How many subprocessors does Gumroad use?

Gumroad lists 13 subprocessors on its published list, including Amazon Web Services (AWS), Stripe, PayPal, Braintree (a PayPal service), and Twilio SendGrid and 8 more.

Where does Gumroad process customer data?

The subprocessors named by Gumroad are located in United States and Primarily United States, as stated on its list.

Does Gumroad use customer data to train AI models?

According to its privacy policy, Gumroad does not use customer data to train AI models: “We do not use this data for advertising or to train our own models.”

Which AI model providers does Gumroad send customer data to?

Anthropic, OpenAI, OpenRouter, and Vercel are named in Gumroad's privacy policy: “We may share this information with OpenAI, Anthropic, Vercel, and OpenRouter to provide these features.”

How quickly does Gumroad report a personal data breach to customers?

According to its DPA, Gumroad reports a personal data breach to customers without undue delay, with no set deadline: “Gumroad will notify the Seller without undue delay after becoming aware of a personal data breach affecting Seller Data”

How much notice does Gumroad give before adding a subprocessor?

Gumroad's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Gumroad will update that list at least 30 days before adding or replacing a subprocessor.”

How does Gumroad transfer personal data outside the EU?

Gumroad's DPA relies on standard contractual clauses: “the parties enter into the standard contractual clauses approved by the European Commission in Decision (EU) 2021/914 (the "SCCs"), which are incorporated into this DPA by reference”

When was Gumroad's subprocessor list last checked?

ClauseTrail last checked Gumroad's subprocessor list on November 3, 2026. Lists are re-checked daily.

How do I find out when Gumroad adds or removes a subprocessor?

ClauseTrail monitors Gumroad's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Gumroad Subprocessors List (November 2026): Changes and History

Gumroad names 13 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 3, 2026 Official source ↗

Gumroad subprocessors (November 2026)

#	Subprocessor	Purpose	Location
1	Amazon Web Services (AWS)	Data hosting, file storage, and media processing	United States
2	Stripe	Payment processing and payouts	Primarily United States
3	PayPal	Payment processing and payouts	Primarily United States
4	Braintree (a PayPal service)	Payment processing	Primarily United States
5	Twilio SendGrid	Transactional and marketing email delivery	Primarily United States
6	Resend	Transactional email delivery	United States
7	Cloudflare	Content delivery network and site security	United States
8	Google Analytics	Site analytics	Primarily United States
9	Sentry	Application error monitoring	Primarily United States
10	TaxJar (a Stripe company)	Sales tax calculation and reporting	United States
11	OpenAI	AI-powered features and content moderation	United States
12	Anthropic	AI-powered features	United States
13	ScaleGrid	Database hosting	United States

Get an email when Gumroad changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Gumroad free

AI and customer data at Gumroad

What Gumroad's own documents say, with the sentence each answer comes from.

Trains AI models on customer data: No

“We do not use this data for advertising or to train our own models.”
Privacy policy, gumroad.com ↗
Sends customer data to AI model providers: Yes: Anthropic, OpenAI, OpenRouter, and Vercel

“We may share this information with OpenAI, Anthropic, Vercel, and OpenRouter to provide these features.”
Privacy policy, gumroad.com ↗
How to opt out: Customers can simply stop using the AI-powered features to avoid sending data to the third-party providers.

“You may stop using these features at any time or contact us at support@gumroad.com.”
Privacy policy, gumroad.com ↗

Key DPA terms at Gumroad

What Gumroad's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“Gumroad will notify the Seller without undue delay after becoming aware of a personal data breach affecting Seller Data”
DPA, gumroad.com ↗
Notice of a new subprocessor: 30 days ahead

“Gumroad will update that list at least 30 days before adding or replacing a subprocessor.”
DPA, gumroad.com ↗
Transfers outside the EU: Standard contractual clauses

“the parties enter into the standard contractual clauses approved by the European Commission in Decision (EU) 2021/914 (the "SCCs"), which are incorporated into this DPA by reference”
DPA, gumroad.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“Upon termination of the Agreement, or earlier at the Seller's choice through the export and deletion features of the Services, Gumroad will delete or return Seller Data, and delete existing copies”
DPA, gumroad.com ↗
Audit rights: Through certifications and audit reports only

“Gumroad may satisfy audit requests by providing documentation, summaries of third-party assessments, or written responses to reasonable information requests, and any on-site inspection requires reasonable prior notice, must not disrupt the Services, and is at the Seller's expense.”
DPA, gumroad.com ↗

Documents we track for Gumroad

DPA: checked November 3, 2026 changed October 16, 2026 gumroad.com ↗
Privacy policy: checked November 3, 2026 changed October 16, 2026 gumroad.com ↗
Subprocessor list: checked November 3, 2026 gumroad.com ↗
Terms of service: checked November 3, 2026 changed October 30, 2026 gumroad.com ↗

Change history

October 30, 2026

Terms of service changed

Section on subscription cancellation now lets Buyers cancel from the receipt or Library under "Manage membership" instead of requiring contact through in-app live chat, with email support as a fallback if those options aren't accessible.

Tracking since October 16, 2026. Every change links to the two versions of the document it came from. All vendors' changes →

Gumroad subprocessors FAQ

How many subprocessors does Gumroad use?: Gumroad lists 13 subprocessors on its published list, including Amazon Web Services (AWS), Stripe, PayPal, Braintree (a PayPal service), and Twilio SendGrid and 8 more.
Where does Gumroad process customer data?: The subprocessors named by Gumroad are located in United States and Primarily United States, as stated on its list.
Does Gumroad use customer data to train AI models?: According to its privacy policy, Gumroad does not use customer data to train AI models: “We do not use this data for advertising or to train our own models.”
Which AI model providers does Gumroad send customer data to?: Anthropic, OpenAI, OpenRouter, and Vercel are named in Gumroad's privacy policy: “We may share this information with OpenAI, Anthropic, Vercel, and OpenRouter to provide these features.”
How quickly does Gumroad report a personal data breach to customers?: According to its DPA, Gumroad reports a personal data breach to customers without undue delay, with no set deadline: “Gumroad will notify the Seller without undue delay after becoming aware of a personal data breach affecting Seller Data”
How much notice does Gumroad give before adding a subprocessor?: Gumroad's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Gumroad will update that list at least 30 days before adding or replacing a subprocessor.”
How does Gumroad transfer personal data outside the EU?: Gumroad's DPA relies on standard contractual clauses: “the parties enter into the standard contractual clauses approved by the European Commission in Decision (EU) 2021/914 (the "SCCs"), which are incorporated into this DPA by reference”
When was Gumroad's subprocessor list last checked?: ClauseTrail last checked Gumroad's subprocessor list on November 3, 2026. Lists are re-checked daily.
How do I find out when Gumroad adds or removes a subprocessor?: ClauseTrail monitors Gumroad's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.