---
title: Data Subprocessors
---

**TRANSPARENCY IN DATA PROCESSING RELATIONSHIPS**

## 1. INTRODUCTION AND OVERVIEW

### 1.1. Purpose and Scope

This document provides comprehensive information about third-party entities that process personal data on behalf of NHCarrigan ("we," "us," "our," or "the Company"). By using our services, you acknowledge that your data may be processed by these subprocessors in accordance with their respective privacy policies and our contractual agreements.

### 1.2. Legal Framework

This disclosure is provided in accordance with:

**(a)** Data protection regulations requiring transparency about third-party processing;

**(b)** Our commitment to user privacy and informed consent;

**(c)** Contractual obligations with our users regarding data processing;

**(d)** Industry best practices for data processing transparency.

### 1.3. Data Processing Principles

All subprocessor relationships are governed by:

**(a)** **Purpose Limitation:** Data processing is limited to specified, legitimate purposes;

**(b)** **Data Minimisation:** Only necessary data is shared with subprocessors;

**(c)** **Security Requirements:** All subprocessors must maintain appropriate security measures;

**(d)** **Contractual Protection:** Formal agreements govern all data processing relationships.

### 1.4. User Rights and Protections

Your rights regarding subprocessor data processing include:

**(a)** **Transparency:** Full disclosure of all entities processing your data;

**(b)** **Consent:** Your continued use constitutes consent to the processing described;

**(c)** **Control:** Rights to access, correct, and delete data processed by subprocessors;

**(d)** **Notice:** Advance notification of changes to subprocessor arrangements.

## 2. PRIMARY SUBPROCESSORS

### 2.1. Definition and Role

Primary subprocessors are third-party entities that directly process, store, or manage data on our behalf as part of our core service delivery. These relationships involve direct contractual arrangements and technical integrations.

### 2.2. Primary Subprocessor Details

#### 2.2.1. Anthropic

**Data Processing Role:** Artificial Intelligence and Natural Language Processing

**Types of Data Processed:**
- Messages and commands sent to and from applications utilising AI integration services
- User interactions with AI-powered features
- Content analysis for service improvement and safety

**Processing Purpose:**
- Providing AI-powered responses and functionality
- Natural language understanding and generation
- Content moderation and safety filtering
- Service improvement and optimisation

**Data Transfer Mechanism:** Encrypted API communications

**Retention Period:** As specified in Anthropic's data retention policies

**Security Measures:** Industry-standard encryption and access controls

**Location:** United States

**Privacy Policy:** https://www.anthropic.com/privacy

#### 2.2.2. DigitalOcean

**Data Processing Role:** Infrastructure and Hosting Services

**Types of Data Processed:**
- All data transmitted over networks to and from our applications
- System logs and performance metrics
- Backup data and system configurations
- Network traffic metadata

**Processing Purpose:**
- Providing cloud infrastructure and hosting services
- Ensuring system availability and performance
- Maintaining security and monitoring systems
- Data backup and disaster recovery

**Data Transfer Mechanism:** Encrypted network transmission

**Retention Period:** As required for service provision and legal compliance

**Security Measures:** SOC 2 Type II compliance, encryption, access controls

**Location:** Multiple global data centres (primarily United States and Europe)

**Privacy Policy:** https://www.digitalocean.com/legal/privacy-policy

#### 2.2.3. MongoDB

**Data Processing Role:** Database Management and Storage

**Types of Data Processed:**
- All structured data provided to our applications through user interactions
- User account information and preferences
- Application data and user-generated content
- System configuration and metadata

**Processing Purpose:**
- Providing database hosting and management services
- Ensuring data availability and integrity
- Facilitating data backup and recovery
- Supporting application functionality

**Data Transfer Mechanism:** Encrypted database connections

**Retention Period:** As configured in our data retention policies

**Security Measures:** Encryption at rest and in transit, access controls, audit logging

**Location:** Configurable global regions (primarily United States)

**Privacy Policy:** https://www.mongodb.com/legal/privacy-policy

#### 2.2.4. Stripe

**Data Processing Role:** Payment Processing and Identity Verification

**Types of Data Processed:**
- Payment information including credit card details and billing addresses
- Identity verification information for age and identity confirmation
- Transaction history and payment method data
- Information necessary for regulatory compliance (KYC/AML)

**Processing Purpose:**
- Processing payments and managing billing
- Verifying user identity and age for service access
- Preventing fraud and ensuring regulatory compliance
- Managing subscriptions and recurring payments

**Data Transfer Mechanism:** PCI DSS compliant encrypted transmissions

**Retention Period:** As required by payment regulations and Stripe policies

**Security Measures:** PCI DSS Level 1 compliance, tokenisation, fraud detection

**Location:** Global processing infrastructure with data residency options

**Privacy Policy:** https://stripe.com/privacy

## 3. SECONDARY SUBPROCESSORS

### 3.1. Definition and Role

Secondary subprocessors are platforms and services that users interact with directly to access our services. While we do not have direct contractual control over these entities, user interaction with our services through these platforms may result in data processing by these entities under their own terms and policies.

### 3.2. Platform Integration Notice

When you access our services through third-party platforms, your interactions are subject to both our privacy policy and the privacy policies of these platforms. We recommend reviewing the privacy policies of all platforms you use to access our services.

### 3.3. Secondary Subprocessor Platforms

#### 3.3.1. Discord

**Relationship Type:** Community Platform Integration

**Data Processing Context:**
- User interactions in Discord servers managed by or affiliated with NHCarrigan
- Bot services and integrations provided through Discord
- Community management and moderation activities

**User Responsibility:** Review Discord's Privacy Policy and Terms of Service

**Privacy Policy:** https://discord.com/privacy

#### 3.3.2. GitHub

**Relationship Type:** Development Platform and Code Repository

**Data Processing Context:**
- Contributions to open-source projects
- Issue reporting and feature requests
- Code repository access and version control
- Development collaboration activities

**User Responsibility:** Review GitHub's Privacy Statement and Terms of Service

**Privacy Policy:** https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement

#### 3.3.3. PayPal

**Relationship Type:** Alternative Payment Processing

**Data Processing Context:**
- Payment processing for services and donations
- Transaction history and payment verification
- Dispute resolution and customer service

**User Responsibility:** Review PayPal's Privacy Statement and User Agreement

**Privacy Policy:** https://www.paypal.com/us/legalhub/privacy-full

#### 3.3.4. Twitch

**Relationship Type:** Live Streaming Platform Integration

**Data Processing Context:**
- Live streaming services and chat interactions
- Channel management and viewer analytics
- Content delivery and broadcasting services

**User Responsibility:** Review Twitch's Privacy Notice and Terms of Service

**Privacy Policy:** https://www.twitch.tv/p/legal/privacy-notice

## 4. SUBPROCESSOR MANAGEMENT AND GOVERNANCE

### 4.1. Due Diligence Process

Before engaging any primary subprocessor, we conduct comprehensive due diligence including:

**(a)** **Security Assessment:** Evaluation of data security measures and certifications;

**(b)** **Privacy Review:** Analysis of privacy policies and data processing practices;

**(c)** **Compliance Verification:** Confirmation of regulatory compliance and certifications;

**(d)** **Contract Negotiation:** Establishment of data processing agreements with appropriate protections.

### 4.2. Ongoing Monitoring

We maintain ongoing oversight of subprocessor relationships through:

**(a)** **Regular Audits:** Periodic review of subprocessor security and privacy practices;

**(b)** **Performance Monitoring:** Assessment of service quality and compliance;

**(c)** **Incident Management:** Coordination on security incidents and data breaches;

**(d)** **Contract Management:** Regular review and update of contractual terms.

### 4.3. Data Processing Agreements

All primary subprocessors are bound by data processing agreements that include:

**(a)** **Purpose Limitation:** Specific restrictions on data use and processing purposes;

**(b)** **Security Requirements:** Mandatory security controls and incident response procedures;

**(c)** **Confidentiality:** Strict confidentiality and non-disclosure obligations;

**(d)** **Audit Rights:** Our right to audit subprocessor data processing practices.

### 4.4. Subprocessor Change Management

Changes to subprocessor arrangements are managed through:

**(a)** **Impact Assessment:** Evaluation of privacy and security implications;

**(b)** **User Notification:** Advance notice to users of significant changes;

**(c)** **Transition Planning:** Careful planning to minimise service disruption;

**(d)** **Documentation Updates:** Timely updates to this disclosure document.

## 5. DATA TRANSFER AND SECURITY

### 5.1. International Data Transfers

When data is transferred internationally to subprocessors, we ensure appropriate safeguards through:

**(a)** **Adequacy Decisions:** Reliance on jurisdictions with adequate data protection laws;

**(b)** **Standard Contractual Clauses:** Implementation of EU Standard Contractual Clauses where applicable;

**(c)** **Certification Schemes:** Use of subprocessors with recognised privacy certifications;

**(d)** **Binding Corporate Rules:** Acceptance of subprocessors with approved internal data transfer rules.

### 5.2. Security Requirements

All primary subprocessors must maintain security measures including:

**(a)** **Encryption:** Data encryption both in transit and at rest;

**(b)** **Access Controls:** Role-based access controls and multi-factor authentication;

**(c)** **Monitoring:** Continuous monitoring for security threats and incidents;

**(d)** **Incident Response:** Established procedures for responding to security incidents.

### 5.3. Compliance and Certifications

We prefer subprocessors with recognised compliance certifications such as:

**(a)** **SOC 2 Type II:** System and Organisation Controls for service organisations;

**(b)** **ISO 27001:** International standard for information security management;

**(c)** **PCI DSS:** Payment Card Industry Data Security Standard (for payment processors);

**(d)** **GDPR Compliance:** Demonstrated compliance with General Data Protection Regulation.

### 5.4. Data Breach Response

In the event of a data breach involving a subprocessor:

**(a)** **Immediate Notification:** Subprocessors must notify us within 24 hours;

**(b)** **Impact Assessment:** Joint assessment of the scope and impact of the breach;

**(c)** **User Notification:** Prompt notification to affected users where required;

**(d)** **Remediation:** Collaborative efforts to contain and remedy the breach.

## 6. USER RIGHTS AND CONTROL

### 6.1. Transparency Rights

Users have the right to:

**(a)** **Information:** Full transparency about subprocessor data processing activities;

**(b)** **Updates:** Regular updates about changes to subprocessor arrangements;

**(c)** **Access:** Information about how to exercise rights with each subprocessor;

**(d)** **Contact:** Direct communication channels for subprocessor-related concerns.

### 6.2. Data Subject Rights

Regarding data processed by subprocessors, users may:

**(a)** **Request Access:** Obtain information about data processing activities;

**(b)** **Seek Rectification:** Request correction of inaccurate data;

**(c)** **Demand Erasure:** Request deletion of personal data in certain circumstances;

**(d)** **Restrict Processing:** Limit how data is processed by subprocessors.

### 6.3. Exercise of Rights

To exercise rights regarding subprocessor data processing:

**(a)** **Primary Contact:** Submit requests through our **Privacy Request Form** (Preferred): https://forms.nhcarrigan.com/o/docs/forms/qEJgBWGDfyHv6x51VU9aVX/4 or contact us at privacy@nhcarrigan.com for coordination;

**(b)** **Direct Contact:** Contact subprocessors directly using their provided channels;

**(c)** **Documentation:** Provide sufficient information to verify identity and specify requests;

**(d)** **Response Time:** Allow reasonable time for investigation and response.

### 6.4. Complaint Mechanisms

If you have concerns about subprocessor data processing:

**(a)** **Internal Escalation:** Raise concerns through our customer support channels;

**(b)** **Supervisory Authorities:** Contact relevant data protection authorities;

**(c)** **Legal Remedies:** Pursue legal remedies available in your jurisdiction;

**(d)** **Alternative Resolution:** Participate in mediation or arbitration where available.

## 7. UPDATES AND CHANGES

### 7.1. Change Notification Process

We will notify users of changes to subprocessor arrangements through:

**(a)** **Email Notification:** Direct notification to registered users for significant changes;

**(b)** **Website Updates:** Updates to this document with change logs;

**(c)** **Service Notifications:** In-app notifications where technically feasible;

**(d)** **Community Announcements:** Public announcements in community forums.

### 7.2. Types of Changes Requiring Notification

Changes requiring advance notification include:

**(a)** **New Subprocessors:** Addition of new primary subprocessors;

**(b)** **Changed Processing:** Significant changes to data processing purposes or methods;

**(c)** **Location Changes:** Changes to data processing locations or jurisdictions;

**(d)** **Security Changes:** Material changes to security measures or protections.

### 7.3. Objection Rights

If you object to changes in subprocessor arrangements:

**(a)** **Notification Period:** We typically provide 30 days' notice of significant changes;

**(b)** **Objection Process:** You may object within the notification period;

**(c)** **Alternative Arrangements:** We will consider reasonable alternative arrangements where possible;

**(d)** **Service Termination:** You may terminate services if objections cannot be accommodated.

### 7.4. Emergency Changes

In emergency situations requiring immediate subprocessor changes:

**(a)** **Immediate Implementation:** Changes may be implemented without prior notice;

**(b)** **Prompt Notification:** Users will be notified as soon as reasonably possible;

**(c)** **Explanation:** Full explanation of the circumstances requiring emergency changes;

**(d)** **Remediation Options:** Information about available remediation options.

## 8. CONTACT INFORMATION AND SUPPORT

### 8.1. Primary Contact

For questions about subprocessor data processing:

**Email:** privacy@nhcarrigan.com

**Subject Line:** Subprocessor Data Processing Inquiry

**Response Time:** Within 7-10 business days for standard inquiries

### 8.2. Rights Requests

For exercising data subject rights regarding subprocessor processing:

**Email:** privacy@nhcarrigan.com

**Subject Line:** Data Subject Rights - Subprocessor

**Required Information:** Please include your full name, account information, and specific request details

### 8.3. Complaints and Concerns

For complaints about subprocessor data processing:

**Email:** privacy@nhcarrigan.com

**Subject Line:** Subprocessor Complaint

**Alternative:** Contact relevant supervisory authorities in your jurisdiction

### 8.4. Technical Support

For technical issues related to third-party platform integrations:

**Email:** support@nhcarrigan.com

**Discord Community:** https://chat.nhcarrigan.com

**Response Time:** Within 7-10 business days for technical support requests

## 9. COMPLIANCE AND REGULATORY INFORMATION

### 9.1. Regulatory Framework

This subprocessor disclosure is maintained in compliance with:

**(a)** **General Data Protection Regulation (GDPR):** EU data protection requirements;

**(b)** **California Consumer Privacy Act (CCPA):** California privacy law requirements;

**(c)** **Other Applicable Laws:** Additional data protection laws in relevant jurisdictions;

**(d)** **Industry Standards:** Best practices for data processing transparency.

### 9.2. Regular Review

This document is reviewed and updated:

**(a)** **Quarterly:** Regular quarterly review for accuracy and completeness;

**(b)** **Change-Triggered:** Updates following any changes to subprocessor arrangements;

**(c)** **Annual Audit:** Comprehensive annual audit of all subprocessor relationships;

**(d)** **Regulatory Updates:** Updates following changes in applicable laws or regulations.

### 9.3. Documentation Standards

We maintain documentation standards including:

**(a)** **Version Control:** Clear versioning and change tracking for all updates;

**(b)** **Audit Trail:** Complete records of all changes and their justifications;

**(c)** **Legal Review:** Review by qualified legal counsel before publication;

**(d)** **Stakeholder Input:** Consideration of feedback from users and privacy advocates.

---

*This document provides transparency about our data processing relationships to help you make informed decisions about using our services. By using our services, you acknowledge understanding of these subprocessor arrangements and consent to the data processing described herein. For questions or concerns about subprocessor data processing, please contact us at privacy@nhcarrigan.com.*
