Privacy policy for Stripe apps

What Stripe does on a live site

Stripe is in the payments category. On sites we scan, it shows up through js.stripe.com, api.stripe.com, m.stripe.network. Its role is to take payments, issue invoices, and screen transactions for fraud.

Data that may be processed: Card and bank details, billing name and email, transaction amounts, and fraud-prevention signals. The vendor describes the location as: United States and other countries where Stripe processes payments. Their public privacy or data-processing terms are at https://stripe.com/legal/dpa.

A privacy policy for a Stripe app should name Stripe directly and say what your own product sends to it. A phrase like "third-party tools" is not enough once this service is on the page.

A Stripe.js page loads js.stripe.com and often sets __stripe_mid. The privacy policy should say that card details are collected by Stripe, not typed into your own database. The refund policy is a separate page: Stripe's public website guidance for businesses asks for a way to contact you, terms, and a refund or cancellation policy before you charge cards.

Name Stripe. Do not stop at 'payment processor'.

What you still have to type

The scan cannot know your company name, the country you operate from, or the support email you want on the page. Those go in a short form after the scan. The legal clauses around them are fixed template text, marked as a draft until a lawyer reviews them.