Buy Me a Coffee

What is Buy Me a Coffee?

Buy Me a Coffee, often shortened to BMC, is a US based creator support platform incorporated as Buy Me a Coffee Inc. in San Francisco, California. Creators (writers, illustrators, podcasters, open source maintainers) set up a public page, then either link to it or embed a yellow Buy Me a Coffee button or a more advanced widget on their own site. Visitors can send a one off tip, become a monthly member, buy a single paid post or pay for an extra such as access to a private community.

BMC handles the public page, the payment flow, supporter messages and the dashboard. Payments are routed to Stripe (the default in most countries) or PayPal. The creator's site only needs to load the button.js script or to drop an iframe; everything else happens on buymeacoffee.com.

Cookies and data collected

When the BMC button or widget is embedded on a third party site, button.js is fetched from cdnjs.buymeacoffee.com. As soon as the iframe to buymeacoffee.com is opened, Cloudflare bot management cookies (__cf_bm, _cfuvid) and BMC functional cookies (_bmc_session, csrf token) are set on the buymeacoffee.com domain. If the supporter clicks the button, a checkout iframe loads Stripe.js or the PayPal SDK, which set their own cookies (m, __stripe_mid, __stripe_sid, paypal_*).

BMC also uses analytics and product tooling on its own domain, typically Google Analytics 4, Microsoft Clarity, HubSpot and Segment. These cookies are not set on the creator's domain but apply to anyone visiting buymeacoffee.com through the embed.

GDPR and ePrivacy implications

Embedding the BMC widget triggers Art. 5(3) ePrivacy because the iframe sets cookies that are not strictly necessary to deliver a service the user has explicitly requested. The widget is loaded on every page where it is dropped, before any action by the visitor. Loading the button without consent is therefore non compliant in France, Germany, Spain, Italy and most EU member states.

Once the supporter actively clicks to send a tip or to subscribe, the payment processing relies on contract performance (Art. 6(1)(b) GDPR) and on Stripe or PayPal as separate processors. The creator remains the controller of supporter data presented in the BMC dashboard.

Consent and implementation

For EU traffic, the BMC embed should be blocked until the visitor has accepted at least the functional category in your CMP. A common pattern is to replace the embed with a static yellow placeholder that opens the BMC public page in a new tab on click, until consent is given. Alternatively, you can route everything to a direct link such as buymeacoffee.com/yourname and avoid the embed entirely.

International data transfers

All BMC processing happens on AWS US regions. The BMC DPA incorporates the European Commission Standard Contractual Clauses and references the EU US Data Privacy Framework. Stripe is established in Ireland for EU customers but transfers to the US under SCCs; PayPal Luxembourg processes EU payment data under its own DPF certification.

A Transfer Impact Assessment is sensible for high volume creators and must cover US surveillance laws (FISA 702, EO 12333) and the residual risk despite the DPF.

Practical compliance steps

Sign the Buy Me a Coffee DPA. Add BMC as a third party in your CMP and gate the embed behind functional consent. List Buy Me a Coffee, Stripe and PayPal in your privacy notice and Article 30 record. Document the international transfer to the United States with SCCs and DPF. Keep supporter messages and payment metadata access limited to authorised team members in the BMC dashboard.