# CPG Playbook — legal documents

Published November 5, 2026 · Version 2026-11-05.1

CPG Playbook, a Colorado limited liability company

Contact: hello@cpgplaybook.com

The Data Processing Addendum requires separate written acceptance as described in that document.

# Terms of Service

Effective November 5, 2026 · Version 2026-11-05.1

These Terms govern access to CPG Playbook’s websites, applications, workspaces, and related services (the “Service”). They are an agreement between CPG Playbook, a Colorado limited liability company (“CPG Playbook,” “we,” “us”), and the individual or organization accepting them (“you,” “Customer”). By accepting these Terms or using the Service after receiving notice of them, you agree to them.

## 1. Business use and authority

The Service is intended for United States business users who are at least 18 years old. It is not a consumer credit, employment screening, medical, emergency, or regulated professional-advice service. If you act for an organization, you represent that you have authority to bind it. In that case, “you” includes that organization, and you must ensure that its authorized users comply with these Terms. If you lack that authority, do not accept on its behalf.

A separately signed agreement controls to the extent it expressly conflicts with these Terms. The [Acceptable Use Policy](https://www.cpgplaybook.ai/acceptable-use) forms part of these Terms. Our [Privacy Policy](https://www.cpgplaybook.ai/privacy) describes personal-information practices; it does not expand the rights you grant in confidential Customer Content.

## 2. Accounts and workspace roles

Provide accurate account and business information, keep it current, and protect your credentials and recovery methods. Do not share individual accounts or give access to someone who is not authorized. Tell us promptly at [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com) if you suspect unauthorized access.

An Owner controls the workspace and its authorized membership. Team members and Guests receive the permissions assigned to their roles and invitations. Owners are responsible for selecting recipients, assigning access, and confirming that invited users are entitled to see the material made available to them. Team members and Guests must stay within that authorization. A Guest’s access to one item does not authorize access to other workspace material.

An organization’s administrator may manage access to information in its workspace, including after a user leaves the organization. Personal accounts, membership, ownership of business records, and rights under privacy law are distinct. We may request evidence of authority when resolving account or workspace disputes. We do not adjudicate ownership disputes between business partners.

## 3. Access, availability, and changes

Subject to these Terms, you may use the Service for your own business activities. We retain all rights in the Service’s software, design, documentation, and technology except the access rights expressly granted here. You may not resell access or represent the Service as your own without our written agreement.

Features and availability can change. We may maintain, improve, replace, or discontinue features, address security concerns, or restrict misuse. We will provide reasonable notice of a material adverse change when practicable, except where urgent security, legal, or operational circumstances require earlier action. No uptime, support-response, or service-level commitment applies unless we separately agree to one in writing.

## 4. Free access and existing billing arrangements

The current free-access program does not itself authorize a charge. We will not convert free access to paid access without presenting commercial terms and obtaining the required acceptance and payment authorization. Usage limits, feature availability, and invitations may still apply during free access.

An existing, separately accepted subscription, invoice, or payment arrangement remains governed by its applicable commercial terms. These Terms do not cancel an existing agreement, alter an accrued payment obligation, or erase billing records. Payment processors may retain records needed for payment administration, disputes, fraud prevention, and legal obligations. Contact [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com) with billing questions. Any future price, renewal, cancellation, tax, or refund terms must be disclosed in the applicable commercial agreement.

## 5. Your content and our processing rights

“Customer Content” means material you or your authorized users submit to the Service, including documents, messages, business data, brand assets, listings, and workspace records. As between you and CPG Playbook, you retain your rights in Customer Content. You represent that you have the rights, permissions, and lawful basis needed to provide it and authorize its intended use.

You grant us a nonexclusive, limited right to host, store, reproduce, transmit, display, and process Customer Content as necessary to provide, maintain, secure, and support the Service; perform your instructions; and meet legal obligations. This includes using service providers to perform those functions. It does not transfer ownership of your content or grant a general right to publish your private workspace content for marketing.

When you choose to publish a profile, listing, link, or other material, you authorize the visibility and distribution associated with that feature. Public recipients may copy or retain material; removing it from the Service may not remove independent copies. Confirm the intended audience before sharing. You are responsible for the accuracy of your published claims and for necessary permissions to use names, images, trademarks, and contact details.

## 6. Automated features and business decisions

The Service can organize information, retrieve material, and generate analyses, text, recommendations, and other outputs through automated processing. Requests and relevant context may be sent to the providers described in our [Service-provider Register](https://www.cpgplaybook.ai/service-providers). Results may be incomplete, inaccurate, outdated, or similar to results provided to others. A citation or confident presentation does not establish accuracy or authorization to use the underlying material.

As between you and CPG Playbook, you may use the outputs delivered to your workspace, and we assign to you any rights we may hold in those outputs, subject to third-party rights and applicable law. We do not promise that an output is eligible for intellectual-property protection, unique, or free of third-party claims. Our software, underlying technology, and preexisting materials remain ours or our licensors’.

You must independently review outputs before relying on or publishing them. In particular, obtain appropriate qualified review of labeling, ingredients, allergens, health claims, regulatory compliance, legal matters, contracts, financial forecasts, taxes, and other consequential decisions. The Service does not replace a lawyer, accountant, food-safety specialist, or other qualified adviser, and it does not certify products or business practices.

## 7. Confidential information

Each party may receive nonpublic information from the other that is marked confidential or should reasonably be understood to be confidential. Private Customer Content is Customer’s confidential information. The receiving party will use confidential information only to perform or exercise rights under this agreement, protect it with reasonable care, and disclose it only to personnel and service providers who need it for that purpose and are subject to appropriate confidentiality obligations.

These obligations do not cover information that the receiving party can show was already lawfully known, becomes public without a breach, is independently developed without use of confidential information, or is lawfully obtained from another source without a confidentiality duty. A party may disclose information when legally required, with notice to the other party where legally permitted and reasonable assistance in seeking protection. Material you intentionally make public is no longer confidential to the extent of that publication.

## 8. Third-party services, sources, and transactions

The Service may connect with external providers, display public-source information, or link to other businesses. Third-party services and transactions may have their own terms and privacy policies. We do not control third-party availability, accuracy, performance, or independent processing. You are responsible for the connections you authorize and the rights needed to use imported material.

A directory listing, introduction, or generated recommendation is not an endorsement, certification, agency relationship, or guarantee of a third party. Unless we expressly agree otherwise, purchases and engagements with listed businesses are between you and those businesses. Third-party notices and applicable software-license terms are available in [Third-party Notices](https://www.cpgplaybook.ai/third-party-notices).

## 9. Acceptable use and feedback

Comply with the [Acceptable Use Policy](https://www.cpgplaybook.ai/acceptable-use), applicable law, and the permissions attached to content and accounts. Do not interfere with security, bypass access controls or usage limits, upload harmful code, infringe rights, misuse personal information, or use the Service for prohibited high-risk decisions.

If you voluntarily provide suggestions about the Service, you permit us to use them without payment or attribution. This permission does not transfer ownership of Customer Content or authorize disclosure of your confidential business information.

## 10. Suspension and termination

You may stop using the Service at any time and request account closure through [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com). Ending a user’s access does not necessarily terminate an organization’s workspace or delete records belonging to that organization. Applicable payment obligations remain governed by the relevant commercial agreement.

We may restrict or suspend access where reasonably necessary to address a material breach, unauthorized use, a security threat, harm to others, or legal requirements. We will give notice and an opportunity to resolve the issue when reasonably practicable. We may terminate for an unresolved material breach after reasonable notice, or immediately where serious misconduct or a legal or security requirement makes continued access inappropriate. We may discontinue the Service with reasonable notice when practicable.

If access ends, contact us promptly about retrieving information you are authorized to receive. Retention and deletion are governed by the [Privacy Policy](https://www.cpgplaybook.ai/privacy), applicable law, and any separately accepted data-processing terms. Termination does not require deletion of other users’ records or records we must lawfully retain. Provisions concerning ownership, confidentiality, accrued obligations, disclaimers, liability, disputes, and other provisions that by their nature should survive will continue.

## 11. Warranties and disclaimers

Each party represents that it has authority to enter this agreement. Except for commitments expressly stated in a separately signed agreement, the Service and its outputs are provided “as is” and “as available,” to the fullest extent permitted by law. We disclaim implied warranties of merchantability, fitness for a particular purpose, title, and noninfringement to the extent those warranties may lawfully be disclaimed.

We do not guarantee uninterrupted or error-free operation, complete security, preservation of every record, the accuracy of third-party information or generated output, or a particular commercial result. Nothing in these Terms excludes a warranty, remedy, or obligation that applicable law does not allow us to exclude.

## 12. Limits of liability

To the fullest extent permitted by law, neither party is liable under this agreement for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, business opportunities, goodwill, or anticipated savings, whether based in contract, tort, or another legal theory and even if advised of the possibility.

To the fullest extent permitted by law, CPG Playbook’s aggregate monetary liability arising out of or relating to the Service or these Terms will not exceed the greater of (a) the fees you paid to CPG Playbook for the Service during the 12 months immediately before the event giving rise to the claim or (b) US $100. Related claims do not multiply this limit.

These limits do not apply to fraud, willful misconduct, or any liability that applicable law prohibits limiting or excluding. They do not restrict a person’s nonwaivable statutory rights or a regulator’s powers. The parties acknowledge that these limits reflect the allocation of risk for the Service, including free access.

## 13. Third-party claims

To the extent permitted by law, you will defend CPG Playbook against a third-party claim that Customer Content you supplied infringes that party’s rights or that your unlawful use or material violation of the Acceptable Use Policy caused that party harm, and pay damages and reasonable costs finally awarded or agreed in a settlement you approve. This obligation does not extend to a claim caused by our unlawful processing, unauthorized modifications to your content, or our own breach of these Terms.

We must promptly notify you of the claim, allow you to control the defense using competent counsel, and reasonably cooperate at your expense. Delay in notice excuses your obligation only to the extent it materially prejudices the defense. You may not settle a claim in a way that admits wrongdoing by us, imposes a nonmonetary obligation on us, or fails to release us without our written consent. We may participate with our own counsel at our expense.

## 14. Colorado law and courts

Colorado law governs these Terms, without applying conflict-of-laws rules that would select another jurisdiction’s law. Subject to any nonwaivable legal right, the state courts located in Colorado and the federal courts located in Colorado have exclusive jurisdiction over disputes arising from these Terms or the Service, and each party consents to their jurisdiction and venue.

These Terms do not require arbitration. Before bringing a claim, the parties are encouraged to contact one another to seek a practical resolution. This does not prevent urgent relief, suspend a filing deadline, or require a person to give up a statutory complaint or remedy.

## 15. Notices, amendments, and general provisions

Send legal notices and questions to [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com). We may send notices to the contact information associated with your account or through the Service. Keep that information current. Electronic notices are effective when delivered, subject to applicable law.

We may amend these Terms by posting a revised version and effective date. We will provide reasonable advance notice of material changes through the Service or an account contact where practicable, and obtain additional acceptance when required by law. Changes are prospective; posting new terms does not by itself create a previously unauthorized charge. If you do not agree to a change, stop using the affected Service before it takes effect and contact us about your account.

These Terms and any agreements expressly incorporated into them constitute the agreement on their subject matter. If a provision is unenforceable, the remaining provisions continue to apply. A failure to enforce a provision is not a waiver. Neither party may assign this agreement without the other’s consent, except to an affiliate or in connection with a merger, reorganization, or sale of substantially all related assets, provided the successor assumes its obligations and your statutory rights are preserved. Neither party is the other’s agent or partner. There are no third-party beneficiaries except where applicable law requires otherwise.

# Privacy Policy

Effective November 5, 2026 · Version 2026-11-05.1

CPG Playbook, a Colorado limited liability company, provides business workspaces, planning tools, directories, and related services. This Policy explains how we handle personal information in those services and on our websites. Contact hello@cpgplaybook.com with privacy questions or requests.

## 1. Scope and responsibilities

This Policy covers visitors, prospective customers, account holders, invited users, business contacts, and people whose information is included in our Service. It does not govern a third party’s independent website or service.

We determine how information is used for our account administration, business communications, security, and service management. When a customer supplies information about other people for its workspace, that customer determines the purpose of that use and is responsible for appropriate notices and permissions. We process that information to provide the requested service. If a request concerns information controlled by a customer, we may direct it to that customer or assist the customer in responding. A separately accepted [Data Processing Addendum](https://www.cpgplaybook.ai/data-processing) governs processing to which it applies.

## 2. Information we collect

We collect information you provide, information generated through use of the Service, and information supplied by authorized users, connected providers, or public business sources.

| Category | Examples and sources |
| --- | --- |
| Account and business information | Name, email address, business or brand, role, account identifiers, authentication information, and preferences provided at registration or later. |
| Workspace content | Messages, prompts, saved playbooks, plans, notes, tasks, uploaded documents, images, brand assets, and other material submitted by you or your collaborators. This can include information about customers, colleagues, or other business contacts. |
| Membership and collaboration | Invitations, invitee email addresses, workspace roles, permissions, shared items, comments, and related activity records. |
| Public material | Business profiles, listings, public links, published descriptions, and contact information that users publish or that we obtain from public business sources. |
| Inquiries and subscriptions | Waitlist and event submissions, company and contact details, optional phone numbers, stated interests, newsletter preferences, support messages, and feedback. |
| Billing information | Customer and subscription identifiers, plan or entitlement information, transaction status, and other records received from payment processors or maintained for existing arrangements. Payment details entered into a processor’s interface are handled by that processor. |
| Technical and usage information | Network and device information needed to deliver requests, browser information, session and cookie identifiers, routes and feature interactions, timestamps, error and security records, and processing usage or cost metadata. |

Do not submit passwords for other services, full payment-card details in workspace content, government identification numbers, regulated health records, or other sensitive information that is unnecessary for the intended business workflow. The Service is not designed to receive those categories.

## 3. Why we use information

We use information to:

- Create accounts, authenticate users, maintain sessions, and administer permissions.
- Store, retrieve, organize, and process workspace material and deliver requested outputs.
- Support collaboration, invitations, public profiles, directories, and user-directed sharing.
- Respond to inquiries and requests, provide support, and administer waitlists and subscriptions.
- Maintain existing billing relationships and associated accounting, dispute, and compliance records.
- Diagnose problems, measure service usage and reliability, improve features, and prevent misuse.
- Protect accounts, enforce agreements, investigate incidents, and comply with legal obligations.
- Send service communications and, where permitted and consistent with your choices, business updates or newsletters.

Where a law requires a legal basis for processing, we rely on the basis applicable to the activity, such as performing an agreement, complying with legal obligations, legitimate business interests balanced against individual rights, or consent where required. We do not treat registration as blanket consent for every use.

## 4. Automated processing and service providers

When you request an automated feature, relevant input, attachments, conversation context, or retrieved workspace material may be transmitted to processing providers so they can return results. The information sent depends on the feature and request. Do not submit information you lack authority to disclose for that processing.

Our [Service-provider Register](https://www.cpgplaybook.ai/service-providers) identifies infrastructure, processing, communication, and measurement providers and describes their roles. A routing provider can involve a downstream provider selected for a particular request. Provider-specific retention and permitted uses depend on the applicable service, settings, and agreement; this Policy does not promise that every provider has identical retention or data-use terms. Contact us before submitting information that requires special contractual restrictions.

Generated recommendations are decision support for business users. They require your review and do not constitute professional advice or a certification. See the [Terms of Service](https://www.cpgplaybook.ai/terms).

## 5. When information is disclosed

We disclose information as needed to:

- **Authorized collaborators:** Owners, Team members, Guests, and other recipients within the access you or your organization authorize.
- **The public:** when you publish a profile, listing, share link, or other content intended to be public. Search engines and independent recipients may retain copies.
- **Service providers:** organizations performing hosting, authentication, storage, automated processing, communications, analytics, payment administration, and support functions for us.
- **Connected services:** services you or your organization choose to connect or use, subject to their own terms and your authorization.
- **Professional advisers and authorities:** where reasonably necessary for advice, legal compliance, protection of rights, fraud prevention, or response to a valid legal demand.
- **Business successors:** as part of a proposed or completed merger, financing, reorganization, acquisition, or transfer of relevant assets, subject to appropriate protections and applicable law.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use personal information for cross-company advertising. Disclosures for operating the Service, public sharing directed by users, and third parties’ independent practices are described above.

## 6. Cookies, local storage, and measurement

We use browser storage for authentication, session continuity, and interface preferences. Optional browser analytics, including PostHog usage and browser diagnostic events and browser-submitted product events, starts only after you allow it through our [Cookie preferences](https://www.cpgplaybook.ai/cookies#privacy-choices). You can decline or withdraw that permission at any time. Global Privacy Control and a Do Not Track signal disable this optional collection, including when an earlier saved preference allowed it.

PostHog uses cookies and local storage when permitted. Session replay and automatic interaction capture are disabled. Selected application events and sanitized browser diagnostics can be collected after permission. Service requests separately produce server-side usage, security, and reliability records needed to operate and protect the Service; these do not depend on the optional browser setting. Withdrawing permission does not erase records already received. See the [Cookie Notice](https://www.cpgplaybook.ai/cookies) for controls and the request procedure below for information already collected.

## 7. Retention and deletion

We retain personal information for the period reasonably needed for the purpose for which it was collected, including operating an active workspace, responding to requests, protecting the Service, maintaining required business records, and resolving disputes. The appropriate period depends on the information’s sensitivity, account and contractual status, legal requirements, security needs, and whether it remains necessary for an authorized business purpose.

Different records can have different retention periods. Closing a user account does not automatically remove shared workspace records, another user’s independently retained material, public copies outside our control, or records subject to legal or security requirements. Backups and service-provider systems may follow separate retention cycles. We do not promise a single deletion or backup-expiry deadline for every system.

You may request deletion through the process below. We will assess the request, applicable obligations, authority over shared records, and any permitted retention exception, and explain the response as required by law. Information retained for a restricted legal or security purpose remains subject to appropriate access and use restrictions.

## 8. Privacy requests and choices

Email [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com) to request access, a copy of information, correction, deletion, or help with your privacy choices. Identify your account or the relevant business relationship and describe the request. Do not send a password, full payment-card number, or unnecessary identity documents. We manage these requests through staff review.

Depending on applicable law and its coverage, you may have rights to know or access personal information, obtain a portable copy, correct inaccuracies, request deletion, withdraw consent, restrict or object to processing, or opt out of certain uses, sales, sharing, or profiling. Those rights and exceptions vary by location, activity, and our legal obligations. The Service’s business audience does not mean that every privacy law is inapplicable.

We may request information proportionate to the risk to verify your identity, authority, and the records involved. An authorized agent may submit a request with evidence of authorization, and we may verify the request directly with you where permitted. We will respond within the period required by applicable law and explain any permitted extension, denial, or exception. Where an appeal right applies, reply to our decision with “Privacy appeal” or send an appeal to the same address; we will review it and explain available further recourse, including contacting the relevant regulator where applicable.

We do not discriminate against you for exercising rights protected by law. We may be unable to provide a feature that requires information you ask us to delete or stop processing. Organization-controlled records may require coordination with the organization. You can unsubscribe from marketing messages using their unsubscribe link or by contacting us; essential service communications may continue while your account or obligations remain active.

## 9. Security

We use safeguards intended to protect information, including authenticated access, workspace permissions, transport security, and controls intended to limit sensitive information in diagnostic events. Access and security practices are evaluated in light of the information and services involved. No system or transmission method is completely secure.

Protect your account and review recipients before sharing. Report a suspected security or privacy incident to [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com) without including unnecessary confidential information. We will handle incident notifications as required by applicable law and any applicable agreement.

## 10. Location and international processing

CPG Playbook is a Colorado limited liability company serving United States business users. Our providers may store or process information in the United States and other countries in which they operate. Privacy protections can differ between locations. Where a transfer requires a particular legal safeguard, the applicable parties must establish that safeguard; we do not claim a certification or transfer framework solely because a provider participates in one.

## 11. Children

The Service is intended for adults acting in a business capacity and is not directed to children under 18. We do not knowingly solicit personal information from children for their own accounts. If you believe a child has provided information to us, contact [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com) so we can investigate and take appropriate action.

## 12. Changes and contact

We may update this Policy to reflect changes in the Service, our practices, or applicable law. We will publish the revised version and effective date and provide additional notice or obtain consent when required. A change does not authorize an undisclosed use of previously collected information where the law requires further action.

For privacy requests, questions, or complaints, contact CPG Playbook, a Colorado limited liability company, at [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com).

# Cookie Notice

Effective November 5, 2026 · Version 2026-11-05.1

This Notice explains cookies and similar technologies used by CPG Playbook, a Colorado limited liability company. It supplements our Privacy Policy and covers browser storage as well as related service measurements.

## 1. Technologies and purposes

Cookies are small records stored by a browser and sent with matching requests. Local storage keeps information in a browser until it is removed or updated. Session storage generally lasts for the browser tab’s session. A service worker can cache application resources to support loading and offline behavior. Server-side records are separate from browser storage.

| Purpose | Technologies and information | Duration and control |
| --- | --- | --- |
| Authentication and security | Supabase session/authentication cookies and related session state support sign-in, refresh, sign-out, and protected requests. | Session and refresh lifetimes follow the authentication configuration. Clearing them can sign you out; ongoing use may renew them. |
| Interface preferences | Local storage and similar state remember choices such as appearance, text size, navigation, and dismissed interface notices. | Usually remains until the application changes it or you clear site data. |
| Application loading | Browser and service-worker caches can store application resources. | Browser eviction, application updates, and clearing site data affect retention. This is not a guarantee of offline access to workspace records. |
| Optional usage and diagnostics | PostHog cookies and local storage associate selected events and diagnostics with browser/session or opaque user identifiers. | Used after permission; withdrawal removes accessible PostHog identifiers from browser storage. SDK and browser settings govern persistence; clearing storage removes local copies but not records already received by the service. |
| Privacy choice | The first-party `cpg_analytics_v1` cookie records whether you allow or decline optional analytics. | Saved for 180 days after a choice, unless you clear it sooner. This is a browser preference, not an account-wide record. |

Names and lifetimes can vary by deployment, authentication project, SDK version, and browser. This Notice does not assign a fixed expiry to every storage item.

## 2. Measurement settings

Optional PostHog browser collection uses the United States endpoint and starts only after you select Allow analytics. It uses cookies and local storage and disables session recording, automatic page-view and interaction capture, heatmaps, surveys, and console recording. Selected application events and sanitized browser exceptions may be transmitted. An opaque user identifier may be associated with events after sign-in. Browser-submitted events sent to our first-party analytics endpoint follow the same optional choice.

Server-side processing, security, error, and reliability records continue separately, including sanitized operational monitoring sent to PostHog. Infrastructure also receives technical information needed to deliver requests. Declining optional browser analytics does not stop these service operations. We do not use this integration for targeted advertising.

## 3. Your controls

Use [Cookie preferences](https://www.cpgplaybook.ai/cookies#privacy-choices), available from the website and application footers, to allow or decline optional analytics. Both choices are available without affecting account access. Optional collection stays off before a choice. A Global Privacy Control signal or Do Not Track value of 1 overrides a saved allowance. The control applies to this browser; repeat the choice on other browsers or devices.

Withdrawing permission stops subsequent optional collection and removes accessible PostHog cookies and local/session-storage identifiers. It cannot recall a request already sent or erase server records previously received. Clearing the preference cookie returns optional collection to its default off state. If the browser prevents saving a choice, an allowance cannot take effect without a saved permission.

You can also inspect, block, or delete site storage through browser settings. Blocking authentication storage may prevent sign-in. Clearing other site data can reset interface preferences. Requests about previously collected information can be sent to [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com).

## 4. Other websites and questions

Following a link to a third-party website or using its payment, authentication, or connected-service interface may involve that provider’s own cookies and policies. Review the relevant provider’s notices. Our [Service-provider Register](https://www.cpgplaybook.ai/service-providers) provides provider references.

For requests about information already collected, see the [Privacy Policy](https://www.cpgplaybook.ai/privacy) or email [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com).

# Acceptable Use Policy

Effective November 5, 2026 · Version 2026-11-05.1

This Policy forms part of the Terms of Service for CPG Playbook, a Colorado limited liability company. It applies to account holders, workspace Owners, Team members, Guests, and material submitted or published through the Service.

## 1. Use only what you are authorized to use

Use accounts, invitations, integrations, and workspace information only with permission. Respect role boundaries and confidentiality commitments. Obtain the rights and permissions needed for documents, images, logos, contact lists, personal information, and other material you upload, import, or publish. A document found online is not necessarily free to copy or distribute.

Do not impersonate another person or business, misrepresent your authority or qualifications, or publish false claims about products, certifications, partnerships, or commercial results. Keep public listings accurate and respect requests to correct unauthorized use of another party’s identity or material.

## 2. Prohibited conduct

You must not:

- Violate law, infringe intellectual-property or privacy rights, or disclose another party’s confidential information without authority.
- Access another account or workspace without authorization, share stolen credentials, bypass permissions, or evade suspensions, limits, or payment controls.
- Upload malware, exploit vulnerabilities, disrupt the Service, overwhelm endpoints, or probe systems beyond permission expressly granted by us.
- Scrape private or access-controlled information, collect personal information for unlawful purposes, or use the Service to send unsolicited or deceptive communications.
- Facilitate fraud, illegal discrimination, harassment, threats, abuse, or exploitation of children.
- Submit unnecessary sensitive personal records, account passwords, full payment-card data, or regulated health information into general workspace or generation features.
- Use outputs as the sole basis for decisions about credit, employment, housing, insurance, healthcare, or other decisions affecting an individual’s legal rights or similarly significant interests.
- Represent generated material as a verified regulatory determination, safety certification, professional opinion, or endorsement by another person without a valid basis.
- Remove required proprietary notices, unlawfully reverse engineer the Service, or redistribute software or content beyond the rights granted to you. Statutory rights that cannot be restricted remain intact.

## 3. Business content and output review

You are responsible for the source, audience, and intended use of the material you submit. Avoid placing a third party’s personal information in a public profile or unrestricted link without appropriate permission. Workspace access does not grant an independent right to reuse another organization’s records.

Review generated content, calculations, quotations, and sources before use. Product claims, labeling, ingredients, allergens, safety instructions, financial projections, and legal documents require review appropriate to their consequences. Do not remove context or warnings in a way that makes material misleading.

## 4. Reporting concerns and rights claims

Report misuse, suspected security issues, or an intellectual-property concern to [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com). Identify the relevant URL or material, explain the concern, provide contact information, and describe your authority to act. For a rights claim, include enough information to identify the protected work or right and the allegedly unauthorized use. Do not send unnecessary sensitive information or attempt to prove a security issue by accessing someone else’s data.

We may request clarification, preserve relevant evidence, restrict content or access, or contact the affected parties as appropriate. We may remove or restrict material or suspend accounts under the Terms of Service, subject to applicable law. If you believe we acted in error, contact the same address with the decision and supporting details for review.

# Service-provider Register

Effective November 5, 2026 · Version 2026-11-05.1

CPG Playbook, a Colorado limited liability company, uses service providers to operate the Service. This register describes their functions and the information relevant to those functions. It supplements the Privacy Policy; it is not a statement that every provider receives every customer’s information.

## 1. Infrastructure, communications, and administration

| Provider | Function and information involved | Use in the Service | Provider information |
| --- | --- | --- | --- |
| Supabase | Authentication, database, and file storage; account information, permissions, workspace records, uploaded material, and associated activity. | Core service infrastructure. | [Privacy](https://supabase.com/privacy) |
| Railway | Application hosting and delivery; request and operational metadata and information processed by the hosted application. | Production hosting. | [Privacy](https://railway.com/legal/privacy) |
| Airtable | Waitlist administration and business-directory source data; waitlist company, contact name, email, optional phone, role, interests, and submission records. | Connected waitlist destination and directory-data workflows. | [Privacy](https://www.airtable.com/company/privacy) |
| Resend | Email delivery and subscription administration; recipient addresses, message contents, delivery events, and subscription preferences. | Supports service communications and newsletter subscriptions. Which messages are dispatched depends on the enabled workflow. | [Privacy](https://resend.com/legal/privacy-policy) |
| Stripe | Administration of existing billing arrangements; billing contacts, customer and subscription identifiers, payment status, and transaction records. | Existing billing records and account services. The free-access program does not itself authorize a charge. | [Privacy](https://stripe.com/privacy) |
| PostHog | Product measurement, diagnostic events, operational monitoring, and associated browser/session or opaque user identifiers. | United States endpoint. Optional browser collection and persistence require permission; server operational monitoring runs separately. Session replay is disabled. | [Privacy](https://posthog.com/privacy) |

Provider roles can differ by activity. For example, a payment provider may process information for its own legal and fraud-prevention obligations as well as provide a service to us. A provider’s own policy describes its independent practices; it does not replace our responsibilities.

## 2. Automated processing providers

| Provider or route | Function and information involved | Use in the Service | Provider information |
| --- | --- | --- | --- |
| OpenRouter and the downstream provider serving the selected model | Routing and execution of generation or analysis requests; submitted input, relevant context, attachments or extracted content, and processing metadata. | The primary configured chat route. The downstream provider depends on the model and route used for the request. | [OpenRouter Privacy](https://openrouter.ai/privacy) and [provider-routing documentation](https://openrouter.ai/docs/guides/routing/provider-selection) |
| Meta model services | Generation and analysis using submitted input and relevant context. | An available alternate processing integration; not the primary configured chat route. | [Meta Privacy Center](https://www.facebook.com/privacy/policy/) |
| SpaceX Super Intelligence (Grok API, configured as xAI) | Generation or analysis using submitted input and relevant context. | A configured processing integration whose use depends on the selected feature and model. Configuration does not mean every request uses this provider. | [Business/API information](https://x.ai/legal/faq-enterprise) and [website privacy](https://x.ai/legal/privacy-policy) |

A downstream provider is not selected merely because its software library is installed. Provider availability, routing, and feature selection can change. Contact [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com) for information about the route applicable to a particular processing need. Do not submit information requiring an exclusive provider, a particular processing country, or special retention or training restrictions unless those requirements have been expressly agreed and can be met for that workflow.

## 3. Processing scope, location, and safeguards

Providers receive information relevant to the functions they perform. The nature of their access differs: application hosting and storage involve service content, email delivery involves message content and recipients, and measurement uses selected operational information. Publishing information or connecting your own external service can create additional recipients under your direction.

CPG Playbook serves United States businesses. PostHog is configured for its United States endpoint. Other providers operate infrastructure and support in locations described in their own documentation and agreements; this register does not promise exclusive United States processing. Security certifications held by a provider are not certifications of CPG Playbook.

Provider-specific restrictions and transfer requirements must be assessed for the applicable service and agreement. If your organization requires a processing agreement, see our [Data Processing Addendum](https://www.cpgplaybook.ai/data-processing), which takes effect only through separate written acceptance.

## 4. Updates and requests

We update this register when material provider arrangements change. Any additional notice, authorization, or objection procedure under a separately accepted processing agreement also applies. Contact [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com) for provider questions or to request information needed to assess your intended use.

# Data Processing Addendum

Published November 5, 2026 · Version 2026-11-05.1

This Data Processing Addendum (“Addendum”) is offered by CPG Playbook, a Colorado limited liability company (“CPG Playbook”). It becomes binding only when CPG Playbook and a business customer (“Customer”) expressly incorporate it into a written agreement accepted by both parties. Publication, account registration, or a request for a copy does not execute this Addendum. The accepting agreement identifies Customer and the parties’ authorized contacts.

## 1. Scope and roles

“Customer Personal Information” means personal information included in Customer Content that CPG Playbook processes on Customer’s behalf to provide the Service. “Data Protection Law” means privacy and data-security law applicable to that processing. “Agreement” means the parties’ agreement for the Service, including the instrument accepting this Addendum. “Security Incident” means a confirmed unauthorized acquisition, access, use, disclosure, alteration, or destruction of Customer Personal Information in systems controlled by CPG Playbook; it excludes unsuccessful attempts that do not compromise that information.

Customer acts as controller or business, and CPG Playbook acts as processor, service provider, or contractor, as those roles are defined by applicable Data Protection Law. If Customer itself acts for another controller, it must have authority to give instructions and enter this Addendum. Information CPG Playbook handles for its own account administration, legal compliance, security, or business purposes is governed by the Privacy Policy and applicable law rather than treated as Customer-directed processing solely because the person also uses Customer’s workspace.

## 2. Instructions and permitted processing

CPG Playbook will process Customer Personal Information only on Customer’s documented instructions to provide, support, secure, and maintain the agreed Service, or as required by applicable law. The Agreement, Customer’s authorized configuration and feature use, and separately agreed written instructions constitute those instructions. CPG Playbook will inform Customer if it reasonably believes an instruction violates Data Protection Law and may suspend the affected processing while the parties resolve the issue.

Where law requires processing outside those instructions, CPG Playbook will notify Customer before that processing unless legally prohibited. Customer is responsible for the lawfulness, accuracy, and minimum necessary scope of information it supplies, required notices and authorizations, and the authority of users and instruction-givers. Customer will not submit prohibited or specially regulated information without a separate written agreement covering the necessary controls.

## 3. Use restrictions and confidentiality

For Customer Personal Information covered by this Addendum, CPG Playbook will not sell it, share it for cross-context behavioral advertising, or retain, use, or disclose it outside the specified business purposes and direct business relationship, except as permitted by Data Protection Law. It will not combine it with personal information from another customer or from its own independent interactions except where law permits the combination for an agreed service purpose. It will not use it to train a general-purpose model except on Customer’s separately documented authorization and under an agreed lawful arrangement.

Personnel authorized to process Customer Personal Information will be subject to confidentiality obligations and access limited to their responsibilities. CPG Playbook will ensure that subprocessors are bound by appropriate written obligations for the functions they perform. These are commitments for processing under an executed Addendum; the parties must confirm that the selected provider arrangements can meet them before initiating that processing.

## 4. Security measures

CPG Playbook will maintain technical and organizational measures appropriate to the nature of the processing and the risks to individuals, taking account of available technology and implementation costs. The security schedule below identifies the baseline controls supporting the Service. CPG Playbook may update measures without materially reducing the protection of covered information.

No certification, independent audit result, service level, data-residency guarantee, or fixed recovery objective is incorporated unless the parties expressly accept it in writing. Customer remains responsible for its credentials, devices, user permissions, sharing decisions, and connected services.

## 5. Subprocessors

Customer authorizes the subprocessors disclosed in the [Service-provider Register](https://www.cpgplaybook.ai/service-providers) at the time this Addendum is accepted, to the extent needed for Customer’s agreed features. For processing routes that involve a downstream provider, CPG Playbook will identify the applicable provider and confirm its contractual coverage before using that route for processing subject to this Addendum. A general routing description does not substitute for an identified, covered subprocessor.

CPG Playbook will impose data-protection obligations appropriate to each subprocessor’s processing and remain responsible for its performance of those obligations to the extent required by the Agreement and Data Protection Law. It will give Customer advance notice of a proposed addition or replacement and a reasonable opportunity to object on documented data-protection grounds before the new subprocessor processes covered information. Notices may be sent to Customer’s authorized contract contact.

The parties will work in good faith to resolve an objection, including using an available alternative or limiting the affected feature. If no reasonable resolution is available, Customer may discontinue the affected processing or terminate the affected service under the Agreement without authorizing processing by the disputed subprocessor. Existing payment and refund terms apply except where law or the parties’ written resolution requires otherwise.

## 6. Individual rights and assistance

Taking account of the processing and information available to it, CPG Playbook will reasonably assist Customer with requests to access, obtain a copy of, correct, delete, restrict, or otherwise exercise applicable rights over Customer Personal Information. It will notify Customer of a request directed to it where the request concerns Customer-controlled information, unless prohibited by law, and will not independently respond on Customer’s behalf except as instructed or legally required.

CPG Playbook will provide reasonable assistance with security obligations, impact assessments, and regulator consultations that apply to covered processing. Customer must provide sufficient detail and lawful instructions. The parties may agree reasonable charges for extraordinary assistance, but charges will not excuse either party’s mandatory obligations.

## 7. Security incidents

CPG Playbook will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Information. As available, the notice will describe the nature of the incident, the information and people affected, likely consequences, measures taken or proposed, and a contact for follow-up. Information may be provided in stages as the investigation develops.

CPG Playbook will take reasonable steps to contain and investigate the incident, mitigate its effects, and cooperate with Customer’s legally required response. Notification is not an admission of liability. Customer is responsible for notices to individuals or authorities relating to its role, except where law requires CPG Playbook to notify directly. The parties will coordinate communications where lawful and practicable.

## 8. Return, deletion, and retained records

At the end of covered processing, CPG Playbook will, at Customer’s choice and subject to applicable law, return Customer Personal Information in a reasonably usable form or delete it, and delete remaining copies unless retention is legally required. The parties will document a secure method and practical completion schedule appropriate to the systems and records involved, without limiting any mandatory legal deadline.

If information is retained because of a legal obligation, CPG Playbook will identify the applicable basis where permitted and restrict its use to that purpose. Backup copies will remain protected and will be removed through the applicable backup cycle; if restored before removal, the relevant deletion instructions must be reapplied. This Addendum does not authorize Customer to delete another organization’s independently controlled records.

## 9. Information, assessment, and remediation

CPG Playbook will make available information reasonably necessary to demonstrate compliance with this Addendum and cooperate with reasonable assessments required by Data Protection Law. Assessments should first use relevant documentation or available independent reports. If further review is reasonably necessary, the parties will arrange proportionate review on reasonable notice, during normal business hours, subject to confidentiality, security, and protection of other customers’ information. These arrangements do not restrict a regulator’s lawful authority.

CPG Playbook will notify Customer if it determines it can no longer meet applicable obligations. Customer may take reasonable and appropriate steps to verify compliant use and, on notice, stop and remediate unauthorized processing, as permitted by law. CPG Playbook certifies that it understands and will comply with the contractual restrictions applicable to its service-provider or contractor role under an executed Addendum.

## 10. International transfers and precedence

The Service is offered to United States businesses. Where a proposed transfer requires a specific international-transfer mechanism, the parties must establish that mechanism before the covered transfer. This Addendum does not by itself incorporate standard contractual clauses or assert participation in a certification framework.

This Addendum prevails over conflicting terms of the Agreement concerning Customer Personal Information. Other terms, including governing law, dispute venue, and liability limits, remain applicable except where Data Protection Law prohibits their application. An invalid provision does not invalidate the remainder. The Addendum lasts for as long as CPG Playbook processes Customer Personal Information subject to it.

## 11. Processing schedule

| Particular | Description |
| --- | --- |
| Subject matter | Hosting and operating the Customer’s business workspace and the agreed features of CPG Playbook. |
| Nature and purpose | Collection, organization, storage, retrieval, display, transmission, analysis, generation, correction, export, and deletion as needed to provide the agreed Service and perform authorized instructions. |
| Duration | The period of covered service and the return/deletion period required by section 8. |
| Individuals | Customer’s authorized users, invited collaborators, personnel, and business contacts whose information Customer lawfully supplies. |
| Information | Business contact and role details, account/workspace identifiers, submitted communications and documents, shared content, and associated activity records included in Customer Content. |
| Restricted information | No intentional processing of children’s information, government identifiers, full payment-card details, regulated health records, or other specially regulated categories without a separately agreed lawful arrangement. |
| Frequency | Ongoing during authorized use, including storage between user requests. |
| Instructions and contact | Authorized workspace operations and documented instructions from the contacts identified in the accepting agreement; CPG Playbook’s contact is hello@cpgplaybook.com. |

## 12. Security schedule

The baseline service controls include:

- Supabase-backed authentication and session management, with role and workspace access controls in the application and database.
- HTTPS delivery and transport-security headers for applicable application requests.
- Server-side handling of privileged credentials rather than exposing them in public client code.
- Restricted administrative actions and checks on access to private workspace material.
- Application-selected telemetry with property filtering and sanitization of diagnostic errors; browser session recording is disabled in the measurement configuration.
- Separation of public sharing from restricted workspace access, subject to Customer’s selected permissions.

These controls describe the service baseline; they do not represent an independent security certification or an assurance that every operational control has been audited. Additional requirements, including a specific backup schedule, geographic restriction, recovery target, audit report, or downstream-provider restriction, apply only when expressly agreed and supported for the covered processing.

# Accessibility Statement

Effective November 5, 2026 · Version 2026-11-05.1

CPG Playbook, a Colorado limited liability company, aims to make its business services usable by people with disabilities. We consider accessibility in the design and maintenance of the Service and welcome reports of barriers.

## 1. Our approach

Our work includes attention to readable structure, descriptive links, keyboard access, visible focus, adaptable layouts, and usable contrast. We use the Web Content Accessibility Guidelines as a reference when evaluating improvements. This Statement does not assert that every part of the Service conforms to a particular WCAG level or that an independent conformance audit has been completed.

Third-party content, connected interfaces, uploaded documents, and older materials may have different accessibility characteristics. We will work with you to understand barriers and identify a practical way to access the information or function you need.

## 2. Request assistance or report a barrier

Email [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com) with “Accessibility” in the subject. If you can, include the page or feature, what you were trying to do, the barrier you encountered, and your preferred way for us to respond. Browser, device, or assistive-technology details can help but are not required. You do not need to disclose a diagnosis or send sensitive medical information.

We will review the report, seek clarification where needed, and discuss an accessible alternative or a correction. If you need information from a document in a different format, identify the document and the format that would help. We will consider requests in light of the task and applicable obligations.

## 3. Feedback and rights

Accessibility feedback is used to understand and address barriers. Personal information included in a report is handled under the [Privacy Policy](https://www.cpgplaybook.ai/privacy). This Statement does not limit rights or remedies provided by applicable law.

# Third-party Notices

Effective November 5, 2026 · Version 2026-11-05.1

CPG Playbook, a Colorado limited liability company, uses third-party software and materials. Their applicable licenses and rights remain in effect. This page provides access to notices collected from the dependencies and bundled fonts used by the Service.

## 1. Software notices

The [software and font license collection](https://www.cpgplaybook.ai/policy-documents/third-party-licenses.txt) contains license and notice text collected from the installed production dependency graph and bundled font sources for this publication. It identifies package names and resolved versions. The Service’s dependency manifest and lockfile determine the components included in a particular release; a listed dependency may be used only on the server or as part of a build or bundled component.

Open-source rights are granted by the applicable copyright holders under their licenses. The [Terms of Service](https://www.cpgplaybook.ai/terms) do not restrict rights those licenses independently grant. Inclusion in the collection does not imply endorsement by a package author or grant rights to trademarks. Some packages have multiple or component-specific licenses; consult the included text for the applicable conditions.

## 2. Fonts

The Service bundles Space Grotesk and Space Mono. Their copyright statements and SIL Open Font License texts are included in the [license collection](https://www.cpgplaybook.ai/policy-documents/third-party-licenses.txt). Local font files are served with the application. Font-name reservations and license conditions remain applicable; no ownership of those typefaces is claimed.

## 3. Business content, brands, and other materials

Business names, product names, logos, customer submissions, directory entries, photographs, and other third-party materials remain the property of their respective rights holders. Their appearance does not imply an endorsement or affiliation. Software licenses do not grant rights to unrelated brand assets or uploaded content.

Users must have the rights and permissions required by the [Acceptable Use Policy](https://www.cpgplaybook.ai/acceptable-use) to upload, share, or publish material. Public availability alone is not a license. To report a missing attribution or a rights concern, identify the material and relevant rights at [hello@cpgplaybook.com](mailto:hello@cpgplaybook.com).