You are in a violation of GDPR because you don't show "allow all" and "decline all" buttons equally. I won't look up the exact regulation quote, but it is somewhere there.
Also, why do you need to store personal information of the users in the first place? A SAAS operator can handle user payments just fine without any extra data stored to require an additional consent, because storing payment status doesn't require it by law.
We do not gather payment information like card numbers etc, but we collect events from Stripe Payments if the payment was successful to enable the respective tier. why do you say that?
Also, why do you need to store personal information of the users in the first place? A SAAS operator can handle user payments just fine without any extra data stored to require an additional consent, because storing payment status doesn't require it by law.