Subprocessor List
BananaRat Studio uses the following third-party subprocessors to deliver our service. We disclose them here per GDPR Article 28 and to support the Data Processing Agreement that we accept with Shopify on your behalf.
Active subprocessors
| Subprocessor | Purpose | Data type | Location |
|---|---|---|---|
| Shopify Inc. | Storefront, checkout, payments, customer accounts, order processing | Email, name, billing address, purchase history, payment metadata | Canada (primary), US (failover) |
| Stripe Inc. / Shopify Payments | Payment card processing, refunds, chargeback handling | Card number (tokenised), billing address, payment metadata | US (PCI-compliant infrastructure) |
| Anthropic PBC | AI agent inference (Claude API — songwriting agents) | Intake transcripts (your inputs to the AI), composition outputs | US (no retention beyond 30-day caching per Anthropic's policy) |
| Resend, Inc. (rolling out 2026-05-25) | Transactional email delivery (deletion confirmations, account access links) | Email address, email body content | US |
| Cloudflare, Inc. | DNS hosting, DDoS protection (storefront only, not the AI studio backend) | IP address, request headers | Global CDN |
| Discord, Inc. | Internal operations alerting (chargeback notifications, system events) | Customer GID hashes (no PII in alert payloads) | US |
What is a subprocessor?
A subprocessor is a third party that processes personal data on our behalf to deliver our service. We are the data controller (decide what data to collect and why); subprocessors are data processors (act on our instructions). Under GDPR Article 28, we have written agreements with each ensuring they protect your data as we do.
Changes to this list
We update this page whenever we add, remove, or replace a subprocessor. Material changes affecting EU residents are communicated 30 days in advance via email to active customers. If you object to a change, you have the right to terminate your account before the change takes effect.
Want to know more?
Email feedback@bananarat.com with questions about how we use any of these processors, what data flows where, or to request copies of our Data Processing Agreements.