Ko-fi
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Ko-fi Labs Limited (company no. 11087704), Suite 501, The Nexus Building, Broadway, Letchworth Garden City, SG6 9BL, United Kingdom
UK creator platform (Ko-fi Labs Limited) for tips, memberships and digital shops: 0-5% service fee, but payouts run only through PayPal, Inc. or Stripe, Inc., with no EU payment option.
Ko-fi offers EU hosting in the United Kingdom, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Membership platforms.
Assessment notes
Ko-fi is a UK platform for tips, memberships, commissions and digital shops, operated by Ko-fi Labs Limited in Letchworth Garden City under English law. It is popular with European creators and was named by the reader who asked for this category, so it is listed, but it is not a European option in the sense this directory uses: the operator is outside the EU, and the money rails are exclusively American. Ko-fi does not process payments itself; the creator connects their own account and the terms name PayPal, Inc. and Stripe, Inc., US entities, as the parties that do. There is no EU-incorporated payment option and no way to configure one, which is the difference between Ko-fi and Petje Af, whose otherwise identical bring-your-own-processor model also offers Mollie. Ko-fi publishes no DPA, no sub-processors list and no hosting location; the site is served through Cloudflare, and Google, X, Facebook and Twitch are named as login providers, CookieYes for consent, with Google Workspace, Microsoft and SendGrid visible in the mail configuration: Material.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 12 · 11 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Ko-fi
Ko-fi is a creator funding platform operated by Ko-fi Labs Limited from Letchworth Garden City in the United Kingdom, governed by English law and by the exclusive jurisdiction of the English courts. It is the broadest product in this category by feature count: one-off tips, recurring memberships, commissions for custom work, a shop for digital and physical items, Discord and Twitch integrations, stream alerts, goals, polls and embeddable widgets, all on a page that costs nothing to open. The service fee is 0% on tips for the legacy free tier and 5% on memberships, shop sales and commissions, with new creators defaulting to a 5% Standard plan and Ko-fi Gold at 12 USD per month removing service fees entirely.
Structurally Ko-fi works the same way as Petje Af: it never holds the money. The creator connects their own payment account and supporters pay them directly. The difference, and it is the whole difference for a European reader, is which accounts can be connected. Ko-fi's terms are explicit that payments are handled by third-party providers and name PayPal, Inc. and Stripe, Inc., both US-incorporated. There is no Mollie, no Adyen, no SEPA-native option, and no setting that changes this. A European creator using Ko-fi is therefore routing every euro their audience sends through an American payment company, by design rather than by oversight.
The rest of the disclosure is thin. Ko-fi publishes no data processing agreement, no sub-processors list and no statement of where the platform is hosted; the site is served through Cloudflare. The privacy policy does name the third parties it uses: PayPal and Stripe for payments, Google, X, Facebook and Twitch as login providers, YouTube and Twitch for stream integrations, and CookieYes for consent, with Google Workspace, Microsoft and SendGrid visible in the mail configuration, and it commits to appropriate safeguards including standard contractual clauses for transfers outside the UK and EEA: Material. Ko-fi is included here because European creators use it heavily and because a reader specifically asked, not because it is a European alternative. Best fit: creators who want the widest feature set on one free page and for whom payment jurisdiction is not a decision criterion.
Sub-processor map · 12
-
Cloudflare, Inc. USUnited States
CDN and DDoS protection in front of ko-fi.com
-
Google Ireland Limited (Google Workspace) USIreland
Corporate and support email (from public MX and SPF records)
-
Google LLC USUnited States
Account sign-in provider
-
Google LLC (YouTube) USUnited States
Stream chat and alert integration
-
Meta Platforms, Inc. USUnited States
Account sign-in provider (Facebook)
-
Microsoft Corporation (Exchange Online) USUnited States
Additional authorised mail sender (from public SPF record)
-
PayPal, Inc. USUnited States
Supporter payments and payouts, named in the terms as a third-party payment provider
-
Stripe, Inc. USUnited States
Supporter payments and payouts, named in the terms as a third-party payment provider
-
Twilio SendGrid USUnited States
Transactional email delivery (from public SPF record)
-
Twitch Interactive, Inc. USUnited States
Account sign-in provider and stream chat and alert integration
-
X Corp. USUnited States
Account sign-in provider
-
CookieYes Limited non-USUnited Kingdom
Cookie consent management
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Cloudflare, Inc. | United States | CDN and DDoS protection in front of ko-fi.com | US |
| Google Ireland Limited (Google Workspace) | Ireland | Corporate and support email (from public MX and SPF records) | US |
| Google LLC | United States | Account sign-in provider | US |
| Google LLC (YouTube) | United States | Stream chat and alert integration | US |
| Meta Platforms, Inc. | United States | Account sign-in provider (Facebook) | US |
| Microsoft Corporation (Exchange Online) | United States | Additional authorised mail sender (from public SPF record) | US |
| PayPal, Inc. | United States | Supporter payments and payouts, named in the terms as a third-party payment provider | US |
| Stripe, Inc. | United States | Supporter payments and payouts, named in the terms as a third-party payment provider | US |
| Twilio SendGrid | United States | Transactional email delivery (from public SPF record) | US |
| Twitch Interactive, Inc. | United States | Account sign-in provider and stream chat and alert integration | US |
| X Corp. | United States | Account sign-in provider | US |
| CookieYes Limited | United Kingdom | Cookie consent management | non-US |
Source: the vendor’s published sub-processor list, read 10 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Ko-fi
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicemore.ko-fi.com/terms…
Alternatives in this category
-
CzechiaUS-LinkedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct This listing The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
FranceEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
-
PolandEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Herohero
Czechia
|
US-Linked | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Liberapay
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |
Patronite
Poland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |