Privacy policy: Membership Billing for Stripe

Last updated: 13 November 2026

This policy explains what data the Wix app “Membership Billing for Stripe” (the app), published by Kaya Byte, org.nr 938 851 883, trading as Kayabyte, Stasjonsveien 64, 0771 Oslo, Norway (we, us), processes when it is installed on a Wix site. It adds to the privacy policy for Kayabyte apps for Wix, which also applies.

What the app does

The app connects a Wix site to the site owner’s own Stripe account. Site members subscribe on Stripe Checkout; the app then gives them the linked Wix pricing plan as an offline plan order and ends or pauses that plan when Stripe ends or pauses the subscription. Payments go from the member to the site owner’s Stripe account. The app never takes, holds or pays out money and never sees card details.

Roles

The site owner is the controller for the data about its members. Kayabyte acts as a processor that handles the data only to provide the app to the site owner. Wix.com Ltd. hosts the site, the members area, the pricing plans and their orders, and the app’s dashboard page. Stripe, Inc. and its affiliates process the payments and the member’s billing data under the site owner’s own Stripe account and agreement with Stripe. Cloudflare, Inc. hosts the app’s service and its database (Cloudflare Workers and D1) and is a sub-processor.

Members who want to see, correct or delete their data should contact the site they subscribed on. We help the site owner answer such requests.

Data the app reads

• From Wix: the site’s pricing plans; the pricing plan orders the app created; for a member who subscribes, the member ID and the member’s login email address; the site’s name and address (URL) and the app’s plan.
• From Stripe (through the restricted key the owner creates): products and recurring prices, customers, subscriptions and their status, invoices and payment events of the subscriptions made through the app, and the name of the Stripe account.

Data the app stores

For each site, the app’s database holds: - Per member who subscribed: the Wix member ID, the Stripe customer ID, the Stripe subscription and price IDs, the Wix plan and order IDs, the subscription status and its dates (for example the next payment or end date), the test or live mode, and warnings the app shows to the owner. - Per linked plan: the Stripe price and product IDs, the Wix plan ID and plan name, the name shown on the site, and a snapshot of the price (amount, currency, interval). - The site: the instance ID, site name and address (URL), the Stripe account’s display name, the mode (test or live), the last 4 characters of the key, the ID of the app’s webhook endpoint in Stripe, and the app’s settings. - Secrets: the owner’s Stripe API key and the webhook signing secret, both encrypted with AES-GCM. They are used only inside the app’s service and are never shown again, sent to a browser or written to logs. - Activity log: what happened and when (for example “plan granted”, “renewed”, “refund logged”, with amount and currency for refunds), by IDs. It holds no names or email addresses. Log lines are deleted after 365 days. - Stripe event IDs, to process each event once. They are deleted after 30 days.

The app does not store member names or email addresses. The member’s email address is passed to Stripe once, to prefill Stripe Checkout on the owner’s Stripe account; from then on it lives in the owner’s Stripe account, under Stripe’s terms and the owner’s agreement with Stripe.

Who else sees the data

• The site owner and collaborators: everyone with access to the app’s page in the site dashboard sees the members list (member ID, status, plan, dates) with links to Stripe.
• Wix: the plan orders the app creates are kept in the owner’s Wix site like any other plan order, under Wix’s own terms, whatever happens in the app.
• Stripe: the member’s email address, card and billing details, invoices and receipts are held by Stripe under the owner’s Stripe account. Stripe sends receipts and payment emails from that account.
• Cloudflare: runs the service and the database and keeps technical request logs for a short time.

We do not sell personal data and do not use it for advertising. The app sends no emails.

Retention and deletion

Data is kept while the app is installed. When the app is removed from a site, the Stripe key and webhook secret are deleted at once and the app tries to delete its webhook endpoint in the owner’s Stripe account. All other data of that site is deleted 30 days after the removal; the clean-up runs in batches, so deletion can happen somewhat later than day 30, not earlier. If the app is installed again within that time, the member records are still there. Disconnecting Stripe in the dashboard also deletes the key and the webhook secret at once.

Plan orders in the owner’s Wix site and customers and subscriptions in the owner’s Stripe account are not ours to delete; the site owner manages them in Wix and Stripe. The app never cancels a Stripe subscription.

To have a site’s data deleted sooner, email support@kayabyte.dev from the site owner’s address.

Logs

The service writes technical log lines (kinds of events, instance IDs, HTTP statuses and error types). Member IDs, email addresses, keys and Stripe messages are not written to the logs by the app.

Plans and payments

The app’s own plans are sold and billed by Wix. Members’ subscription payments are made on Stripe Checkout to the site owner’s Stripe account; they never pass through Kayabyte, and we never receive card details.

Cookies, tracking and third parties

The site widget sets no cookies and uses no analytics, advertising or tracking services. When a member subscribes or opens the billing page, they go to Stripe’s pages, where Stripe’s own privacy policy applies. No data is shared with third parties other than Wix, Stripe (on the owner’s account) and Cloudflare, as described above.

Your rights

Members: contact the site you subscribed on first; it decides about your data. Site owners and anyone else: for questions about this policy, or to exercise your rights under the GDPR, contact support@kayabyte.dev. You can also complain to the Norwegian Data Protection Authority (Datatilsynet) or your local authority.

Changes

We will update this page if the app’s data handling changes. The date at the top shows the latest version.