices. User must inform Stripe about any negotiation with third party beneficiaries that are non-financial institutions related to Payment Card Receivables within 10 business days from the start of the negotiation. User must provide Stripe with accurate and complete information related to the negotiations of Payment Card Receivables.
Qualifications & exceptions
Applies to Users in Brazil.
Liens or interests may be granted only as authorized by Law.
The 10-business-day notice applies to negotiations with non-financial-institution beneficiaries.
Not stated here
Which Law governs the registration and sharing is not named.
Sharing & Disclosure · Company practice
Brazil: Stripe manages dealings with card-receivables registration offices on opt-ins, releases and contestations
For Users in Brazil, a Card Receivables Registration Office is any competent Payment Card Receivables registration office in Brazil. Stripe will manage communication with the appropriate offices on three matters: third-party requests to access, or to stop accessing, information about the User's Payment Card Receivables preferences (opt-in and opt-out); release of assignments or encumbrances, including those tied to a Promessa de Cessão or similar contract; and measures associated with contestations.
Supporting quotations
“Card Receivables Registration Office” means any competent Payment Card Receivables registration office in Brazil. Stripe will manage communication with the appropriate Card Receivables Registration Offices related to (i) requests from third parties to access or refrain from accessing information about User’s Payment Card Receivables preferences (opt-in, opt out); (ii) release of assignments or encumbrances, including those associated with a Promessa de Cessão or similar contracts; and (iii) measures associated with contestations.
Qualifications & exceptions
Applies to Users in Brazil who have granted a lien or interest in Payment Card Receivables (Section 5.5).
Not stated here
The procedures of the registration offices themselves are governed by Brazilian Law, not supplied.
Sharing & Disclosure · Company practice
Stripe may share your account data, including Protected Data, with payment providers; you waive claims over it
Stripe may share information about the User's Stripe Account, including User Information, with Payment Method Providers and Payment Method Acquirers as it believes necessary to verify the User's eligibility for the Stripe Payments Services, set up accounts or credit with Financial Providers, monitor Transactions and other activity, run risk management and compliance reviews, and take other actions needed to provide the Services. Stripe may also share data, including Protected Data, with Financial Providers, who may use and share it to manage a Dispute, assess the User's compliance with Financial Provider Terms, and support compliance with Law, Payment Method Rules and Payment Method Terms. The User waives any claim against Stripe arising from such sharing about the User Group, including being placed on a terminated merchant list as a result. Stripe may periodically review the User's account information to verify eligibility.
Supporting quotations
Stripe may share information about User’s Stripe Account, including User Information, with Payment Method Providers and Payment Method Acquirers as Stripe believes necessary to verify User’s eligibility to use the Stripe Payments Services, establish any necessary accounts or credit with Financial Providers, monitor Transactions and other activity, conduct risk management and compliance reviews, and take any other actions as may be necessary to enable Stripe to provide the Stripe Payments Services to User.
Stripe may also share data, including Protected Data, with Financial Providers, and they may use and share this data, for the purpose of managing a Dispute, assessing User’s compliance with Financial Provider Terms and facilitating Stripe’s, the Payment Method Providers’, and the Payment Method Acquirers’ compliance with Law, Payment Method Rules and Payment Method Terms.
User waives its right to bring any claim against Stripe arising from Stripe sharing information about User Group with Payment Method Providers and Payment Method Acquirers, including any inclusion on a terminated merchant list that results from this sharing. Stripe may periodically review User’s Stripe Account information to verify that User is eligible to use the Stripe Payments Services.
Qualifications & exceptions
Sharing with Providers and Acquirers is 'as Stripe believes necessary' for the listed purposes.
Financial Providers may themselves use and share the data for the listed Dispute, compliance and legal purposes.
The waiver covers claims against Stripe from the sharing, including terminated-merchant-list consequences.
Not stated here
What Protected Data covers is defined in the General Terms, not supplied.
Which terminated merchant lists are meant is not stated.
Sharing & Disclosure · Restriction or exception
Australia: the waiver of claims over Stripe sharing your information with payment providers does not apply
For Users in Australia, the Section 3.6 waiver of the User's right to bring any claim against Stripe arising from Stripe sharing information about the User Group with Payment Method Providers and Payment Method Acquirers does not apply. The sharing itself remains permitted under Section 3.6.
Supporting quotations
15.3 Data Sharing.
The waiver in Section 3.6 (Data Sharing) of User’s right to bring any claim against Stripe arising from Stripe sharing information about User Group with Payment Method Providers and Payment Method Acquirers does not apply.
Qualifications & exceptions
Applies to Users in Australia; only the claim waiver is switched off, not the sharing permission.
Sharing & Disclosure · Restriction or exception
India: accepting American Express means following its Terms and Data Security Policy and sharing your data with Amex
For Users in India who elect to accept American Express cards, the following Payment Method Terms apply: the User will comply with American Express' Terms and Conditions and Data Security Policy, including obligations on disputes, transaction processing, authorization, submission, prohibited uses and transactions, and protecting Customer information. The User consents to Stripe disclosing its Transaction data, merchant data, personal information and other information to American Express, and to American Express using it to perform its obligations, operate its business, perform analytics, create reports and for any other lawful business purpose. A further term on displaying American Express trademarks follows in the next packet.
Supporting quotations
15.15 American Express Payment Method Terms.
User agrees to the following Payment Method Terms if User elects to accept payments using American Express cards in India:
including User’s obligations concerning disputes, transaction processing, authorization, submission, prohibited uses and transactions, and protecting Customer information.
User consents to Stripe’s disclosure of User’s Transaction data, merchant data, personal information, and other information to American Express and to American Express' use of such information to perform its obligations, operate its business, perform analytics or create reports and any other lawful business purpose.
Qualifications & exceptions
Applies to Users in India who elect to accept American Express cards.
American Express's permitted uses of the shared data are broad, ending in 'any other lawful business purpose'.
Not stated here
The American Express Terms and Conditions and Data Security Policy are linked external documents, not supplied.
Sharing & Disclosure · Restriction or exception
New Zealand: the waiver of claims over Stripe sharing your information with payment providers does not apply
For Users in New Zealand, the Section 3.6 waiver of the User's right to bring any claim against Stripe arising from Stripe sharing information about the User Group with Payment Method Providers and Payment Method Acquirers does not apply. The sharing permission itself is unchanged.
Supporting quotations
The waiver in Section 3.6 (Data Sharing) of User’s right to bring any claim against Stripe arising from Stripe sharing information about User Group with Payment Method Providers and Payment Method Acquirers does not apply.
Qualifications & exceptions
Applies to Users in New Zealand; only the claim waiver is switched off.
Sharing & Disclosure · Procedure
You, not Stripe, must get verifiable consents letting Stripe use, store and share personal and payment data with sellers
The User, not Stripe, must obtain valid and verifiable consents from Agentic Customers and give them the disclosures and notices Law and the Payment Method Requirements require. The consents must authorize Stripe to lawfully use, store and share Personal Data and Agentic Payment Account Details with Agentic Sellers and, where applicable, Stripe Connect Platforms in order to complete Agentic Transactions, save and reuse payment details for future transactions, provide services to Agentic Sellers, and carry out other data sharing or activities needed to comply with these terms.
Supporting quotations
4. Disclosures, Information-Sharing and User Agreements.
User, and not Stripe, must obtain valid and verifiable consents from, and provide necessary disclosures and notices to, Agentic Customers, as required by Law and applicable Payment Method Requirements. These consents must authorize Stripe to lawfully use, store, and share Personal Data and Agentic Payment Account Details with Agentic Sellers and Stripe Connect Platforms (as applicable) to: (a) complete Agentic Transactions; (b) save and reuse Agentic Payment Account Details for future transactions; (c) provide services to Agentic Sellers; and (d) facilitate other data sharing or activities necessary to comply with these Agentic Commerce Agent Terms.
"Agentic Customer" means an entity or individual, whether acting for itself or through an AI agent, who provides Authority or initiates a request to purchase goods or services via an Agentic Interface.
Qualifications & exceptions
Responsibility for consents and disclosures sits with the User alone.
The consents must cover reuse of saved payment details for future transactions as well as the current one.
Not stated here
What Law and Payment Method Requirements demand of the consents depends on jurisdiction and network; not stated here.
Sharing & Disclosure · Permission or license
Stripe may route you to third-party Providers and share data with them; agent and filing services follow LegalZoom terms
Stripe may enable or allow the User to access services from Providers, third parties serving the User in connection with the Atlas Services. The User authorizes Providers to deliver their services and interact with Government Authorities as needed, and authorizes Stripe to share the data necessary for that. The User acknowledges that its access to Registered Agent services and automated state and federal filing processing is subject to the LegalZoom Provider Terms, located at legalinc.com.
Supporting quotations
5. Providers.
Stripe may enable or allow User to access services provided to User by Providers. User authorizes: (a) Providers to deliver services and interact with Government Authorities as required to deliver the relevant services, and (b) Stripe to share data necessary to deliver the same. User acknowledges that its access to and use of Registered Agent services, and automated state and federal filing processing is subject to the LegalZoom Provider Terms.
“Provider” means a third party that provides services to User in connection with the Stripe Atlas Services.
“LegalZoom Provider Terms” means the terms located at
Qualifications & exceptions
Data sharing with Providers is limited to what is necessary to deliver the services.
The LegalZoom Provider Terms are an external document, linked but not supplied.
Not stated here
Which other Providers Stripe uses is not stated.
Sharing & Disclosure · Procedure
Obtain and record consents to share Platform User Data with Stripe for marketing and underwriting; exclude end-user data
The User must obtain, record and manage all necessary consents and authorizations, and provide disclosures, including from and to its Platform Users, so that it may disclose Platform User Data to Stripe and Stripe may collect, use, process or disclose the Personal Data and other information the User gives Stripe or a Capital Provider for the Service or a financing, including for marketing and underwriting. Platform User Data is a Platform User's payment volume from other processors, transaction data and offline cash and check transactions that the User shares with Stripe. The User must ensure Platform User Data does not include a Platform User's own end users' personal data under the GDPR or personal information under the CCPA.
Supporting quotations
obtain all necessary consents, and authorizations, and record and manage those consents and authorizations and (ii) provide disclosures, including from and to User’s Platform Users, in each case to disclose Platform User Data to Stripe and enable Stripe to collect, use, process, or disclose Personal Data and other information User provides to Stripe or a Capital Provider in connection with the Stripe Capital for Platforms Services or a Stripe Capital Financing, including consents and authorizations for marketing and underwriting purposes
ensure that Platform User Data does not include a Platform User's end users' “personal data” as defined in the GDPR or “personal information” as defined in the CCPA.
“Platform User Data” means a Platform User’s payment volume information from other payment processors, transaction data, and offline transactions that User shares with Stripe, including from cash and checks.
“GDPR” means General Data Protection Regulation (EU) 2016/679.
User must:
Qualifications & exceptions
Consents must cover marketing and underwriting uses, not only service delivery.
End-user personal data (GDPR) or personal information (CCPA) must be excluded from what is shared.
Not stated here
The GDPR and CCPA are cited by name; their text is not supplied.
Sharing & Disclosure · Company practice
Stripe uses Data to screen Prospects, service loans, fight fraud, satisfy regulators and investors, and improve products
Stripe processes, analyzes and manages Data under its Privacy Policy to determine eligibility to become a Prospect, provide the Service, provide Servicing, mitigate fraud, financial loss or other harm, meet its obligations to regulators, Capital Providers, credit facilities financing loans and investors who may buy loans, and to analyze, develop and improve its products, systems and tools. Stripe provides Data to third-party service providers, Capital Providers, credit facilities, loan investors and its Affiliates to deliver the Service to the User, Platform Users, Connected Accounts and other users. The User consents to these uses. Stripe may retain the Platform User Data it receives according to applicable Law and its retention policies.
Supporting quotations
4.3 Stripe’s Use of Data.
Stripe processes, analyzes, and manages Data in accordance with Stripe’s Privacy Policy to (a) determine eligibility to become a Prospect, (b) provide the Stripe Capital for Platforms Services, (c) provide Servicing, (d) mitigate fraud, financial loss, or other harm, (e) fulfill Stripe’s obligations to regulatory authorities, Capital Providers, credit facilities involved in the financing of loans, and investors who may purchase loans, and (f) analyze, develop, and improve Stripe’s products, systems, and tools. Stripe provides Data to third-party service providers, Capital Providers, credit facilities involved in the financing of loans, investors who may purchase loans, and Stripe’s Affiliates, to allow Stripe to provide the Stripe Capital for Platforms Services to User, Platform Users, Connected Accounts, and other users.
User consents to Stripe’s use of Data for the purposes and in a manner consistent with this Section 4.3. Stripe may retain Platform User Data it receives from User in accordance with applicable Law and Stripe’s retention policies.
Qualifications & exceptions
The purposes include product development and improvement, not only delivering the Service.
Recipients include credit facilities and investors who may purchase loans.
Not stated here
Stripe's Privacy Policy and retention policies are not supplied; no retention period is stated.
Sharing & Disclosure · Restriction or exception
Your agreement with each Connected Account must authorize your data access and Activity; never act beyond that authority
The User's Platform Provider Agreement must explain how the User accesses and uses Connected Account Data (data about Connected Accounts and Activity, which may include Protected Data and Stripe Data) and the Activity it may conduct on the accounts' behalf via Connect, and must authorize the User to perform that Activity and to share Connected Account Data with Stripe. The User must not use the Connect Services to access Connected Account Data or conduct Activity, or attempt to, that the Connected Account has not authorized or has withdrawn authorization for.
Supporting quotations
3.4 User’s Agreements with Connected Accounts.
User’s Platform Provider Agreement must explain how User accesses and uses Connected Account Data, and the Activity that User may conduct on the Connected Accounts’ behalf via the Stripe Connect Services. User’s Platform Provider Agreement must also authorize User to perform that Activity, and to share the Connected Account Data with Stripe.
3.5 Limitations.
User must not use the Stripe Connect Services to access any Connected Account Data or conduct any Activity, or attempt to do either, for which the relevant Connected Account has not authorized, or has withdrawn the authorization.
“Connected Account Data” means data about Connected Accounts and Activity, which may include Protected Data and Stripe Data.
Qualifications & exceptions
Authorization must cover both the User's Activity and its sharing of Connected Account Data with Stripe.
Withdrawn authorization ends the User's permitted access or Activity.
Not stated here
Protected Data and Stripe Data are defined in the General Terms, not supplied.
Sharing & Disclosure · Permission or license
Once transferred, the Destination is custodian and Stripe is not liable for copies; Stripe moves data only as you direct
The User authorizes Stripe to transfer SDP Data to a Destination. After transfer, the Destination is the custodian of the data and Stripe is not responsible for any copy the User or Destination makes, including how it is stored, used, secured, modified or disclosed. The User must hold all rights and consents needed for Stripe to provide and the User to use the pipeline, including to retain, reproduce and disclose SDP Data, and must on request assist Stripe with its legal obligations, such as responding to data subjects or Governmental Authorities. Stripe will transfer SDP Data only at the User's direction and under the Agreement.
Supporting quotations
3. SDP Data.
User authorizes Stripe to transfer SDP Data to a Destination. After Stripe transfers SDP Data, (a) the Destination is the custodian of the SDP Data; and (b) Stripe is not responsible for any copy of the SDP Data that User or the Destination makes, including how it is stored, used, secured, modified, or disclosed. User must have all necessary rights and consents sufficient to enable Stripe to provide, and for User to use, the Stripe Data Pipeline Services, including to retain, reproduce, and disclose any SDP Data. Upon Stripe’s request, User will assist Stripe in complying with its obligations under Law, which assistance may include responding to requests by data subjects or a Governmental Authority.
Stripe will only transfer SDP Data at User’s direction and according to the terms of this Agreement.
Qualifications & exceptions
Stripe's responsibility ends at transfer; the Destination becomes custodian.
Stripe commits to transfer only on the User's direction.
Sharing & Disclosure · Restriction or exception
Share Connections Data only with service providers bound to equivalent obligations and only for the Authorized Purpose
The User may share Connections Data only with its service providers whose agreements impose obligations consistent with these Financial Connections Terms and Section 4 of the General Terms, and only for providing services that implement the Authorized Purpose. The User is responsible for its service providers' acts and omissions, including their compliance with the Agreement.
Supporting quotations
User may only share Connections Data with User’s service providers (a) whose agreement with User imposes on that service provider obligations consistent with those contained in these Stripe Financial Connections Terms and Section 4 of the General Terms; and (b) for the purpose of providing services to User that implement the Authorized Purpose. User is responsible for User’s service providers’ acts and omissions, including their compliance with this Agreement.
Qualifications & exceptions
Both conditions must hold: contractual flow-down of obligations and a purpose limited to the Authorized Purpose.
Not stated here
Section 4 of the General Terms is not supplied.
Sharing & Disclosure · Company practice
Stripe may hand Data Sources your name, end-user names and consents, even onsite; answer requests within 14 days
To meet its obligations to Data Sources, Stripe may provide them the User's name, the names of Connections End Users associated with that source, all Express Consents and related records and other information the User provided under Section 4, and may, with the User's reasonable cooperation, obtain and verify that information onsite at the User's premises. The User must respond to Stripe's information requests under these terms within 14 days; failing that, Stripe may suspend or terminate access to the Financial Connections Services immediately. Section 4 survives termination.
Supporting quotations
4. Cooperation and Audit.
4.1 Stripe May Provide Data to Data Sources.
To comply with Stripe’s obligations to Data Sources, Stripe may (a) provide the following to Data Sources: (i) User’s name; (ii) any Connections End User’s name associated with that Data Source; (iii) all Express Consents and related records; (iv) all other information User provided to Stripe under this Section 4; and (b) with User’s reasonable cooperation, obtain and verify the information required under this Section 4.1 onsite at User’s premises.
4.2 Responses.
User must respond to Stripe’s requests for information under these Stripe Financial Connections Terms no later than 14 days after Stripe’s request. Stripe may suspend or terminate User’s access to the Stripe Financial Connections Services immediately if User fails to timely provide this information to Stripe.
4.3 Survival.
This Section 4 will survive termination of this Agreement.
Qualifications & exceptions
Onsite verification requires the User's reasonable cooperation.
The 14-day response deadline carries an immediate suspension or termination remedy.
Sharing & Disclosure · Restriction or exception
United States: Stripe is a GLBA service provider for Financial Institutions; Section 1033 data holders sign access terms
For Users in the United States, if the User is a Financial Institution as defined in the Gramm-Leach-Bliley Act (15 U.S.C. Sections 6802-6809, an external statute cited by name), Stripe acts as the User's service provider under GLBA for accessing and sharing Connections Data with it. If the User controls Connections End User data covered by rules implementing Section 1033 of the Consumer Financial Protection Act of 2010 (also external), then on Stripe's reasonable request the User must enter into an agreement with Stripe enabling Stripe and its Data Sources to access and use that data for uses the End User approves.
Supporting quotations
United States.
The following Regional Terms apply for Users in the United States.
6.1 US Financial Institution Users.
If User is a Financial Institution, Stripe will act as User's service provider under GLBA for the purpose of accessing and sharing Connections Data with User.
6.2 Consumer Data Access.
If User controls any Connections End User data covered by rules implementing Section 1033 of the Consumer Financial Protection Act of 2010, then upon Stripe's reasonable request, User will enter into an agreement with Stripe to enable Stripe and its Data Sources to access and use that Connections End User data for uses approved by the End User.
"Financial Institution" has the meaning given to it in the GLBA.
"GLBA" means Gramm-Leach Bliley Act, 15 U.S.C. Sections 6802-6809.
Qualifications & exceptions
Applies to Users in the United States.
The Section 1033 agreement duty is triggered by Stripe's reasonable request and limited to end-user-approved uses.
Not stated here
The GLBA and Section 1033 are cited by name; their text and implementing rules are not supplied.
Sharing & Disclosure · Procedure
Your contracts with payees must link Stripe’s Privacy Policy and name Stripe as your payment provider processing data
The User must include in any applicable contracts with its Recipients a link to Stripe's Privacy Policy and state that it uses Stripe as its payment services provider and that Stripe processes Recipients' data under that policy. The Fiat Terms' single definition names the Stripe Global Payouts Fiat Services as the Services for fiat Outbound Payments to Recipients; a 'Back to Top' link closes the terms.
Supporting quotations
3. Privacy Policies.
User must include, in any applicable contracts between User and User’s Recipients, a link to Stripe’s Privacy Policy, and state that User uses Stripe as User’s payment services provider and that Stripe processes Recipients’ data in accordance with its Privacy Policy.
4. Definitions.
“Stripe Global Payouts Fiat Services” means the Services that enable User to make fiat currency Outbound Payments from User's Financial Account to Recipients.
Qualifications & exceptions
Applies to applicable contracts between the User and its Recipients.
Not stated here
Stripe's Privacy Policy is not supplied.
Sharing & Disclosure · Permission or license
You authorize sharing your and payees' personal data with the Partner and regulators, and must secure consents
The User authorizes Stripe and the Stablecoin Partner to share the User's Personal Data and that of Stablecoin Payout Recipients with each other and with relevant regulators, tax authorities and implicated digital asset service providers on an ongoing basis to meet their regulatory and tax obligations. The User must give each recipient the necessary notices and obtain the rights and consents enabling Stripe and the Partner to lawfully collect, use, retain and disclose recipients' Personal Data, including names, dates of birth, physical addresses, Designated Wallet addresses, contact information and government-issued identification numbers, as needed to process payouts. Stripe and the Partner may require additional Personal Data from the User or recipients at any time as a condition of continued access, and may temporarily suspend access pending receipt.
Supporting quotations
2.9 Stablecoin Payout Recipient Data.
User authorizes Stripe and the Stablecoin Partner to share User's Personal Data and the Personal Data of Stablecoin Payout Recipients with each other and with any relevant regulatory bodies, tax authorities or implicated digital asset service providers on an ongoing basis to meet their respective regulatory compliance and tax obligations. User must provide all necessary notices to, and obtain all necessary rights and consents from, each Stablecoin Payout Recipient sufficient to enable Stripe and the Stablecoin Partner to lawfully collect, use, retain, and disclose Stablecoin Payout Recipients' Personal Data, including their names, dates of birth, physical addresses, Designated Wallet addresses, contact information, and government-issued identification numbers, as necessary to process Stablecoin Payout Transactions. Stripe and the Stablecoin Partner may require additional Personal Data from User or Stablecoin Payout Recipients at any time as a condition to continued access to the Stripe Global Payouts Stablecoin Services, and may temporarily suspend access to the Stripe Global Payouts Stablecoin Services pending receipt of that information.
Qualifications & exceptions
Sharing is ongoing and for regulatory compliance and tax purposes.
Access may be suspended until requested additional Personal Data is provided.
Sharing & Disclosure · Procedure
Your privacy policy must name Stripe as an independent controller and disclose data rights, uses and transfers
If the User receives any Submitted Data or Stripe Data through the Stripe Identity Services, its Privacy Policy must at a minimum: state that the User and Stripe are each independent controllers of Personal Data and that Stripe processes it under Stripe's Privacy Policy and these terms in addition to acting as the User's service provider (Stripe offers model wording about sharing personally identifying information with Stripe for risk evaluation and identity verification); state how Submitted Individuals can make data subject requests, including deletion and access, with contact details; state how the User will use Submitted Data and Stripe Data, including, where Law requires, whether it will sell or disclose Submitted Data as 'sell' is defined in the CCPA; where Law requires, state the alternative verification methods for people who do not consent, that Submitted Data may be sent outside the User's jurisdiction including to the United States, and that it may go to third-party service providers including Governmental Authorities to evaluate the individual; and include everything else Law requires. If the User receives no Submitted Data or Stripe Data, the policy need only meet the controller statement, data-rights and Law-required disclosure items (Section 5.2(a), (b) and (d)).
Supporting quotations
5.2 Requirements for User’s Privacy Policy.
If User receives access to any Submitted Data or Stripe Data as part of the Stripe Identity Services, User’s Privacy Policy must, at a minimum:
(a) state that User and Stripe are each independent controllers of Personal Data, and that Stripe will process Personal Data in accordance with Stripe’s Privacy Policy and these Stripe Identity Terms, in addition to acting as a service provider to User. For example, User may choose to add the following to User’s Privacy Policy if it does not already include a disclosure to this effect: "We use Stripe for risk and identity verification services. We share personally identifying information with Stripe, which analyzes and uses it to operate and improve the services it provides to us, including for risk evaluation and identity verification.
(b) state the process through which Submitted Individuals can submit data subject requests (including data deletion and data access) to User, and provide User’s contact information for this purpose;
(c) state the ways in which User will use Submitted Data and Stripe Data, including, if Law requires, whether User will sell or disclose Submitted Data (including as the term “sell” is defined in the CCPA);
(d) if Law requires, (i) state the alternative verification methods that User makes available to individuals who do not consent to be verified by the Stripe Identity Services; (ii) state that using the Stripe Identity Services may include transmitting Submitted Data outside of User’s jurisdiction, including to the United States; and (iii) state that Submitted Data may be submitted to third-party service providers, including Governmental Authorities, for the purpose of evaluating a Submitted Individual; and
(e) include all other information Law requires User to include.
5.3 Minimum Requirements.
If User does not receive access to any Submitted Data or Stripe Data as part of the Stripe Identity Services, User’s Privacy Policy must, at a minimum, satisfy the requirements of Section 5.2(a), (b) and (d) of these Stripe Identity Terms.
Qualifications & exceptions
The full list applies when the User receives Submitted Data or Stripe Data; otherwise only items (a), (b) and (d) apply.
Several disclosures are required only if Law requires them.
Sharing & Disclosure · Company practice
You must hold the rights and consents for cardholders' Personal Data; Stripe shares it with card printers and Affiliates
The User must have and maintain all rights and consents under Law for Stripe to collect, use, retain and disclose the Personal Data the User provides or authorizes Stripe to collect, including data Stripe may collect directly from Issuing Authorised Users. The User is solely responsible for telling Issuing Authorised Users that Stripe may receive Personal Data from the User, and must give them all necessary notices and obtain the rights and consents Stripe needs to lawfully collect, use, retain and disclose their Personal Data in the ways the Agreement (including Section 4.5 of the General Terms) and Stripe's Privacy Policy describe. Stripe provides Issuing Authorised Users' Personal Data to third-party service providers, including those engaged for Card printing, and their Affiliates, and to Stripe's Affiliates, to enable the Stripe Issuing Program. Stripe may delete or disconnect an Issuing Authorised User's Personal Data from the Stripe Issuing Account when Law or the Card Network Rules require.
Supporting quotations
User must have and maintain all necessary rights and consents under Law to provide to Stripe and to allow Stripe to collect, use, retain and disclose, all Personal Data that User provides to Stripe or authorize Stripe to collect, including data that Stripe may collect directly from Issuing Authorised Users. User is solely responsible for disclosing to Issuing Authorised Users that Stripe may receive Personal Data from User. User must provide all necessary notices to and obtain all necessary rights and consents from each Issuing Authorised User sufficient to enable Stripe to lawfully collect, use, retain and disclose their Personal Data in the ways this Agreement (including Section 4.5 of the General Terms) and Stripe's Privacy Policy describe. Stripe provides Issuing Authorised Users' Personal Data to third-party service providers, including third parties engaged for Card printing services, and their respective Affiliates, as well as to Stripe’s Affiliates, to enable Stripe to provide the Stripe Issuing Program. Stripe may delete or disconnect an Issuing Authorised User’s Personal Data from User’s Stripe Issuing Account when Law or the Card Network Rules require.
Qualifications & exceptions
The notice and consent duty falls entirely on the User for Issuing Authorised Users.
Stripe's deletion or disconnection is tied to what Law or the Card Network Rules require.
Not stated here
Section 4.5 of the General Terms and Stripe's Privacy Policy are cited but not supplied in this document.
Sharing & Disclosure · Restriction or exception
Disclose Personal Data sharing and give Stripe's Privacy Policy to prospects; never modify the Accountholder Terms
The User must disclose to all prospective Stripe Issuing Accountholders and prospective Issuing Authorized Users that the User may provide Personal Data to Stripe and that Stripe may receive or collect Personal Data, and must make Stripe's Privacy Policy available to each prospective accountholder before it participates in the Stripe Issuing Program. The User must not modify or supplement any provision of the Stripe Issuing Accountholder Terms.
Supporting quotations
4.5 Data Use Disclosure.
User must disclose to all prospective Stripe Issuing Accountholders and prospective Issuing Authorized Users that User may provide Personal Data to Stripe, and that Stripe may receive or collect Personal Data. User must ensure that Stripe’s Privacy Policy is made available to each prospective Stripe Issuing Accountholder prior to their participation in the Stripe Issuing Program.
4.6 No User Modifications.
User must not modify or supplement any provision of the Stripe Issuing Accountholder Terms.
Qualifications & exceptions
The Privacy Policy must be available before the prospective accountholder participates.
Not stated here
Stripe's Privacy Policy is not supplied in this document.
Sharing & Disclosure · Company practice
You must hold the rights and consents for cardholders' Personal Data; Stripe shares it with card printers and Affiliates
The User must have and maintain all rights and consents under Law for Stripe and the Issuing Bank to collect, use, retain and disclose the Personal Data the User provides or authorizes them to collect, including data Stripe may collect directly from Issuing Authorized Users. The User is solely responsible for telling Issuing Authorized Users that Stripe may receive Personal Data from the User and must give them the notices and obtain the rights and consents Stripe needs to lawfully collect, use, retain and disclose their Personal Data in the ways the Agreement (including Section 4 of the General Terms) and Stripe's Privacy Policy describe. Stripe provides Issuing Authorized Users' Personal Data to third-party service providers, including Card printers, and their Affiliates, and to Stripe's Affiliates, to enable the program. Stripe may delete or disconnect an Issuing Authorized User's Personal Data from the account when Law or the Card Network Rules require.
Supporting quotations
6. Data Protection.
6.1 Data Protection.
User must have and maintain all necessary rights and consents under Law to provide to Stripe and the applicable Issuing Bank, and to allow Stripe and the applicable Issuing Bank to collect, use, retain and disclose, all Personal Data that User provides to Stripe or any Issuing Bank or authorizes Stripe and any Issuing Bank to collect, including data that Stripe may collect directly from Issuing Authorized Users. User is solely responsible for disclosing to Issuing Authorized Users that Stripe may receive Personal Data from User. User must provide all necessary notices to and obtain all necessary rights and consents from each Issuing Authorized User sufficient to enable Stripe to lawfully collect, use, retain and disclose their Personal Data in the ways this Agreement (including Section 4 of the General Terms) and Stripe's Privacy Policy describe. Stripe provides Issuing Authorized Users' Personal Data to third-party service providers, including third parties engaged for Card printing services, and their respective Affiliates, as well as to Stripe’s Affiliates, to enable Stripe to provide the Stripe Issuing Program. Stripe may delete or disconnect an Issuing Authorized User’s Personal Data from User’s Stripe Issuing Account when Law or the Card Network Rules require.
Qualifications & exceptions
The notice and consent duty falls on the User.
Deletion or disconnection is tied to what Law or the Card Network Rules require.
Not stated here
Section 4 of the General Terms and Stripe's Privacy Policy are not supplied in this document.
Sharing & Disclosure · Procedure
Ensure cardholders accept the Authorized User Terms, and disclose data sharing and Privacy Policy to prospects
Accountholders may designate Issuing Authorized Users to make Card Transactions on their behalf. The User must ensure each accountholder presents the Issuing Authorized User Terms to each Issuing Authorized User and that each agrees to them, in the manner the Guidelines describe, and on Stripe's request must give proof they were entered into. If Stripe believes the process does not create a binding agreement between accountholders and Issuing Authorized Users or does not meet the Issuing Bank's requirements, the User must modify it as Stripe or the bank requires. The User must also disclose to all prospective accountholders that it may give Personal Data to Stripe and the Issuing Bank and that they may receive or collect it, and ensure each prospective accountholder consents to Stripe's Privacy Policy.
Supporting quotations
(iv) Issuing Authorized User Terms. Stripe Issuing Accountholders may designate Issuing Authorized Users to make Card Transactions on their behalf. User must ensure that each Stripe Issuing Accountholder presents the Issuing Authorized User Terms to each Issuing Authorized User, and that each Issuing Authorized User agrees to the Issuing Authorized User Terms, in the manner described in the Stripe Issuing Program Guidelines. At Stripe’s request, User must provide proof as Stripe requires that these terms have been entered into by Issuing Authorized Users. If Stripe believes that User’s existing process does not (A) create a binding agreement between any Stripe Issuing Accountholders and each Issuing Authorized User; or (B) comply with the applicable Issuing Bank’s requirements, then, upon Stripe’s request, User must modify that process as Stripe or the Issuing Bank requires.
(v) Data Use Disclosure. User must disclose to all prospective Stripe Issuing Accountholders that User may provide Personal Data to Stripe and the applicable Issuing Bank, and that Stripe and the applicable Issuing Bank may receive or collect Personal Data. User must ensure that each prospective Stripe Issuing Accountholder consents to Stripe’s Privacy Policy.
Qualifications & exceptions
Consent to Stripe's Privacy Policy is required of each prospective accountholder.
Not stated here
The Issuing Authorized User Terms and Stripe's Privacy Policy are not supplied here.
Sharing & Disclosure · Restriction or exception
You may not sell, share, disclose, download or store the fraud tools data
The User must not, and must not let a third party, (b) sell, rent, transfer, make available or communicate Advanced Fraud Tools Data orally or by other means, with “sell” as the CCPA defines it, or (c) disclose, download or store the data. Disclosure is allowed where Law requires it.
Supporting quotations
User must not, and must not enable or allow any third party, to:
(b) sell, rent, transfer, make available, or communicate orally or through other means Advanced Fraud Tools Data (including as the term “sell” is defined in the CCPA);
(c) disclose (except as Law requires), download, or store the Advanced Fraud Tools Data;
Qualifications & exceptions
Disclosure is permitted where Law requires it.
The ban reaches third parties the User enables or allows.
Not stated here
The store ban sits alongside a deletion duty and a Law-required retention exception; the terms do not say how to reconcile storing with a retained copy beyond those two clauses.
Sharing & Disclosure · Restriction or exception
You must work on joint marketing, consider offering Financial Insights, and use shared data only as authorized
The User will use commercially reasonable efforts to develop mutually agreed marketing and promotion for Link through its Agentic Agent, and will in good faith evaluate offering Stripe's Financial Insights open banking product (which lets Mutual End Users share financial account data with the User's Agentic Agent) where available in the Territory. If a Mutual End User shares financial account data this way, the User will use it only for purposes the Mutual End User authorized.
Supporting quotations
(b) Marketing; Services Availability. User will use commercially reasonable efforts to collaborate and develop mutually agreed-upon marketing and promotional activities and materials relating to the use of Link through the User’s Agentic Agent. User will, in good faith, evaluate making Stripe’s “Financial Insights” product offering (which is an open banking solution that enables Mutual End Users to share their financial account data with User’s Agentic Agent ) available to Mutual End Users through User’s Agentic Agent, to the extent such offering is available in the Territory. To the extent a Mutual End User uses Financial Insights to share financial account data with User through User’s Agentic Agent, User will only use such data for purposes the Mutual End User has authorized.
Qualifications & exceptions
Marketing is commercially reasonable efforts toward mutually agreed activities.
Financial Insights evaluation is in good faith and only where available in the Territory.
Shared financial data may be used only for purposes the end user authorized.
Not stated here
The duty is to evaluate, not to offer, Financial Insights.
Sharing & Disclosure · Permission or license
You authorize Stripe and its Affiliates to give your User Information to Stripe's Financial Providers
The User authorizes Stripe and its Affiliates to provide User Information to Stripe's Financial Providers in connection with the User's use of the Stripe Managed Payments Service.
Supporting quotations
3.5 Seller Information.
User authorizes Stripe and its Affiliates to provide User Information to Stripe’s Financial Providers in connection with User’s use of the Stripe Managed Payments Service.
Qualifications & exceptions
Sharing is for use of the Managed Payments Service.
Not stated here
The terms do not list the Financial Providers or the information shared.
Sharing & Disclosure · Permission or license
SMP may send tax documents to you and to Government Authorities and may file periodic informational returns
SMP or its Affiliates may send documents about transactions processed through the Services to the User and to any relevant Government Authority. Law may require them to file periodic informational returns with a Government Authority related to the User's use of the Services, and they may send tax-related information to the User electronically.
Supporting quotations
SMP or its Affiliates may send documents to User and any relevant Government Authority for transactions processed using the Services. Specifically, Law may require SMP or its Affiliates to file periodic informational returns with a Government Authority related to User’s use of the Services. SMP or its Affiliates may send tax-related information to User electronically.
Qualifications & exceptions
Filings are described as what Law may require.
Not stated here
The terms do not say which documents or what information go to the authority.
Sharing & Disclosure · Restriction or exception
On request you must give Stripe information about Third-Party PSPs and your transactions with them
On request, the User must (iv) give Stripe information about a Third-Party PSP that Stripe determines it needs to comply with Law or meet its obligations to the User, the User's Customers, Stripe's users and Financial Providers, and (vi) to the extent Law permits, give Stripe information about transactions with Third-Party PSPs through the Orchestrated Services that Stripe determines it needs for investigations, administrative inquiries, legal requirements, audits, and demands or inquiries from consumers, merchants or Third-Party PSPs.
Supporting quotations
(a) Ensuring Third-Party PSP Compliance. User must:
(iv) upon request, provide Stripe with information about a Third-Party PSP that Stripe determines is necessary to enable Stripe to comply with Law or otherwise fulfill its obligations to User, User's Customers, Stripe’s users, and Stripe’s Financial Providers;
(vi) upon request and to the extent permitted by Law, User must provide Stripe with information about transactions with Third-Party PSPs using the Orchestrated Services that Stripe determines is necessary to enable Stripe to comply with any investigations, administrative inquiries, legal requirements, audits, and demands or inquiries from consumers, merchants, or Third-Party PSPs;
Qualifications & exceptions
Stripe determines what information is necessary.
Transaction information is subject to what Law permits.
Sharing & Disclosure · Permission or license
You authorize Stripe to transfer Output Data to you or your chosen PSP, and must help Stripe meet legal duties
The User authorizes Stripe to transfer Orchestrated Output Data to the User or to the Third-Party PSP the User designates through the Orchestrated Services. On Stripe's request, the User will help Stripe comply with its legal obligations, which may include responding to requests from data subjects or a Governmental Authority.
Supporting quotations
4.2 Transfer and Custody of Orchestrated Output Data.
User authorizes Stripe to transfer Orchestrated Output Data to User or to the Third-Party PSP User designates via the Stripe Orchestrated Services. Upon Stripe’s request, User will assist Stripe in complying with its obligations under Law, which assistance may include responding to requests by data subjects or a Governmental Authority.
Qualifications & exceptions
Assistance is on Stripe's request.
Not stated here
The terms do not say who is the custodian of the data once transferred, unlike the parallel data pipeline clause.
Sharing & Disclosure · Permission or license
By joining, you authorize sharing your account data and wide administration of your account by Organization entities
By joining an Organization, the User authorizes (a) Stripe to share the User's account data with other Organization Accounts in the Organization; (b) people with authority to act for individual Organization Accounts to do so through the Organization; and (c) all other legal entities of the Organization Accounts in the same Organization to enable paid features or other paid Services for the Organization, to add or remove other Affiliate Stripe Accounts, and to access, share, delete and modify the User's Organization Account data, based on the administration roles the User sets for that account.
Supporting quotations
4. Administration of Organization.
By joining an Organization, User authorizes (a) Stripe to share User’s account data with other Organization Accounts in User’s Organization; (b) those individuals with authority to act on behalf of individual Organization Accounts, to do so through the Organization; and (c) all other legal entities of the Organization Accounts that are part of the same Organization to enable paid features or other paid Services for the Organization, to add or remove other Affiliate Stripe Accounts in the Organization, and to access, share, delete and modify the account data of User’s Organization Account based on administration roles that User sets for that Stripe Account.
Qualifications & exceptions
Access by other entities follows the administration roles the User sets for that account.
Not stated here
The terms do not say which account data is shared.
Sharing & Disclosure · Restriction or exception
You must hold notices and consents for sharing Personal Data in the Organization and stop third-party misuse
The User must have given all notices and obtained, and keep throughout the Term, all rights and consents from the people concerned, including all Customers, that Stripe needs to lawfully disclose Personal Data to other Organization Accounts in the Organization. The User must not enable or allow any third party to access or use its Organization Account, or any data including Personal Data tied to any Organization Account in the Organization, in a way that breaks Law, including Law that applies to the User or to other Organization Accounts.
Supporting quotations
5. Sharing of Data.
User must have provided all notices and obtained all rights and consents from applicable individuals, including from all Customers, and maintain such rights and consents throughout the Term, necessary to permit Stripe to lawfully disclose Personal Data to other Organization Accounts in User’s Organization. User must not enable or allow any third party to access or use (a) User’s Organization Account, or (b) any data including Personal Data associated with any Organization Account in User’s Organization, in a manner that violates Law, including Law applicable to User or to other Organization Accounts in User’s Organization.
Qualifications & exceptions
Consents must be maintained throughout the Term.
Sharing & Disclosure · Permission or license
Preview Customer and Payment Method Sharing lets your CPM Information be shared with other Organization Accounts
Section 7, a Preview feature, applies only if the User uses the Customer and Payment Method Sharing feature. If the User enables it for its Organization, the User's CPM Information can be shared with the other Organization Accounts. CPM Information is Customer account information including name, contact information, billing information, tax ID, loyalty program information and the Customer's payment methods saved to the Customer profile. The feature lets the User share that information of its Organization Accounts with other Organization Accounts in the Organization.
Supporting quotations
7. Customer and Payment Method Sharing (Preview).
7.1 Customer and Payment Method Sharing.
This section applies only if User uses the Customer and Payment Method Sharing feature of Stripe Organizations Services.
7.2 Permitted Use.
If User enables Customer and Payment Method Sharing for User’s Organization, User’s CPM Information can be shared with the other Organization Accounts in User’s Organization.
“Customer and Payment Method Information” (or “CPM Information”) means Customer account information including Customer name, Customer contact information, Customer billing information, Customer tax ID, Customer loyalty program information, and Customer’s payment methods saved to the Customer profile.
“Customer and Payment Method Sharing” means the feature that enables User to share Customer Payment Method Information of User’s Organization Accounts with other Organization Accounts in User’s Organization.
Qualifications & exceptions
Applies only if the User uses the feature.
The feature is in Preview.
Sharing & Disclosure · Restriction or exception
Before enabling sharing you must give notices and get the consents Law requires for CPM Information
Before enabling Customer and Payment Method Sharing, the User must give all necessary notices and obtain all necessary rights and consents from the people concerned, as Law requires, before sharing CPM Information with other Organization Accounts in its Organization.
Supporting quotations
7.3 Conditions of Use.
Before enabling Customer and Payment Method Sharing, User must provide all necessary notices and obtain all necessary rights and consents from applicable individuals, as required by Law, before sharing CPM Information with other Organization Accounts in User’s Organization.
Qualifications & exceptions
Must be done before enabling.
Sharing & Disclosure · Restriction or exception
Sharing CPM Information is all or nothing, only Stripe can disable it, and disabling may cost you access to it
The User agrees that (a) if it enables sharing, all of its CPM Information is shared with other Organization Accounts that have also enabled sharing, and CPM Information cannot be segregated or shared in part; and (b) once enabled, the feature can be disabled only by Stripe. If it is disabled, the User may lose access to all CPM Information.
Supporting quotations
User agrees that:
(a) if User enables sharing of User’s CPM Information with User’s Organization, then all of User’s CPM Information is shared with other Organization Accounts that have also enabled sharing CPM Information. CPM Information cannot be segregated and shared in part; and
(b) once enabled, Customer and Payment Method Sharing can only be disabled by Stripe.
If Customer and Payment Method Sharing is disabled, User may lose access to all CPM Information.
Qualifications & exceptions
Sharing cannot be partial.
Only Stripe can turn the feature off once enabled.
Not stated here
The terms do not say whether information already shared can be recalled from other accounts.
Sharing & Disclosure · Restriction or exception
No selling, sharing, disclosing, downloading or storing Radar Data
The User must not, and must not let a third party, (b) sell, rent, transfer, make available or communicate Radar Data orally or by other means, with “sell” as the CCPA defines it where applicable, or (c) disclose, download or store Radar Data. Disclosure is allowed where Law requires it or the Agreement otherwise permits it.
Supporting quotations
User must not, and must not enable or allow any third party to:
(b) sell, rent, transfer, make available, or communicate orally or through other means Stripe Radar Data (including as the term “sell” is defined in the CCPA, as applicable);
(c) disclose (except as Law requires or this Agreement otherwise permits), download or store Stripe Radar Data;
Qualifications & exceptions
Disclosure is allowed where Law requires it or the Agreement otherwise permits.
The ban reaches third parties the User enables or allows.
Sharing & Disclosure · Company practice
By enabling Third-Party Services you accept that RevRec Data may flow between them and Stripe
By enabling the Third-Party Services, the User understands that RevRec Data may flow between the Third-Party Services and Stripe.
Supporting quotations
3. Third-Party Services.
By enabling the Third-Party Services, User understands that RevRec Data may flow between the Third-Party Services and Stripe.
Qualifications & exceptions
Data flow is a possibility (“may”) once the User enables the Third-Party Services.
Not stated here
Which Third-Party Services are meant and what data they receive is not stated in this section.
Sharing & Disclosure · Company practice
Stripe may file tax information reports and send you copies, and the Stablecoin Partner may report separately
Stripe may be required to submit tax information reports to tax authorities about these transactions and may send the User a copy. Law may require Stripe to file periodic informational returns with taxing authorities about the User's use of the services, and Stripe may send tax-related information to the User electronically. The Stablecoin Partner may also have independent tax reporting obligations for Stablecoin Partner Transactions, as its Partner Terms describe.
Supporting quotations
Stripe may be required to submit tax information reports to tax authorities regarding these transactions and may send User a copy of such tax information. Specifically, Law may require Stripe to file periodic informational returns with taxing authorities related to User's use of the Stripe Stablecoin Treasury Services, and Stripe may send tax-related information electronically to User. The Stablecoin Partner may also have independent tax reporting obligations with respect to Stablecoin Partner Transactions, as described in the applicable Stablecoin Partner Terms.
Qualifications & exceptions
Filings are described as what Law may require.
Not stated here
The terms do not say what information goes to tax authorities.
Sharing & Disclosure · Permission or license
You authorize Stripe and its Affiliates to share your information and Personal Data with the Stablecoin Partner
The User authorizes Stripe and its Affiliates to share information about the User, including Personal Data, with the Stablecoin Partner as necessary to let the User access and use the Stripe Stablecoin Treasury Services and the Stablecoin Partner Services.
Supporting quotations
4. Privacy.
User authorizes Stripe and its Affiliates to share information about User, including Personal Data, with the Stablecoin Partner as necessary to enable User to access and use the Stripe Stablecoin Treasury Services and the Stablecoin Partner Services.
Qualifications & exceptions
Sharing is limited to what is necessary to let the User use the services.
Not stated here
The terms do not list the categories of information shared.
Sharing & Disclosure · Permission or license
You authorize Stripe to share your information with third parties, including Financial Providers, for listed purposes
The User authorizes Stripe and its Affiliates to share, unless Financial Account Regulatory Requirements prohibit it, information including Personal Data about the User, its Financial Account, Recipients and Financial Account Transactions with third parties, including Financial Providers: (a) to let the User open the account and complete transactions; (b) to provision VBANs; (c) to investigate any claim the User makes; (d) to comply with Financial Account Regulatory Requirements; (e) to comply with an arbitration order; or (f) as otherwise disclosed or permitted by the Treasury Terms, Stripe's Privacy Policy or the Agreement.
Supporting quotations
6. Permitted Privacy and Data Use.
User authorizes Stripe and its Affiliates to share, unless prohibited by Financial Account Regulatory Requirements, information, including Personal Data, about User, User’s Financial Account, Recipients, and Financial Account Transactions, with third parties (including our Financial Providers): (a) to enable User to open the Financial Account and complete Financial Account Transactions; (b) for the provisioning of VBANs; (c) in connection with investigating any claim User makes; (d) to comply with Financial Account Regulatory Requirements; (e) to comply with an arbitration order; or (f) as otherwise disclosed or permitted by these Stripe Treasury Terms, Stripe’s Privacy Policy, or the Agreement.
Qualifications & exceptions
Sharing is subject to a legal prohibition if one applies.
Item (f) allows sharing wherever the Privacy Policy or Agreement permits.
Not stated here
Stripe's Privacy Policy is linked and not supplied.