Nucleic Lyrics — Privacy Policy

This Privacy Policy explains how we collect, use, share, and protect personal data when you use Nucleic Lyrics, a web application available at https://nucleiclyrics.com (the "Service"). Nucleic Lyrics helps musicians and bands create and organize songs (lyrics) and set-lists, run a live performance reader/teleprompter, and publish public "show" pages that audiences can view by scanning a QR code.

We are committed to handling your personal data in a transparent and lawful way. This policy is written in plain English for an international audience. Where the law of your country or region gives you specific rights, those rights apply. We have designed this policy to comply with the EU and UK General Data Protection Regulation (GDPR) and with Turkey's Personal Data Protection Law (KVKK — Law No. 6698), among other applicable laws.

Please read this policy together with our Terms of Service. If you do not agree with this policy, please do not use the Service.

The Service is operated by Nucleus, located at Türkiye ("we", "us", "our"). For the personal data described in this policy, Nucleus acts as the data controller (under GDPR) and the data controller / veri sorumlusu (under Turkey's KVKK), meaning we decide why and how your personal data is processed.

If you have any questions about this policy, or you want to exercise your privacy rights, you can contact us at [email protected]. If we are required to appoint a representative or data protection officer in your region, their contact details will be published here.

Important: when you purchase a paid plan, payment is processed by Polar as the Merchant of Record (reseller). For the payment transaction, Polar is the seller/merchant and is an independent data controller for the billing data it handles. Polar's own privacy policy applies in addition to this one. See Section 7 (Sharing and Sub-Processors) for details.

We collect the following categories of personal data:

• Account data — the email address and name you provide when you register, your plan/subscription status, and authentication information needed to keep your account secure.
• User content — the songs, lyrics, set-lists, and "show" pages you create and organize, including any content you choose to publish publicly (for example, the lyrics shown to audiences on a public show page are provided by you).
• Fan / audience submissions — when audience members interact with a published show page, we collect what they submit: song requests, votes, "hype" signals, shoutouts/messages, and photo or video "moments" they upload, which may include a display name they choose. Fan submissions are reviewed (moderated) by the band/account owner before they appear publicly.
• Payment-related data — when you subscribe to a paid plan, the payment itself is handled by Polar. We do not receive or store your full card details. We receive limited information from Polar to manage your subscription, such as confirmation of payment, plan, billing country, and subscription status.
• Usage data — basic technical and usage information generated when you use the Service, such as approximate device/browser type, log data, IP address, and actions taken in the app, used to operate, secure, and improve the Service.
• Cookies and session data — a login session cookie that keeps you signed in, plus any strictly necessary cookies needed for the Service to function. See Section 6 for details.
• Media files — photos and videos uploaded as user content or fan submissions are stored and delivered through a content delivery network (CDN).

We use personal data only for the purposes described below. Under GDPR (and similarly under KVKK), we rely on the following legal bases:

• To provide and operate the Service — creating and managing your account, storing your songs/set-lists/shows, running the performance reader, publishing show pages, and enabling audience interactions and moderation. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)); under KVKK, necessity for the performance of a contract.
• To process subscriptions and billing via Polar — managing your paid plan, renewals, upgrades/downgrades, cancellations, and refunds. The payment transaction is processed by Polar as Merchant of Record. Legal basis: performance of our contract and our legitimate interest in being paid for the Service (GDPR Art. 6(1)(b) and (f)).
• To communicate with you — sending service and transactional messages (for example, email verification, password resets, security notices, and billing-related notifications). Legal basis: performance of our contract and our legitimate interests (GDPR Art. 6(1)(b) and (f)). Any optional marketing emails are sent only with your consent (GDPR Art. 6(1)(a)) and you can opt out at any time.
• To keep the Service safe and secure — authenticating users, preventing fraud and abuse, moderating content, maintaining security, and protecting our rights and those of our users. Legal basis: our legitimate interests and, where applicable, compliance with a legal obligation (GDPR Art. 6(1)(f) and (c)).
• To maintain, troubleshoot, and improve the Service — diagnosing problems, understanding how features are used, and developing improvements. Legal basis: our legitimate interests in operating and improving the Service (GDPR Art. 6(1)(f)).
• To comply with the law — meeting legal, tax, accounting, and regulatory obligations and responding to lawful requests. Legal basis: compliance with a legal obligation (GDPR Art. 6(1)(c)).

When you publish a "show" page, the content you choose to make public — including set-lists and the lyrics shown to audiences — is visible to anyone with the link or QR code. Please do not include personal or sensitive information in content you publish unless you intend it to be public.

Audience members who interact with a show page (requests, votes, hype, shoutouts/messages, photo/video moments, and any display name they enter) should only submit content and media that they are entitled to share. Fan submissions are reviewed by the band/account owner before they are displayed publicly. The account owner acts as moderator and decides what appears.

If you are an audience member and want a submission or display name removed, please contact the band/account owner that runs the show page, or contact us at [email protected] and we will assist where we can. We may also remove content that is unlawful, infringing, or abusive (see Section 11).

We use a small number of cookies and similar technologies. The most important is a login session cookie, which is strictly necessary to keep you securely signed in while you use the Service. Without it, core features will not work.

We may also use strictly necessary cookies for security and basic functionality, and limited usage/analytics information to understand and improve the Service. Where required by law, we will ask for your consent before setting any non-essential cookies, and you can manage your preferences through your browser settings or any cookie controls we provide.

Note that third parties involved in a transaction (such as Polar during checkout) may set their own cookies governed by their own privacy and cookie policies.

We do not sell your personal data. We share personal data only as needed to run the Service and as described here. We work with carefully selected service providers (sub-processors) who process data on our behalf under appropriate data protection terms. Our key providers are:

• Polar (polar.sh) — payments and subscription billing. Polar acts as our Merchant of Record (reseller), is the seller/merchant for the transaction, handles billing and the calculation/collection of sales tax/VAT, and is the party you contract with for payment. Polar is an independent data controller for the payment data it processes, and its own privacy policy applies to that data. Refunds are handled through Polar in accordance with our policy.
• Microsoft Azure — cloud hosting and infrastructure, including storage of application data and media delivered via CDN.
• Email delivery provider — sending transactional and service emails (such as verification, password reset, and security notices).
• Other parties where required — we may disclose data to comply with the law, enforce our terms, protect rights and safety, or in connection with a business transfer (such as a merger or acquisition), in which case we will notify you where required.

We operate internationally, and our service providers (including Microsoft Azure, Polar, and our email provider) may process and store data in countries outside your own, including outside the European Economic Area, the United Kingdom, and Turkey.

When we transfer personal data across borders, we take steps to ensure it remains protected and that the transfer complies with applicable law. For transfers from the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum) or transfers to countries with an adequacy decision. For transfers subject to KVKK, we rely on the transfer mechanisms permitted under Turkish law.

You can contact us at [email protected] for more information about the safeguards we use.

We keep personal data only for as long as necessary for the purposes set out in this policy, and then delete or anonymize it.

In general: account data and user content are retained while your account is active. If you close your account or delete content, we will delete or anonymize the associated personal data within a reasonable period, except where we need to retain certain records to comply with legal, tax, or accounting obligations, to resolve disputes, or to enforce our agreements. Billing records held in connection with Polar transactions may be retained for the periods required by applicable tax and financial law.

Fan submissions may be removed by the account owner at any time and are retained according to the account owner's use of the moderation tools and our standard retention practices.

We do not guarantee that uploaded images, videos, or other media will be retained for any particular period or kept available. Such media may be deleted or become unavailable at any time, with or without notice; please keep your own copies of anything you wish to preserve.

We take reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. These include access controls, encryption in transit, secure authentication and session handling, and reliance on reputable infrastructure providers such as Microsoft Azure.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You also play an important role: please keep your password confidential and notify us promptly at [email protected] if you believe your account has been compromised. Where required by law, we will notify the relevant authorities and affected individuals of a personal data breach.

Depending on where you live and the applicable law, you have rights over your personal data. Under GDPR and Turkey's KVKK, these include:

• Access — to be informed whether we process your data and to obtain a copy of it.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to request deletion of your data in certain circumstances (the "right to be forgotten").
• Restriction — to ask us to limit how we use your data in certain cases.
• Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Portability — to receive certain data in a portable format and, where technically feasible, have it transferred to another provider.
• Withdraw consent — where we rely on your consent, to withdraw it at any time without affecting prior lawful processing.
• KVKK-specific rights — to learn the purposes of processing and whether data is used accordingly, to know any third parties (domestic or abroad) to whom data is transferred, to request correction or deletion and notification of such actions to third parties, to object to outcomes from solely automated analysis, and to claim compensation for damages caused by unlawful processing.

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before acting on your request, to protect your data. We will respond within the timeframes required by applicable law (for example, generally within one month under GDPR and within 30 days under KVKK).

Exercising your rights is free in most cases, though we may charge a reasonable fee or decline requests that are manifestly unfounded, excessive, or repetitive, as permitted by law.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with a supervisory authority — in the EEA, your local data protection authority; in the UK, the Information Commissioner's Office (ICO); and in Turkey, the Personal Data Protection Authority (KVKK Kurumu / KVKK Board). We would, however, appreciate the chance to address your concerns first.

The Service is not directed to children. We do not knowingly collect personal data from children under the age of 13, or under the higher minimum age required in your country (for example, up to 16 in some EEA countries).

If you are a parent or guardian and believe a child has provided us with personal data, please contact us at [email protected] and we will take steps to delete it. Account owners who publish public show pages are responsible for ensuring their use of the Service, including audience interactions, is appropriate for their audience.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you through the Service or by email.

Your continued use of the Service after an update takes effect means you acknowledge the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

Nucleus, Türkiye. Email: [email protected]. For questions specifically about payments, billing, or refunds, please also refer to Polar, our Merchant of Record, and Polar's own privacy policy.