Lemon Squeezy
Lemon Squeezy is a US based merchant of record (MoR) payment platform built for SaaS, software, ebooks and digital products. Acquired by Stripe in 2024, it lets sellers outsource billing, EU VAT, refunds, fraud prevention and chargebacks. The hosted checkout overlay is loaded from lemonsqueezy.com via lemon.js, sets non strictly necessary first party cookies and routes payments through Stripe. EU sellers should gate the overlay behind consent and document the US transfer with SCCs and the Data Privacy Framework.
What does Lemon Squeezy do?
What is Lemon Squeezy?
Lemon Squeezy is a US based merchant of record (MoR) payment platform incorporated as Lemon Squeezy LLC in Pennsylvania, and acquired by Stripe Inc. in 2024. It targets SaaS, software vendors, indie hackers, ebook authors and any creator selling digital products that require global tax handling. As MoR, Lemon Squeezy is the legal seller on the invoice, collects EU VAT and other sales taxes, handles refunds, chargebacks and fraud prevention, and remits the net revenue to the seller.
Sellers integrate Lemon Squeezy with the hosted checkout link, the Lemon.js overlay (a checkout iframe over their own site) or the API. License keys, file downloads, subscriptions and affiliate management are built in.
Cookies and data collected
On the seller's site, lemon.js is fetched from assets.lemonsqueezy.com. Once the overlay opens, an iframe to app.lemonsqueezy.com sets first party Lemon Squeezy cookies (ls_session, ls_csrf, ls_risk and an attribution cookie) and Cloudflare bot management cookies. Stripe is used as the underlying payment processor and adds __stripe_mid, __stripe_sid and m on the checkout iframe. Lemon Squeezy's own dashboard and marketing site use Google Analytics 4, Crisp Chat and HubSpot.
GDPR and ePrivacy implications
Loading the Lemon.js overlay sets non strictly necessary cookies before the visitor takes any action, which triggers Art. 5(3) ePrivacy and requires prior consent in the EU. On the hosted checkout itself, strictly necessary cookies needed to complete the purchase rely on contract performance and are exempt from prior consent. As MoR, Lemon Squeezy is a separate controller for the invoicing and tax data and a processor for the seller's customer base.
Consent and implementation
For EU visitors, the cleanest pattern is to redirect to the hosted checkout link until consent is given in your CMP, then load lemon.js after the visitor has accepted the functional or marketing category. Sellers that want the overlay to open instantly can rely on a CMP with auto blocking and document the consent flow.
International data transfers
Lemon Squeezy processes EU customer data on AWS US East. The DPA incorporates the EU Standard Contractual Clauses (modules 2 and 3) and the UK IDTA, and the company is self certified under the EU US Data Privacy Framework. Following the Stripe acquisition, Stripe's sub processor list and adequacy documentation apply.
Practical compliance steps
Sign the Lemon Squeezy DPA from the seller dashboard. Gate the Lemon.js overlay behind a CMP. List Lemon Squeezy (Lemon Squeezy LLC) and Stripe in your privacy notice and Article 30 record, document the US transfer with SCCs and DPF, and update your terms so refunds and VAT receipts go through Lemon Squeezy as merchant of record.
Lemon Squeezy and the GDPR
Lemon Squeezy is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for the Lemon.js overlay loaded on the seller's own site, because it sets non strictly necessary cookies before any visitor action. Contract performance (Art. 6(1)(b)) for the purchase the customer completes on the hosted checkout. Legal obligation (Art. 6(1)(c)) for EU VAT collection and reporting, since Lemon Squeezy is the merchant of record.
- Risk level
- medium
- Applicable regulations
- GDPR, UK GDPR, ePrivacy Directive 2002/58/EC, EU US Data Privacy Framework, EU VAT Directive (Council Directive 2006/112/EC), PSD2, PCI DSS, US CCPA/CPRA
Impact assessment (DPIA)
A DPIA is not normally required for a standard SaaS subscription sold through Lemon Squeezy. It can become relevant when the seller combines Lemon Squeezy with extensive customer profiling, behavioural pricing, regulated industry data or special category data tied to subscription tiers.
Sample text for your banner
Sales on this site are powered by Lemon Squeezy (Lemon Squeezy LLC, a Stripe company, United States), our merchant of record. The Lemon.js overlay sets functional and analytics cookies, opens an iframe to lemonsqueezy.com and routes payments through Stripe. International transfers to the US are covered by Standard Contractual Clauses and the EU US Data Privacy Framework.
What Lemon Squeezy sets and contacts
- Tracking method
- Merchant of record (MoR) payment platform for SaaS and digital products: hosted checkout overlay loaded from app.lemonsqueezy.com / assets.lemonsqueezy.com with the lemon.js library; opens an iframe to the Lemon Squeezy checkout that sets first party session, CSRF and risk cookies; payments are tokenised through Stripe in the background, with Lemon Squeezy as the legal seller of record
- Server location
- United States (Lemon Squeezy LLC, owned by Stripe since 2024, headquartered in Pennsylvania); production hosted on AWS US East regions; static assets and the lemon.js library served from Cloudflare and AWS CloudFront with EU edge presence
- Data transferred outside the EU
- Lemon Squeezy LLC is established in the United States and was acquired by Stripe Inc. in 2024. Customer payment data is processed on AWS US East. Lemon Squeezy is self certified under the EU US Data Privacy Framework, and its DPA incorporates the EU Standard Contractual Clauses (modules 2 and 3) and the UK International Data Transfer Addendum. As merchant of record, Lemon Squeezy handles EU VAT collection and reporting.
Cookies set (6)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| ls_session | third_party | 2 weeks | Lemon Squeezy functional session cookie set on app.lemonsqueezy.com to keep an in progress checkout and the buyer's session. |
| ls_csrf | third_party | Session | CSRF protection token for the Lemon Squeezy checkout form. |
| ls_risk | third_party | 30 minutes | Fraud risk score cookie used by Lemon Squeezy and Stripe to assess the transaction during the checkout. |
| ls_attribution | third_party | 6 months | Attribution cookie used to track which seller link or affiliate brought the buyer to the Lemon Squeezy checkout. |
| __stripe_mid | third_party | 1 year | Stripe machine identifier loaded during the Lemon Squeezy Stripe checkout step for fraud prevention. |
| __stripe_sid | third_party | 30 minutes | Stripe session identifier loaded during the Lemon Squeezy Stripe checkout step for fraud detection. |
Third-party domains contacted (5)
lemonsqueezy.comapp.lemonsqueezy.comassets.lemonsqueezy.comjs.stripe.comq.stripe.com
Frequently asked questions about Lemon Squeezy
Can't find your question? Write to us, we answer fast.
What cookies does Lemon Squeezy set?
When the Lemon.js overlay opens, it sets first party Lemon Squeezy cookies on app.lemonsqueezy.com (ls_session, ls_csrf, ls_risk and an attribution cookie) and Cloudflare bot management cookies. The Stripe checkout step adds __stripe_mid, __stripe_sid and m.
Do I need consent to load the Lemon Squeezy overlay?
Yes. The overlay loads non strictly necessary cookies before any visitor action, so Art. 5(3) ePrivacy requires prior consent in the EU. Use a CMP to gate lemon.js and rely on a static link to the hosted checkout until consent is given.
What is the legal basis for using Lemon Squeezy?
Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for the overlay cookies. Contract performance (Art. 6(1)(b)) for the purchase on the hosted checkout. Legal obligation (Art. 6(1)(c)) for EU VAT collection and tax record keeping, since Lemon Squeezy is the merchant of record.
Does Lemon Squeezy transfer data to third countries?
Yes. Lemon Squeezy is established in the United States and processes EU customer data on AWS US East. Transfers are covered by the EU Standard Contractual Clauses and the EU US Data Privacy Framework. Stripe applies its own SCCs and DPF for the payment step.
Do I need a DPIA for Lemon Squeezy?
Standard SaaS billing through Lemon Squeezy does not normally require a DPIA. It can become appropriate when Lemon Squeezy is combined with extensive customer profiling, regulated industries or special category data tied to subscription tiers.
How do I implement Lemon Squeezy compliantly?
Sign the DPA, gate the overlay behind a CMP, list Lemon Squeezy and Stripe in your privacy notice and Article 30 record, document the US transfer with SCCs and DPF and update your terms so refunds and VAT receipts go through Lemon Squeezy.
Are there alternatives to Lemon Squeezy?
Other merchant of record platforms include Paddle (UK), FastSpring (US with DPF), 2Checkout / Verifone (US and EU), Gumroad (US with DPF). Non MoR EU friendly options include Stripe Billing (Ireland), Mollie subscriptions (Netherlands), Adyen subscriptions (Netherlands) and Chargebee Billing.
How should I update my cookie and privacy policy for Lemon Squeezy?
List the Lemon Squeezy and Stripe cookies in your cookie policy. In your privacy notice describe Lemon Squeezy as your merchant of record, the overlay, the iframe to lemonsqueezy.com, the US transfer with SCCs and DPF and the role of Stripe as the underlying payment processor.
Radial Ecommerce
Radial Ecommerce offers a scalable e-commerce solution designed to help merchants sell products and services online. Its feature set includes customizable storefronts, multi-currency support, automated tax calculations, and advanced shipping options. Radial Ecommerce integrates with leading payment gateways, marketing platforms, and fulfillment services. Built-in analytics and reporting tools help merchants track performance, optimize conversions, and make data-driven business decisions for sustainable growth.
Unipag
Unipag is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Unipag provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Unipag helps deliver the right message to the right audience at the right time.
Ventrata
Ventrata is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Ventrata provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Ventrata helps deliver the right message to the right audience at the right time.
Glofox
Glofox is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Glofox integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Glofox helps organizations maintain robust websites that meet user expectations and technical requirements.
Global-e
Global-e is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Global-e supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Global-e ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
FieldStack Omni
FieldStack Omni is a comprehensive e-commerce platform that provides businesses with all the tools needed to build, manage, and grow an online store. From product catalog management and secure payment processing to inventory tracking and order fulfillment, FieldStack Omni delivers a complete commerce solution. It features responsive storefront themes, SEO-optimized product pages, and powerful marketing tools to help merchants increase visibility and drive sales across channels.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.