The change

Stripe added a notice to the top of its Privacy Policy: “This Privacy Policy will be updated on November 20, 2026.” The current version still reads “Last updated: April 28, 2026” and stays in force until then. The notice links to a preview of the new policy, which says “Stripe’s updated Privacy Policy will be effective as of November 20, 2026.”

Stripe’s own summary of the update lists “Updates to communication policies covering automated dialing, AI voice agents, and transcripts for outreach and model training.” We compared the preview with the current policy sentence by sentence to see which parts are new.

What changed

• AI voice agents. “We may leverage automated dialing systems and AI technologies, such as AI-powered voice agents and AI transcription, chat, and email tools, to initiate and conduct communications with you for operational, support, sales, marketing, and lead qualification purposes.”

• AI training on those calls. Stripe may use “call recordings and transcripts of interactions facilitated by automated systems” for “staff training, quality assurance, and other operational purposes, as well as to train, test, and improve the artificial intelligence and machine learning models.”

• Data about you as a sales lead. Stripe may collect information “from third-party enrichment services and publicly available sources to help us understand your business needs and tailor our outreach.”

• Signals at signup and login. Stripe’s fraud services “may collect device and behavioral signals at the time of account registration and login on platforms that have enabled Stripe’s risk API services.”

• Data sent to card issuers. During payment authorization, Stripe may share its risk assessment and “your IP address, email address, phone number, and shipping address” with “your card-issuing bank.”

• Signals pooled across merchants. “Stripe uses transaction signals pooled across its global merchant network to optimize payment authorization rates.”

• Link has its own policy. Stripe’s summary says the update comes “with Link moved to a separate Link Privacy Policy.”

• Global Privacy Control. The current policy says “Stripe honors the Global Privacy Control (GPC) opt-out preference signals.” The new one limits that to “the device and associated browser that transmits the signal.”

AI agents can call you for sales

The new paragraph sits in the section on how Stripe uses personal data, under the heading “Automated and AI-Powered Communications.” It covers calls Stripe starts, not only calls you make to support. The listed purposes include “sales, marketing, and lead qualification.” Stripe explains the goal this way: “These technologies are used to enhance the efficiency of our outreach and to provide immediate engagement tailored to your business needs.”

The same paragraph says what happens to the calls. Recordings and transcripts may be used “to train, test, and improve the artificial intelligence and machine learning models.” The one opt-out it gives is for recording: “To opt out of call recording, please do so when prompted at the beginning of the call.”

Stripe may know your current payment provider before it calls

A new paragraph, “Business Lead and Prospect Information,” applies when you are “a potential Business User or lead.” It says the data Stripe collects “includes your personal and contact details, firmographic data such as company size, industry, and business growth signals, as well as your organization’s current payment service and billing providers.”

The current policy already allowed Stripe to collect data about you “from third parties, including data providers, to advertise, market, and communicate with you.” The new text names enrichment services and spells out what they provide. It is part of a wider pattern: Zoom now says it may sell business contact data.

A disclosure duty for merchants

This is the part that may require work on your side. The section on End Customers’ data now says: “In addition to screening transactions at the point of payment, Stripe’s fraud detection services may collect device and behavioral signals at the time of account registration and login on platforms that have enabled Stripe’s risk API services. These signals are used to detect multi-account abuse and fraudulent registrations before a payment is initiated. Merchants using these services are required by their Stripe agreement to disclose this collection to their customers.”

If your signup or login flow calls Stripe’s risk API, your own privacy notice should say that Stripe collects device and behavioral signals there. The privacy policy points to the Stripe agreement for this duty, so check your agreement for the exact wording.

What Stripe may share with your customers’ banks

The current policy already says Stripe “may provide Business Users and Financial Partners” with personal data “(including your attempted transactions) to help them assess the fraud or loss risk.” The new version names the fields Stripe may send to the card-issuing bank during authorization: “your IP address, email address, phone number, and shipping address.” It adds: “Card issuers are independent data controllers for signals they receive.”

The new policy also explains what pooled signals mean for a buyer: “This means transaction patterns from your payments at one merchant may inform how Stripe routes authorization requests at other merchants.”

What did not change

• Call recording is not new. The current policy already says: “Where permitted under applicable law, we may record and transcribe our calls with you to provide our Services, comply with our legal obligations, perform research and quality assurance, and for training purposes.”

• AI training is not new either. The current policy already lists “Training artificial intelligence models to power our Services and protect against fraud and other harm.” The new version extends that line to “other internal training, quality assurance, and operational improvement purposes.”

• Until November 20, 2026, the April 28, 2026 version remains the policy in force.

Why this matters

Stripe has been building payments for AI agents. Its terms already make AI agent actions legally binding on users, and Walmart, Google, and Stripe put AI agent mistakes on you. This update turns AI agents toward Stripe’s own outreach, and it names the recordings of those calls as material for training AI models.

For a SaaS company that runs billing on Stripe, the more practical change is the disclosure duty. A line in a vendor’s privacy policy can create a task in your own privacy notice. That is why it pays to monitor vendor terms of service and privacy policies, not only contracts.

Potential impact

If your company uses Stripe, the update raises four practical questions:

• Does your signup or login flow use Stripe’s risk API services, and does your privacy notice mention it?

• Do your sales, finance, or engineering staff take calls from Stripe, and do they know they can opt out of recording?

• Are you comfortable with Stripe knowing which payment and billing providers you use today?

• Does your own privacy notice tell customers that their bank may receive their IP address, email, phone number, and shipping address during payment?

How Venpo detected it

Venpo monitors Stripe’s privacy policy and flagged the new notice on October 23, 2026. The record is on the Stripe change page. We then compared the full preview with the current policy, and every quote in this article was checked against those two texts as published at the time of publication.

Business outcome

Teams that see this change before November 20 can update their privacy notice for Stripe’s signup and login signals and brief staff on AI sales calls, instead of finding out after the policy takes effect. That is what continuous monitoring of vendor legal changes is for.

Key takeaway

From November 20, 2026, Stripe’s privacy policy says it may use AI voice agents to call you for sales and train AI models on those calls, and merchants that use Stripe’s risk API at signup or login must tell their customers about it.