Playbook

GDPR overview

There is no mention of the GDPR anywhere on Playbook's website: the term does not appear once across the pages collected, and no compliance statement, Data Processing Agreement, subprocessor list or Article 27 EU representative is published. The privacy policy nevertheless grants rights that mirror the regulation, including confirmation of processing, access, a copy of the data, portability, objection, restriction, rectification, withdrawal of consent and erasure, and it tells users in the European Economic Area and the United Kingdom that they may lodge a complaint with a supervisory authority. A dedicated right-to-be-forgotten procedure runs through support@playbook.com and requires proof of identity. For California residents, the company states that it does not sell personal information. In short, GDPR-shaped rights are offered in practice, but the formal compliance paperwork a European buyer usually asks for is absent.

Who owns the data?

Playbook's terms are explicit: you keep ownership of your User Content, and Playbook claims no ownership rights over the files you upload. The company and its licensors own the service itself and the Playbook Content around it. To run features such as commenting, sharing, search, thumbnails and organisation, you grant Playbook a limited right to access, store and process your files, and that permission extends to its affiliates and to the trusted third parties it works with, including the providers behind its AI features. One exception cuts the other way: any feedback or suggestion you send the company is irrevocably assigned to it.

Reuse rights

Because ownership stays with you, you can reuse, publish, licence or sell your own files without asking Playbook for permission; the terms state that nothing in them restricts your rights to use and exploit your User Content. What you may not reuse is Playbook's own material: the service, its trademarks, logos and page layouts remain the company's, and mirroring, framing or reverse-engineering them is prohibited. Files that other users share with you follow their rights, not yours, and you must hold every right needed for whatever you upload. Playbook states that it does not sell user data to advertisers or third parties, and that customer content is not used to train generalised AI models.

Data retention & training

Hosting summary

Playbook makes no commitment about where data lives. Its privacy policy states that information may be transferred, processed and stored anywhere in the world, explicitly including the United States, and warns that destination countries may have different data protection laws. No data centre, cloud provider or region is named, and no residency option appears on the self-serve plans; only Enterprise customers are offered a bring-your-own-storage arrangement. The jurisdiction is American: Playbook Digital, Inc. is based at 341 Moultrie St in San Francisco, the terms are governed by the law of the State of California, and corporate disputes are heard in the Northern District of California. On security, the vendor claims encryption at rest, two-factor authentication, secure backups and malware scanning, without publishing an audit or certification to support those claims. The public website itself is delivered through Cloudflare. Any organisation with residency obligations should obtain written answers before uploading regulated material.