1. Who is responsible
We are the controller for data about website visitors, people who contact us, and the account and billing data of our customers’ users. For personal data inside the projects our customers create (Customer Content), we act as a processor on the customer’s behalf under our Data Processing Agreement; the customer is the controller and you should contact them first.
Contact: [Company legal name], [Registered address], [Country] — privacy@playabledesk.com.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Contact form and emails: name, work email, studio, role, message | Reply to you and arrange a call | Legitimate interest; steps before a contract |
| Account: name, email, job title, time zone, password (stored hashed by our authentication provider) | Provide the platform and secure access | Contract |
| Usage: sign-in records, IP address, AI agent usage per member, activity log of organization changes | Security, abuse prevention, usage limits, showing admins their organization’s usage | Contract; legitimate interest |
| Billing: company details, invoice contacts, payment records | Invoicing and accounting | Contract; legal obligation |
| Support conversations (e.g. Slack, email) | Help you and improve the service | Contract; legitimate interest |
We do not sell personal data, do not use it for advertising profiles, and do not use customer content to train AI models.
3. Cookies
The website uses no advertising or analytics cookies. The platform uses strictly necessary cookies to keep you signed in, and remembers display preferences (like the theme) in your browser. If we add analytics in the future we will update this policy and ask for consent where required.
4. AI features
When a user asks the AI agent for help, the request and the relevant parts of the project are sent to the selected model provider (Anthropic or OpenAI) to generate a response. These providers process the data under business API terms that do not allow training on it, and may retain it for a limited period for abuse monitoring.
5. Who we share data with
Only with service providers that help us run PlayableDesk, under contracts that require them to protect it, and with authorities when the law requires it. If our business is sold or merged, data may transfer to the new owner under this policy.
6. Service providers
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication and file storage for the platform | [Region of the Supabase project, e.g. EU (Frankfurt)] |
| Netlify, Inc. | Hosting and content delivery for the website and the platform | United States / global CDN |
| Anthropic, PBC | AI models for the in-editor agent (only content sent to the agent) | United States |
| OpenAI, L.L.C. | AI models for the in-editor agent (only content sent to the agent) | United States |
| Resend, Inc. | Transactional email (invitations, password resets) | United States |
7. International transfers
Some providers are located outside the European Economic Area and the UK. Where that happens we rely on an adequacy decision (such as the EU–US Data Privacy Framework where the provider is certified) or the European Commission’s Standard Contractual Clauses, with the UK addendum where relevant.
8. How long we keep data
- Contact requests: up to 24 months after our last conversation, unless you become a customer.
- Account and usage data: for the life of the account, then deleted or anonymised within 90 days.
- Customer Content: as described in the Terms — read-only for 30 days after a subscription ends, then deleted within 90 days.
- Invoices and payment records: as long as accounting law requires (typically 6–10 years).
9. Security
Data is encrypted in transit and at rest, each customer’s data is isolated by access rules enforced in the database, access is invitation-only with role-based permissions, and changes to organizations are recorded in an activity log. See the security measures in our DPA.
10. Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict certain processing, and withdraw consent. Email privacy@playabledesk.com; we reply within one month. You may also complain to your data protection authority.
11. Children
PlayableDesk is a business service and is not intended for anyone under 16.
12. Changes
We will post updates here and change the effective date. For material changes affecting customers we will also notify account owners.