Playbook AI Policy

1. Definitions

This policy applies to Customer's use of the AI Features in Playbook. Capitalized terms not defined here have the meaning given in the Playbook Terms of Service (the "Agreement").

AI Features: features of Playbook that use machine learning to analyze, search, organize or generate content, including AI search, automatic tagging, duplicate detection and facial recognition.
Applicable Law: any law that governs Customer's use of the AI Features, including data protection, biometric privacy and AI laws.
Biometric Data: personal data produced by technical processing of a person's physical characteristics that allows or confirms the unique identification of that person.
Face Data: the Biometric Data facial recognition creates. That is a face template (a list of numbers computed from a face in an image) and the position of that face in the image.
Customer Content: files and other material uploaded to, generated in or stored in Playbook by Customer and its Users.
Input: prompts and other data Customer submits to an AI Feature. Output: what an AI Feature returns for an Input or produces from Customer Content.
Roles: for personal data in Customer Content, Customer is the controller (or business), and Playbook is the processor (or service provider) acting on Customer's instructions under the Agreement and the Data Processing Addendum (the "DPA").

2. Responsible use

Human oversight. AI Features suggest; people decide. Users can rename, correct, regroup or remove anything an AI Feature produces, including the people facial recognition groups.
Intended use. Customer uses each AI Feature only for its intended purpose as described in Playbook's documentation. Customer is responsible for its own internal policies on AI use.
Review of Outputs. Outputs can be wrong. Customer reviews Outputs before relying on them.
Prohibited uses. Customer will not use the AI Features to:
1. monitor, track or surveil individuals;
2. make or support decisions about a person's employment, credit, housing, insurance, education or access to services;
3. support law enforcement or immigration enforcement;
4. identify people by matching against sources outside its workspace;
5. infer or categorize people by race, ethnicity, religion, health, sexual orientation, political views or other sensitive characteristics, or recognize emotions;
6. create deceptive content, impersonate people, or produce content that causes legal, reputational or economic harm;
7. reverse engineer, extract or copy the models behind the AI Features, or get around their safeguards;
8. build or train competing AI models, or label data for training third-party models.
No training. Playbook does not train, fine-tune or otherwise improve any AI model with Customer Content, Inputs, Outputs or Face Data, and does not let any third party do so.
Third-party providers. Some AI Features use third-party AI providers, listed in our sub-processor list (Annex III of the DPA). Facial recognition does not: it runs entirely on Playbook's own service (section 4).

3. Ownership

Customer keeps all rights in its Customer Content and Inputs, and confirms it has the rights needed to submit them. Playbook assigns to Customer whatever rights it has in the Outputs.
AI Features can produce similar Outputs for other customers, so Playbook does not guarantee that an Output is unique.
Playbook keeps all rights in the AI Features and their models, and grants Customer the rights needed to use them under the Agreement.

4. Facial recognition and Biometric Data

What it does. Facial recognition finds faces in the images in a workspace's boards and archive. It creates a face template for each face, then groups images of the same person so members can find and name them. It does not process video.
Where it runs. Playbook's own face-recognition service processes the images, on Google Cloud in the United States (Oregon). It fetches each image over an encrypted connection, and keeps no copy of the image, the face or the template after it answers. Face Data is stored, encrypted at rest, in Playbook's databases in the United States. No third-party face-recognition provider receives Customer Content.
What Face Data is used for. Only to group and find images of the same person within the workspace that owns them. Playbook never:Face templates are not shown in the product, and no API, export or integration returns them.
1. compares Face Data across workspaces;
2. matches faces against outside databases, the internet or lists of public figures;
3. infers age, gender, emotion, ethnicity or any other attribute from a face;
4. sells, leases or trades Face Data, or otherwise profits from it;
5. discloses Face Data, except to sub-processors that store or process it for Playbook under the same obligations, or where the law requires.
Turned on only by an administrator's agreement. Facial recognition is available on Team and Enterprise plans, and the Team and Enterprise trials. It starts in a workspace only after an administrator reads a summary of this policy in the product and chooses Agree on behalf of Customer. Playbook records who agreed, when, which version of this policy, and the location of the connection used. Only the workspace's own owners and administrators can answer; Playbook staff never answer on Customer's behalf. If the administrator declines, facial recognition stays off and no faces are processed. An administrator can turn it on later in Settings > AI, which asks for the same agreement, and can turn it off at any time. Turning it off stops processing at once and deletes the workspace's Face Data within 30 days, unless an administrator turns it back on before then. Administrators can also remove a person, which deletes that person's Face Data at once (copies in the search index within minutes) and excludes the photos they appeared in from future facial recognition until those photos' content changes.
Not available in Illinois. Playbook does not offer facial recognition to workspaces located in Illinois, USA. Playbook checks the location of the connection an administrator uses to agree to this policy. When that location is Illinois, or cannot be determined, facial recognition cannot be turned on from that connection. Customer must not misstate its location or otherwise get around this restriction. Customer must turn facial recognition off if it is located in Illinois.
Customer's responsibilities. Customer decides whether facial recognition stays on in its workspace, and is responsible for using it lawfully. In particular, Customer must:These obligations are part of Customer's obligations for Customer Content under the Agreement, including its indemnification obligations.
1. tell its Users that it uses facial recognition, and tell the people whose faces appear in its images where Applicable Law requires;
2. obtain every consent, release or other legal basis Applicable Law requires, including any written release a biometric privacy law requires, before uploading images of people while facial recognition is on, and before leaving it on for images already in the workspace;
3. turn facial recognition off if it cannot meet these requirements;
4. handle requests from people who appear in its images, using the tools in section 6.
Playbook's responsibilities. Playbook processes Face Data only to provide facial recognition to Customer, under the Agreement and the DPA. It protects Face Data with at least the care it gives its own most sensitive data, and never less than reasonable care. It deletes Face Data on the schedule in section 5.

5. Retention and destruction

This schedule is Playbook's public retention and destruction policy for Biometric Data. Playbook permanently destroys Face Data when the purpose it was created for ends, at the latest at the first event below that applies.

Event	What is destroyed	When
An image is deleted	The Face Data from that image	Within 45 days of deletion. For the first 30 days the image can be restored from trash
An administrator removes a person	That person's Face Data. Their photos are excluded from future facial recognition until the photo's content changes; the exclusion record holds no Face Data	At once; search-index copies within minutes
Facial recognition is turned off	All of the workspace's Face Data	Within 30 days, unless an administrator turns it back on before then
The workspace moves to a plan without facial recognition, including a trial that ends without an upgrade, or Playbook stops offering facial recognition to the workspace	All of the workspace's Face Data	Within 30 days, unless facial recognition is available to the workspace again before then
The workspace is deleted	All of the workspace's Face Data	With the workspace
For 12 months, no member of the workspace has used Playbook and the workspace has not used the Playbook API	All of the workspace's Face Data	Within 30 days after the 12 months
Playbook replaces its face model	Templates made by the old model	When the new model ships. They are re-created with the new model or destroyed
Backups	Destroyed Face Data in backups	When those backups expire

When an administrator removes a person, Playbook keeps a record of which photos they appeared in, with no Face Data, until those photos are deleted. This keeps the person removed if facial recognition is later turned off and on again.

6. Requests from people in images

A person who appears in a workspace's images can ask that workspace to remove them. The workspace's administrators handle the request with "Remove person", which destroys that person's Face Data at once (section 5).
A person can also write to support@playbook.com. Playbook passes the request to the workspace and helps carry it out. When the workspace cannot be identified or does not respond within 30 days, Playbook may remove the person's Face Data itself.
Playbook cannot block future matches of a person without keeping their face template, which would defeat the request. So it destroys the template and excludes the person's existing images from grouping.

7. Security

Playbook keeps written information security policies with administrative, physical and technical safeguards, and reviews them regularly, as described in the DPA. For Face Data in particular:

Face Data is encrypted in transit and at rest, and only the systems that provide facial recognition can reach it.
Face templates are never logged, shown in the product or returned by an API, export or integration.
The face-recognition service accepts only authenticated requests from Playbook.
Access to production systems is limited to authorized staff who maintain them.
Unauthorized access to Face Data is handled as a security incident under the DPA.

8. Changes to this policy

Playbook reviews this policy at least once a year. It posts each new version here with its date, and tells Customer about material changes by email or in the product before they take effect. Questions go to support@playbook.com.

Last updated: 22 October 2026