Payment
GDPR Paddle
In an indie stack, Paddle is used for Merchant of record for software sales. Entity cited: Paddle.com Inc. (DPA) ; la politique cite aussi Paddle.com Market Limited, Paddle Payments Limited et Paddle.com Canada Ltd. comme responsables. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Paddle
Yes. Public Data Processing Addendum, under which the customer is controller and Paddle.com Inc. is processor.
Stated role
For the seller services, the terms state that each party acts as an independent controller (Data Sharing Addendum). A separate DPA applies when the customer is controller and Paddle.com Inc. is processor.
Personal data
The policy cites name and identifiers, IP address, social security numbers, license numbers, and passport numbers, address, phone, email, invoices and payments, cardholder name and payment identifiers, device, browser, and usage data.
Sub-processors of Paddle
The DPA states that the up-to-date list is provided on request, and cites learn.profitwell.com/article/se5xmjlhhd-what-data-sub-processors-do-you-use: that URL returned 404 on 4 October 2026. The ProfitWell Metrics help page names, for that product, Amazon Web Services, Postmark, and Twilio. Public list covering all Paddle services: not disclosed.
Transfers outside the EU
Hosting / location
not disclosed
EU–United States Data Privacy Framework
Official search for “Paddle” on the active and inactive lists: no participant. Not registered.
Cookies
The policy indicates cookies necessary to operate and secure the site, and non-essential cookies, with consent when required, for analytics, advertising, and marketing.
Typical use, written by StackLégal and not by the vendor: Merchant of record for software sales.
History
Last update: October 4, 2026.
Sub-processors: the URL cited by the DPA returned 404 on 4 October 2026. No replacement list was invented.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Paddle a processor within the meaning of the GDPR?
For the seller services, the terms state that each party acts as an independent controller (Data Sharing Addendum). A separate DPA applies when the customer is controller and Paddle.com Inc. is processor.
What DPA does Paddle publish?
Yes. Public Data Processing Addendum, under which the customer is controller and Paddle.com Inc. is processor. https://www.paddle.com/legal/data-processing-addendum
Which further sub-processors does Paddle publish?
The DPA states that the up-to-date list is provided on request, and cites learn.profitwell.com/article/se5xmjlhhd-what-data-sub-processors-do-you-use: that URL returned 404 on 4 October 2026. The ProfitWell Metrics help page names, for that product, Amazon Web Services, Postmark, and Twilio. Public list covering all Paddle services: not disclosed. https://www.paddle.com/help/profitwell-metrics/setup/configure/what-data-sub-processors-do-you-use
Where does Paddle state that it processes data, including outside the EU?
not disclosed
Is Paddle registered under the EU–United States Data Privacy Framework?
Official search for “Paddle” on the active and inactive lists: no participant. Not registered.
Which personal data does Paddle mention?
The policy cites name and identifiers, IP address, social security numbers, license numbers, and passport numbers, address, phone, email, invoices and payments, cardholder name and payment identifiers, device, browser, and usage data.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.