Privacy Policy

This Policy covers visitors, prospective customers, account holders, invited users, business contacts, and people whose information is included in our Service. It does not govern a third party’s independent website or service.

We determine how information is used for our account administration, business communications, security, and service management. When a customer supplies information about other people for its workspace, that customer determines the purpose of that use and is responsible for appropriate notices and permissions. We process that information to provide the requested service. If a request concerns information controlled by a customer, we may direct it to that customer or assist the customer in responding. A separately accepted Data Processing Addendum governs processing to which it applies.

We collect information you provide, information generated through use of the Service, and information supplied by authorized users, connected providers, or public business sources.

Do not submit passwords for other services, full payment-card details in workspace content, government identification numbers, regulated health records, or other sensitive information that is unnecessary for the intended business workflow. The Service is not designed to receive those categories.

We use information to:

• Create accounts, authenticate users, maintain sessions, and administer permissions.
• Store, retrieve, organize, and process workspace material and deliver requested outputs.
• Support collaboration, invitations, public profiles, directories, and user-directed sharing.
• Respond to inquiries and requests, provide support, and administer waitlists and subscriptions.
• Maintain existing billing relationships and associated accounting, dispute, and compliance records.
• Diagnose problems, measure service usage and reliability, improve features, and prevent misuse.
• Protect accounts, enforce agreements, investigate incidents, and comply with legal obligations.
• Send service communications and, where permitted and consistent with your choices, business updates or newsletters.

Where a law requires a legal basis for processing, we rely on the basis applicable to the activity, such as performing an agreement, complying with legal obligations, legitimate business interests balanced against individual rights, or consent where required. We do not treat registration as blanket consent for every use.

When you request an automated feature, relevant input, attachments, conversation context, or retrieved workspace material may be transmitted to processing providers so they can return results. The information sent depends on the feature and request. Do not submit information you lack authority to disclose for that processing.

Our Service-provider Register identifies infrastructure, processing, communication, and measurement providers and describes their roles. A routing provider can involve a downstream provider selected for a particular request. Provider-specific retention and permitted uses depend on the applicable service, settings, and agreement; this Policy does not promise that every provider has identical retention or data-use terms. Contact us before submitting information that requires special contractual restrictions.

Generated recommendations are decision support for business users. They require your review and do not constitute professional advice or a certification. See the Terms of Service.

We disclose information as needed to:

• Authorized collaborators: Owners, Team members, Guests, and other recipients within the access you or your organization authorize.
• The public: when you publish a profile, listing, share link, or other content intended to be public. Search engines and independent recipients may retain copies.
• Service providers: organizations performing hosting, authentication, storage, automated processing, communications, analytics, payment administration, and support functions for us.
• Connected services: services you or your organization choose to connect or use, subject to their own terms and your authorization.
• Professional advisers and authorities: where reasonably necessary for advice, legal compliance, protection of rights, fraud prevention, or response to a valid legal demand.
• Business successors: as part of a proposed or completed merger, financing, reorganization, acquisition, or transfer of relevant assets, subject to appropriate protections and applicable law.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use personal information for cross-company advertising. Disclosures for operating the Service, public sharing directed by users, and third parties’ independent practices are described above.

We use browser storage for authentication, session continuity, and interface preferences. Optional browser analytics, including PostHog usage and browser diagnostic events and browser-submitted product events, starts only after you allow it through our Cookie preferences. You can decline or withdraw that permission at any time. Global Privacy Control and a Do Not Track signal disable this optional collection, including when an earlier saved preference allowed it.

PostHog uses cookies and local storage when permitted. Session replay and automatic interaction capture are disabled. Selected application events and sanitized browser diagnostics can be collected after permission. Service requests separately produce server-side usage, security, and reliability records needed to operate and protect the Service; these do not depend on the optional browser setting. Withdrawing permission does not erase records already received. See the Cookie Notice for controls and the request procedure below for information already collected.

We retain personal information for the period reasonably needed for the purpose for which it was collected, including operating an active workspace, responding to requests, protecting the Service, maintaining required business records, and resolving disputes. The appropriate period depends on the information’s sensitivity, account and contractual status, legal requirements, security needs, and whether it remains necessary for an authorized business purpose.

Different records can have different retention periods. Closing a user account does not automatically remove shared workspace records, another user’s independently retained material, public copies outside our control, or records subject to legal or security requirements. Backups and service-provider systems may follow separate retention cycles. We do not promise a single deletion or backup-expiry deadline for every system.

You may request deletion through the process below. We will assess the request, applicable obligations, authority over shared records, and any permitted retention exception, and explain the response as required by law. Information retained for a restricted legal or security purpose remains subject to appropriate access and use restrictions.

Email hello@cpgplaybook.com to request access, a copy of information, correction, deletion, or help with your privacy choices. Identify your account or the relevant business relationship and describe the request. Do not send a password, full payment-card number, or unnecessary identity documents. We manage these requests through staff review.

Depending on applicable law and its coverage, you may have rights to know or access personal information, obtain a portable copy, correct inaccuracies, request deletion, withdraw consent, restrict or object to processing, or opt out of certain uses, sales, sharing, or profiling. Those rights and exceptions vary by location, activity, and our legal obligations. The Service’s business audience does not mean that every privacy law is inapplicable.

We may request information proportionate to the risk to verify your identity, authority, and the records involved. An authorized agent may submit a request with evidence of authorization, and we may verify the request directly with you where permitted. We will respond within the period required by applicable law and explain any permitted extension, denial, or exception. Where an appeal right applies, reply to our decision with “Privacy appeal” or send an appeal to the same address; we will review it and explain available further recourse, including contacting the relevant regulator where applicable.

We do not discriminate against you for exercising rights protected by law. We may be unable to provide a feature that requires information you ask us to delete or stop processing. Organization-controlled records may require coordination with the organization. You can unsubscribe from marketing messages using their unsubscribe link or by contacting us; essential service communications may continue while your account or obligations remain active.

We use safeguards intended to protect information, including authenticated access, workspace permissions, transport security, and controls intended to limit sensitive information in diagnostic events. Access and security practices are evaluated in light of the information and services involved. No system or transmission method is completely secure.

Protect your account and review recipients before sharing. Report a suspected security or privacy incident to hello@cpgplaybook.com without including unnecessary confidential information. We will handle incident notifications as required by applicable law and any applicable agreement.

CPG Playbook is a Colorado limited liability company serving United States business users. Our providers may store or process information in the United States and other countries in which they operate. Privacy protections can differ between locations. Where a transfer requires a particular legal safeguard, the applicable parties must establish that safeguard; we do not claim a certification or transfer framework solely because a provider participates in one.

The Service is intended for adults acting in a business capacity and is not directed to children under 18. We do not knowingly solicit personal information from children for their own accounts. If you believe a child has provided information to us, contact hello@cpgplaybook.com so we can investigate and take appropriate action.

We may update this Policy to reflect changes in the Service, our practices, or applicable law. We will publish the revised version and effective date and provide additional notice or obtain consent when required. A change does not authorize an undisclosed use of previously collected information where the law requires further action.

For privacy requests, questions, or complaints, contact CPG Playbook, a Colorado limited liability company, at hello@cpgplaybook.com.