Privacy Policy Analyze (x402)

Example response

{
  "purposes": [
    "Service delivery and payment processing",
    "Fraud prevention and security",
    "Artificial intelligence model training",
    "Transaction authentication",
    "Identity verification",
    "Co-marketing of End User Services",
    "Product improvement",
    "Regulatory compliance",
    "Legal obligation fulfillment"
  ],
  "source_url": "https://stripe.com/privacy-center/legal",
  "dpo_contact": null,
  "legal_basis": [
    "Contract performance (service delivery)",
    "Legitimate interest",
    "Legal obligation",
    "Consent (implied for some contexts)"
  ],
  "user_rights": [
    "Access to personal data",
    "Deletion/right to be forgotten",
    "Rectification/correction",
    "Data portability",
    "Objection to processing",
    "Right to exercise data protection rights",
    "Right to honor Global Privacy Control (GPC) signals",
    "Right to opt-out of tracking and advanced fraud signals",
    "Right to lodge complaints (India-specific: mentioned)"
  ],
  "company_name": "Stripe",
  "cookie_usage": "Stripe uses cookies for fraud detection, payment method storage (Link feature), and potentially advertising. Advanced fraud signals are used but distinguished from ad tracking. Stripe.js is employed. Merchants and Link users have specific obligations regarding cookie technology disclosures.",
  "last_updated": null,
  "children_data": null,
  "third_parties": [
    "Sub-processors (list available but not detailed in excerpt)",
    "BNPL providers",
    "Crypto wallet services",
    "Third-party fraud prevention and security providers",
    "Third-party identity verification providers",
    "Advertising partners (for ad targeting)"
  ],
  "data_collected": [
    "Personal data from Business Users",
    "End Customer personal data (cardholders)",
    "Representative contact information (beneficial owners, shareholders, officers, directors)",
    "Precise location data (context-dependent)",
    "Identity verification data",
    "Transaction history",
    "Authentication and authorization data",
    "Phone verification information",
    "Call recordings (in some instances)",
    "Payment method details",
    "Financial account information (via Financial Connections)"
  ],
  "missing_elements": [
    "Specific data retention periods (policy states 'not specified' or deferred to details)",
    "DPO contact information (policy asks 'Does Stripe have a DPO?' but answer not provided in excerpt)",
    "Detailed sub-processors list (only referenced, not detailed)",
    "Specific legal basis matching per data type",
    "Automated decision-making and profiling disclosures",
    "Right to lodge complaint with supervisory authority (only mentioned for India)",
    "Specific cookie names and purposes",
    "Last updated/effective date of the policy",
    "Biometric data handling",
    "Details on when data is NOT retained after deletion requests",
    "Specific retention timelines (e.g., '30 days', '7 years')",
    "Explicit children's data policy/age restrictions"
  ],
  "retention_periods": [
    "not specified"
  ],
  "ccpa_compliant_signals": [
    "Dedicated CCPA section in Privacy Center",
    "Categories of Personal Information Collected disclosed",
    "Sensitive personal information categories identified",
    "Sale/Share of personal information addressed explicitly",
    "California Privacy Rights Metrics provided",
    "Data retention periods mentioned as CCPA-related topic"
  ],
  "gdpr_compliant_signals": [
    "Dual role as data controller and processor clearly articulated",
    "Data Processing Agreements (DPAs) available for Business Users",
    "Data Transfer Addendum provided",
    "Multiple legal basis identification",
    "Specific guidance for Business Users as controllers under GDPR",
    "EU-U.S. Data Privacy Framework certification",
    "Standard Contractual Clauses implemented",
    "Sub-processors list published",
    "Privacy by Design implementation mentioned",
    "Clear distinction between user categories",
    "Ireland-based main establishment (Stripe Technology Company Limited) for GDPR compliance",
    "Support for Global Privacy Control (GPC)",
    "Jurisdictional nuances acknowledged (EEA, Switzerland, UK, APAC)"
  ],
  "international_transfers": [
    "EU-U.S. Data Privacy Framework (DPF) certified",
    "Standard Contractual Clauses (SCCs)",
    "UK Addendum (for UK data transfers)",
    "Cross-border: Americas vs. Non-Americas entities (Stripe LLC vs. STC/SPEL)",
    "Global storage of authentication and authorization data",
    "India: localized data storage options mentioned"
  ]
}