Privacy policy

PRIVACY STATEMENT

Effective Date: April 13, 2026
Last Updated: August 11, 2026
Business: Banana Rat Media
Website: https://bananarat.com

1. What We Collect

- Shopify account info (name, email): Authentication, order fulfillment, customer support. Stored by Shopify.
- Payment information: Credit pack purchases. Processed by Shopify Payments (we never see full card numbers).
- Composition prompts (genre, mood, theme, lyrics): Generating your song. Stored on our server (on-premises, not cloud).
- Uploaded files (lyrics, MIDI, tablature): Import and composition. Processed in-memory, not stored after session.
- Generated compositions (JSON, audio files): Delivering your song package. Stored on our server — see Data Retention below.
- Session data (conversation history): Multi-turn songwriting flow. Deleted after 30 days.

2. How AI Processes Your Data

Text Composition (Anthropic Claude API)

Your text prompts (genre, mood, theme, lyrics, and conversation messages) are sent to Anthropic's Claude API for real-time composition. Anthropic does not retain API inputs or outputs for model training under their commercial API data policy.

Audio Generation

All audio generation runs entirely on our local server hardware. No audio data, uploaded files, or generated audio is transmitted to any third-party service. Your music stays on our servers.

We Do Not Train On Your Data

Your compositions, lyrics, uploaded files, and prompts are never used to train, fine-tune, or improve any AI model — ours or anyone else's.

3. Data Sharing

We do not sell, rent, or share your personal information with third parties, except:
- Shopify: Processes your account and payments (see Shopify's privacy policy).
- Anthropic: Receives text prompts for composition (zero-retention API policy).
- Legal obligation: If required by law, regulation, or legal process.

4. Data Retention

- Songs and compositions: kept as long as your account exists. Delivered MP3s and paid Studio Masters are retained indefinitely.
- Raw instrument stems (per-instrument WAV files): retained for 30 days after render; stems you have downloaded are retained beyond that window.
- Session data: deleted after 30 days.
- Account data: retained as long as your Shopify account exists.
- You can request deletion of your data at any time (see Your Rights below).

5. Your Rights

GDPR (EU/EEA residents)

You have the right to: access your data, rectify inaccuracies, request erasure, restrict processing, data portability, and object to processing. Our lawful basis for processing is contract performance (generating the song you requested). To exercise these rights, email privacy@bananarat.com.

CCPA (California residents)

We do not sell personal information. You have the right to know what data we collect, request deletion, and opt out of sale (not applicable — we don't sell data). Contact: privacy@bananarat.com.

6. Security

Compositions and account data are stored on a dedicated on-premises server (not shared cloud infrastructure). Access is restricted via SSH key authentication and encrypted network connections. The server is not exposed to the public internet — all web traffic routes through an encrypted tunnel.

7. Children

BananaRat Studio is not intended for users under 13. We do not knowingly collect data from children.

8. Changes

We may update this policy. Material changes will be communicated via email. Continued use constitutes acceptance.

9. Contact

For privacy questions or data requests: privacy@bananarat.com