Chargebee

What is Chargebee

Chargebee is a subscription management and recurring billing platform operated by Chargebee Inc. (California), with substantial operations through Chargebee Technologies Pvt Ltd in India. It is a popular middle layer between e commerce sites or SaaS applications and the underlying payment service provider, handling plans and pricing tables, free trials, coupons, dunning, taxes (including EU VAT MOSS/OSS), revenue recognition and customer self service portals. Integration options include hosted checkout pages on chargebee.com, drop in JavaScript components and a server side REST API. Chargebee currently offers regional data centres in the EU (Frankfurt, AWS eu-central-1), the US and Australia.

What data Chargebee processes

Chargebee processes customer name, billing and shipping address, email, phone, tax identifiers (VAT number, ABN), subscription plan, invoice history and references to payment method tokens issued by the PSP. The hosted checkout pages set technical cookies (CSRF, session, JSESSIONID) and may include analytics cookies depending on the configuration. Server side, Chargebee stores activity logs, audit trails, webhook deliveries and dunning event history. The Card Vault (cb_secured) optionally tokenises cards inside Chargebee with PCI DSS Level 1 certification.

GDPR and ePrivacy implications

Chargebee acts as a processor under Article 28 GDPR for the subscription data. The legal basis for the underlying processing is the contract with the subscriber (Art. 6(1)(b)), legal obligations for invoicing and accounting (Art. 6(1)(c)) and legitimate interest for dunning and fraud prevention (Art. 6(1)(f)). The technical cookies set by the hosted checkout are largely strictly necessary for the requested service, but any analytics or marketing cookies the merchant enables on the Chargebee pages require consent under Article 5(3) ePrivacy. Cross border transfers to Chargebee Inc. (US) and Chargebee Technologies (India) trigger Chapter V GDPR.

Is consent required

For the core subscription processing on hosted checkout, no: the cookies are strictly necessary to complete the requested service. For any Chargebee analytics integration (Mixpanel, Google Analytics, custom tracking) and for marketing widgets on the merchant site that lead to Chargebee, consent is required. The user must also be informed that Chargebee receives the data and that some flows reach the US and India.

Data transfers and recipients

With the EU data centre, persistent customer data stays in Frankfurt. Chargebee Inc. in the United States accesses data for engineering, support and security; Chargebee Technologies in India handles a significant share of the technical operations. Chargebee Inc. is self certified under the EU US Data Privacy Framework. India does not have an EU adequacy decision; transfers rely on the new SCCs in the Chargebee DPA and supplementary measures (encryption at rest, access controls, audit logs). The DPA is publicly available and pre approved by EU customers.

Practical compliance steps

Choose the EU data centre during onboarding, sign the Chargebee DPA, list Chargebee Inc. and Chargebee Technologies as recipients in your privacy policy with the transfer mechanism, restrict access using SSO and role based controls, and configure the dunning and email notifications to use anonymised templates. Make sure the cookie banner exposes any analytics integration enabled on the Chargebee hosted pages.