Privacy Policy

1. Information we collect

We collect the minimum information necessary to operate Playbook. This includes:

• Account information. Email address, name, organization name, and authentication credentials managed via passwordless email magic links.
• Financial data from connected sources. When you connect a bank via Plaid, Stripe, or QuickBooks Online, we ingest balances, transactions, customers, invoices, bills, subscriptions, and similar records. We never receive bank login credentials directly. Plaid handles authentication on our behalf.
• Usage data. Standard server logs (IP address, request paths, user agent) and product analytics events used to debug and improve the Service.
• Communications. Emails, support tickets, and chat messages you send us.

2. How we use information

• To provide, maintain, and improve Playbook.
• To reconcile transactions, build forecasts, detect anomalies, and generate reports on your behalf.
• To respond to your requests and provide support.
• To detect, prevent, and address abuse, fraud, and security incidents.
• To comply with legal obligations.

We do not sell your data. We do not use your financial data to train third-party general-purpose AI models. Where we use AI features inside the product, requests are sent to enterprise-grade model providers under terms that prohibit training on your data.

3. Sub-processors

We use the following sub-processors strictly to deliver the Service. Each is contractually bound to handle your data only on our instructions and to maintain appropriate security controls.

• Plaid Inc. Bank account connectivity, transactions, and balances. Plaid handles bank-side authentication so we never receive your bank credentials.
• Stripe, Inc. Subscription, customer, and payment data ingested via our Stripe integration. Also processes payments for Playbook subscriptions.
• Intuit Inc. QuickBooks Online integration for accounts receivable, accounts payable, invoices, and bills.
• Slack Technologies, LLC. Delivery of alerts and digests for customers who connect Slack.
• Anthropic, PBC. Large language model inference for the AI assistant. Anthropic does not train on customer data sent via the API.
• Hetzner Online GmbH. Application hosting and compute infrastructure.
• PlanetScale, Inc. Managed database hosting for application data.
• Sentry (Functional Software, Inc.). Error monitoring and performance telemetry for the application.
• Cloudflare, Inc. DNS, edge network, and DDoS protection for app.onplaybook.com.

We will update this list when we add or replace a sub-processor that handles regulated data. Email support@onplaybook.com to subscribe to change notifications.

4. Data retention

We retain account and financial data for as long as your account is active. If you delete your account, we purge your primary records within 30 days and remove them from operational backups within 90 days. We may retain limited records longer where required by law (for example, audit logs and accounting records).

5. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. Email support@onplaybook.com and we will respond within 30 days. We will verify your identity before acting on a request.

6. Children

Playbook is built for businesses. It is not directed to anyone under 16, and we do not knowingly collect information from children.

7. International transfers

Playbook is operated from the United States. If you access Playbook from outside the United States, you understand that your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your jurisdiction.

8. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify account owners by email and update the “Last updated” date at the top of this page.

9. Contact

Playbook
support@onplaybook.com