A sports reporter who uses Stripe to process payments for her paid newsletter on the Substack platform discovered her phone number and physical address was being published on invoices to her readers without her realizing it.
A text from a reader who wanted a refund initially alarmed her, thinking he had tracked her down online.
“Some random dude just texted my personal cell phone to ask me to refund him for his substack subscription that he didn’t mean to renew, then got angry at me for asking how he got my number since I don’t give it to strangers,” she posted on social networking site Bluesky. (We chose not to publish the name of the reporter given the privacy concerns she had cited.)
Another member of her network on Bluesky replied, saying it was a default setting. When she had set up Stripe on her Substack account, it made the information available to readers who paid for a subscription to her newsletter.
The help page on Substack currently advises publishers about the settings, but it’s unclear when it added the information – and having the information publish as a default setting may not be best practice:
Connecting to Stripe
It takes just minutes to set up your Stripe account. Before you get started, Stripe will ask for information about your business and customer support details.
Customer support details such as a phone number and address may appear on subscriber invoices and their card statements.
Tip: You can hide the public support phone number on Stripe but for extra privacy, you can set up a Google Voice number and/or a virtual mailbox.
SlashGear picked up the story on Saturday, and it provided information on how to change the settings.
There’s nothing to suggest other platforms use Stripe contact information as default contact information for sellers that will be made publicly available on invoices, but sellers may wish to check (no matter which payment processor they use).
Online sellers already struggle with privacy concerns especially after passage of the INFORM Act, which requires online marketplaces to ensure that their “high-volume” third-party sellers disclose to consumers basic identity and contact information.
