Payment
GDPR Gumroad
In an indie stack, Gumroad is used for Sale of digital products and checkout. Entity cited: Gumroad, Inc.. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Gumroad
Yes. Public DPA, which is part of the terms between Gumroad, Inc. and the seller.
Stated role
Processor for seller data such as hosted products and buyer contact details collected by the seller. Independent controller for its own purposes of payment, fraud, tax, compliance, and operation of the service.
Personal data
The policy cites name, user identifier, email, phone, financial-account and payout information, card number, shipping and billing addresses, purchase and subscription history, device identifiers, IP address, and general location.
Sub-processors of Gumroad
Public help article listing the sub-processors.
Transfers outside the EU
Hosting / location
The policy indicates storage on servers in the United States. Gumroad is established in the United States and uses providers in other countries.
EU–United States Data Privacy Framework
Official search for “Gumroad” on the active and inactive lists: no participant. Not registered.
Cookies
The site describes essential cookies, functionality cookies, analytics cookies (including Google Analytics, Optimizely, and New Relic), social-network cookies, and targeted-advertising cookies, as well as pixels.
Typical use, written by StackLégal and not by the vendor: Sale of digital products and checkout.
History
Last update: October 4, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Gumroad a processor within the meaning of the GDPR?
Processor for seller data such as hosted products and buyer contact details collected by the seller. Independent controller for its own purposes of payment, fraud, tax, compliance, and operation of the service.
What DPA does Gumroad publish?
Yes. Public DPA, which is part of the terms between Gumroad, Inc. and the seller. https://gumroad.com/dpa
Which further sub-processors does Gumroad publish?
Public help article listing the sub-processors. https://gumroad.com/help/article/110-gumroads-subprocessors
Where does Gumroad state that it processes data, including outside the EU?
The policy indicates storage on servers in the United States. Gumroad is established in the United States and uses providers in other countries.
Is Gumroad registered under the EU–United States Data Privacy Framework?
Official search for “Gumroad” on the active and inactive lists: no participant. Not registered.
Which personal data does Gumroad mention?
The policy cites name, user identifier, email, phone, financial-account and payout information, card number, shipping and billing addresses, purchase and subscription history, device identifiers, IP address, and general location.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.