CPG Playbook · Colorado LLC
Service-provider Register
Effective · Version 2026-11-05.1
CPG Playbook, a Colorado limited liability company, uses service providers to operate the Service. This register describes their functions and the information relevant to those functions. It supplements the Privacy Policy; it is not a statement that every provider receives every customer’s information.
1. Infrastructure, communications, and administration
| Provider | Function and information involved | Use in the Service | Provider information |
|---|---|---|---|
| Supabase | Authentication, database, and file storage; account information, permissions, workspace records, uploaded material, and associated activity. | Core service infrastructure. | Privacy |
| Railway | Application hosting and delivery; request and operational metadata and information processed by the hosted application. | Production hosting. | Privacy |
| Airtable | Waitlist administration and business-directory source data; waitlist company, contact name, email, optional phone, role, interests, and submission records. | Connected waitlist destination and directory-data workflows. | Privacy |
| Resend | Email delivery and subscription administration; recipient addresses, message contents, delivery events, and subscription preferences. | Supports service communications and newsletter subscriptions. Which messages are dispatched depends on the enabled workflow. | Privacy |
| Stripe | Administration of existing billing arrangements; billing contacts, customer and subscription identifiers, payment status, and transaction records. | Existing billing records and account services. The free-access program does not itself authorize a charge. | Privacy |
| PostHog | Product measurement, diagnostic events, operational monitoring, and associated browser/session or opaque user identifiers. | United States endpoint. Optional browser collection and persistence require permission; server operational monitoring runs separately. Session replay is disabled. | Privacy |
Provider roles can differ by activity. For example, a payment provider may process information for its own legal and fraud-prevention obligations as well as provide a service to us. A provider’s own policy describes its independent practices; it does not replace our responsibilities.
2. Automated processing providers
| Provider or route | Function and information involved | Use in the Service | Provider information |
|---|---|---|---|
| OpenRouter and the downstream provider serving the selected model | Routing and execution of generation or analysis requests; submitted input, relevant context, attachments or extracted content, and processing metadata. | The primary configured chat route. The downstream provider depends on the model and route used for the request. | OpenRouter Privacy and provider-routing documentation |
| Meta model services | Generation and analysis using submitted input and relevant context. | An available alternate processing integration; not the primary configured chat route. | Meta Privacy Center |
| SpaceX Super Intelligence (Grok API, configured as xAI) | Generation or analysis using submitted input and relevant context. | A configured processing integration whose use depends on the selected feature and model. Configuration does not mean every request uses this provider. | Business/API information and website privacy |
A downstream provider is not selected merely because its software library is installed. Provider availability, routing, and feature selection can change. Contact hello@cpgplaybook.com for information about the route applicable to a particular processing need. Do not submit information requiring an exclusive provider, a particular processing country, or special retention or training restrictions unless those requirements have been expressly agreed and can be met for that workflow.
3. Processing scope, location, and safeguards
Providers receive information relevant to the functions they perform. The nature of their access differs: application hosting and storage involve service content, email delivery involves message content and recipients, and measurement uses selected operational information. Publishing information or connecting your own external service can create additional recipients under your direction.
CPG Playbook serves United States businesses. PostHog is configured for its United States endpoint. Other providers operate infrastructure and support in locations described in their own documentation and agreements; this register does not promise exclusive United States processing. Security certifications held by a provider are not certifications of CPG Playbook.
Provider-specific restrictions and transfer requirements must be assessed for the applicable service and agreement. If your organization requires a processing agreement, see our Data Processing Addendum, which takes effect only through separate written acceptance.
4. Updates and requests
We update this register when material provider arrangements change. Any additional notice, authorization, or objection procedure under a separately accepted processing agreement also applies. Contact hello@cpgplaybook.com for provider questions or to request information needed to assess your intended use.