GDPR

1. Data controller

now-playing.top is the controller for personal data processed through this website and its APIs.

Privacy contact: info@now-playing.top.

2. Legal bases for processing

We process personal data under the following GDPR legal bases: performance of a contract / your request (accounts, widgets, connected platforms), consent (optional OAuth permissions, optional cookies including analytics, public features), legitimate interests (security, abuse prevention, debugging, reliable operation) and legal obligation. You can withdraw consent at any time without affecting earlier lawful processing. See the Privacy Policy for detail.

3. Your rights

Subject to the conditions in the GDPR, you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — have your data deleted (“right to be forgotten”).
• Restriction — limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — for anything based on consent, at any time.
• Not be subject to solely automated decisions with legal or similarly significant effects — we do not carry out such decision-making or profiling.
• Complain to a supervisory authority (see section 6).

4. How to exercise your rights

Most rights are self-service in your account: review and edit your profile, unlink providers, revoke widget tokens, clear listening history, disable public features and end sessions. To access, export or erase your data, use the Data deletion page or email info@now-playing.top. We respond to verified requests without undue delay and within 30 days (extendable by two months for complex requests, of which we will inform you). We do not charge a fee unless a request is manifestly unfounded or excessive.

5. International transfers, retention and security

Some providers we rely on (for example connected platforms and infrastructure) may process data outside the EEA under their own safeguards, such as Standard Contractual Clauses or an adequacy decision. We keep personal data only as long as needed for the purpose or as required by law — see the retention table in the Privacy Policy. We use HTTPS/TLS in transit, encryption at rest for OAuth and platform credentials, role-based access and optional two-factor authentication. If a personal-data breach is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours where required, and affected users when the law requires it.

6. Supervisory authority

If you are in the EEA or the UK, you have the right to lodge a complaint with your local data-protection authority. In the EEA you can find yours via the EDPB members list; in the UK, the ICO. We would appreciate the chance to address your concern first — contact info@now-playing.top.