Sub-processors
Last updated 17 June 2026
These are the third-party services Bandhamster uses to run the platform. Each one processes some personal data on our behalf, under a data processing agreement and on our instructions. We keep the list here so you can see who is involved and where your data is handled.
Our processors
Neon
- Purpose
- Managed Postgres database: accounts, bands, enquiries and the data behind every site.
- Where
- EU region (Frankfurt). Neon is US-owned (Databricks).
- Safeguard
- Neon DPA, with SCCs / UK IDTA covering the US-company transfer.
Neon Auth
- Purpose
- Authentication: your login email, password (hashed by the provider) and session.
- Where
- Processed within the Neon platform.
- Safeguard
- Covered by the Neon DPA and its transfer mechanism.
Cloudflare
- Purpose
- Application hosting (Workers), uploaded image and audio storage (R2), CDN, and the bot / human checks (Turnstile, Access).
- Where
- R2 buckets pinned to the EU jurisdiction. Cloudflare is US-owned.
- Safeguard
- Cloudflare DPA, with SCCs / UK IDTA for the US-company transfer.
Resend
- Purpose
- Sends transactional and booking-notification emails (your name and email address).
- Where
- United States.
- Safeguard
- Resend DPA, with SCCs for the UK / US transfer.
Stripe
- Purpose
- Subscription billing and card payments. Stripe handles card data directly.
- Where
- EU and United States.
- Safeguard
- Stripe DPA, SCCs, and PCI-DSS for card data.
| Provider | What they handle | Where | Safeguard |
|---|---|---|---|
| Neon | Managed Postgres database: accounts, bands, enquiries and the data behind every site. | EU region (Frankfurt). Neon is US-owned (Databricks). | Neon DPA, with SCCs / UK IDTA covering the US-company transfer. |
| Neon Auth | Authentication: your login email, password (hashed by the provider) and session. | Processed within the Neon platform. | Covered by the Neon DPA and its transfer mechanism. |
| Cloudflare | Application hosting (Workers), uploaded image and audio storage (R2), CDN, and the bot / human checks (Turnstile, Access). | R2 buckets pinned to the EU jurisdiction. Cloudflare is US-owned. | Cloudflare DPA, with SCCs / UK IDTA for the US-company transfer. |
| Resend | Sends transactional and booking-notification emails (your name and email address). | United States. | Resend DPA, with SCCs for the UK / US transfer. |
| Stripe | Subscription billing and card payments. Stripe handles card data directly. | EU and United States. | Stripe DPA, SCCs, and PCI-DSS for card data. |
Embedded media
When a band adds embedded media to their site (YouTube, Vimeo, Spotify), that provider is not our processor. If a visitor plays the media, the provider may receive their IP address and set its own cookies under its own privacy policy.
Changes
We update this list before a new processor goes live. Questions? Email privacy@bandhamster.com. See also our Privacy Policy.