How do I request my data or deletion?
How do I request my data or deletion?
BananaRat Studio supports data access (GDPR Art 15) and deletion (GDPR Art 17) requests for all users, regardless of location. These rights also apply under UK GDPR, Canada's PIPEDA, and US state privacy laws including CCPA.
Request a copy of your data (Art 15)
To request a copy of the data we hold about you, visit bananarat.com/pages/request-a-copy-of-your-data and follow the instructions there. You can also submit a request by emailing privacy@bananarat.com with the subject line "Data access request."
We will respond within 30 days of receiving your request, as required by GDPR Art 12(3). Your response will include a structured export of the personal data associated with your account: composition metadata, session logs, credit balance history, and any other data held under your customer ID.
Request deletion of your account and data (Art 17)
To request deletion of your account and all associated personal data, visit bananarat.com/pages/request-a-copy-of-your-data and use the deletion request form, or email privacy@bananarat.com with the subject line "Deletion request."
We will confirm your request within 30 days. Deletion removes your account, session history, credit balances, and personally identifying metadata. Song files you have already downloaded to your device are yours and are not affected — deletion applies to what we hold on our servers.
What is retained after deletion
Some data is retained after a deletion request for legitimate reasons:
- Transaction records: Purchase history and refund records are retained for the period required by applicable tax and accounting law (typically 7 years in most jurisdictions).
- DMCA and copyright records: Content moderation records related to copyright claims are retained as required under §512 of the US Digital Millennium Copyright Act.
- Aggregated analytics: Anonymized, non-identifying usage statistics that cannot be traced back to you are retained for platform improvement.
Account freeze during processing
Once a deletion request is confirmed, your account is placed in a restricted state. You can still log in and download your existing song files during the processing period, but you cannot generate new songs. This is a safeguard to prevent new data being created while we process your deletion.
Response time
We respond to all privacy requests within 30 days, as required by GDPR Art 12(3). Complex requests may take up to an additional 60 days in exceptional circumstances, in which case we will notify you within the initial 30 days and explain the reason.