PRIVACY POLICY
Last updated October 20, 2026
This Privacy Notice for Sovereign Crown Technologies Inc. (doing business as The Playbook) ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share your personal information when you use our services, including when you:
- Visit our website at https://theplaybookam.com
- Use The Playbook — a daily sports intelligence newsletter that delivers one personalised briefing each morning to subscribers based on their favourite teams, covering men's and women's football (soccer, including the Women's Super League and Liga F), basketball, hockey, American football, baseball, Formula 1, golf, mixed martial arts (UFC), rugby union (Premiership Rugby, the United Rugby Championship and the Top 14), and road cycling (the UCI WorldTour).
- Engage with us in other related ways, including any marketing or events.
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us via our account portal contact path, or by post at the address in section 17.
TABLE OF CONTENTS
1. WHAT INFORMATION DO WE COLLECT?
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
Personal Information Provided by You. The personal information we collect may include:
- names
- email addresses
- consent records (the date, source, and IP address of your subscription consent, kept to honour Canadian anti-spam law)
- the teams you follow and your plan
- the country you signed up from, as reported by our hosting provider (Cloudflare) for your connection
- where your signup came from: the referral code you used, if any, and the campaign tags on the link you followed to sign up or subscribe (for example
utm_source=x), so we can tell which of our posts and links bring readers. These are labels for links we publish, never your identity, and nothing is stored on your device to collect them. For a paid subscription they travel with your checkout to our payment processor (Stripe), which returns them to us
Information Collected Automatically. Our emails contain standard open and click measurement provided by our email service, Resend. When you open an email or click a link in it, we record that event, the time, and the type of device or mail client reported to us. We use this to see whether the paper is reaching you and which parts are read. Blocking images in your mail client stops open measurement.
Sensitive Information. We do not process sensitive information.
Payment Data. We may collect data necessary to process your payment if you choose to make purchases. All payment data is handled and stored by Stripe. You may find their privacy notice at https://stripe.com/privacy.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
2. HOW DO WE PROCESS YOUR INFORMATION?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
We process your personal information for a variety of reasons, including:
- To facilitate account creation and authentication.
- To deliver services to you — providing the requested newsletter briefings.
- To send you occasional product news — for example when we add new sports or teams. You can opt out anytime.
- To measure whether our emails are delivered, opened and clicked — so we can find delivery problems and improve the paper.
- To take payments and manage subscriptions for paid plans.
- To show the notices that apply where you live — we use the country you signed up from for this.
- To protect our Services — fraud monitoring and prevention.
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
In Short: We only process your personal information when we have a valid legal reason to do so.
If you are located in the EU or UK, this section applies to you.
The GDPR and UK GDPR require us to explain the valid legal bases we rely on. For each purpose:
- Delivering the daily paper you signed up for, managing your account and teams, and handling cancellations — performance of a contract (our Terms of Service). We also keep a record of your consent to receive email.
- Taking payment for a paid plan — performance of a contract; keeping billing records — legal obligation.
- Occasional product news (new sports, new teams) — consent, given at signup. You can withdraw it with the unsubscribe link.
- Open and click measurement — legitimate interests (making sure the paper is delivered and improving it). It is disclosed at signup, and you can object at any time by contacting us.
- Security and fraud prevention (bot protection, rate limits, the IP address on your consent record) — legitimate interests.
- Using your signup country to show regional notices — legitimate interests and legal obligation.
The legal bases, in general terms:
- Consent — you have given us permission to use your personal information for a specific purpose.
- Performance of a Contract — necessary to fulfil our contractual obligations to you.
- Legitimate Interests — reasonably necessary to achieve our legitimate business interests.
- Legal Obligations — compliance with applicable law.
If you are located in Canada, this section applies to you.
We may process your information if you have given us express or implied consent. You can withdraw your consent at any time.
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
In Short: We may share information in specific situations with the following third parties.
The third parties we share personal information with:
- Subscriber Database & Cloud Computing: Supabase (DPA)
- Website Hosting, Infrastructure & Security: Cloudflare (Cloudflare Pages, Cloudflare Workers, Turnstile bot protection, and Cloudflare Web Analytics — cookieless aggregate page-view counts, no device identifier and no cross-site tracking; DPA)
- Payments: Stripe (DPA)
- Email Delivery: Resend (primary; DPA), which also provides the open and click measurement described in section 1; Google (Gmail SMTP), used as a standby transport when our primary provider’s daily sending quota is exhausted, so that the morning’s edition still reaches you
- AI Content Generation: Anthropic (Claude; DPA). No subscriber personal data is sent to Anthropic: see section 7.
- Scheduled Send Infrastructure: GitHub Actions (GitHub, Inc.), which runs the job that assembles and dispatches each morning's edition (privacy statement)
- Privacy Requests & Policy Hosting: Termly, which receives the data subject access requests you submit through our request form (privacy policy)
We may also share your information in connection with a merger, sale of company assets, or acquisition.
5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?
In Short: We are not responsible for the safety of any information that you share with third parties that we may link to.
The Services may link to third-party websites. We cannot guarantee the safety and privacy of data you provide to any third-party websites. Any data collected by third parties is not covered by this Privacy Notice.
6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
In Short: We may use cookies and other tracking technologies to collect and store your information.
We may use cookies and similar tracking technologies to gather information when you interact with our Services. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice: https://theplaybookam.com/cookie-policy.
7. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
In Short: We offer products, features, or tools powered by artificial intelligence.
We provide AI Products through Anthropic (the Claude API). Anthropic writes the briefings from public sports data and news: results, fixtures, standings and published articles. No subscriber personal data is sent to Anthropic — not your name, your email address, or what you read. Stories are written once per team and shared by everyone who follows that team. The bylines on our stories are AI writing personas, not human journalists.
8. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
In Short: We may transfer, store, and process your information in countries other than your own.
Our servers are located in the United States. If you are a resident in the EEA, UK, or Switzerland, please be aware your information may be transferred to the United States. We have implemented the European Commission's Standard Contractual Clauses for such transfers. Our Data Processing Agreements that include Standard Contractual Clauses are available at https://supabase.com/privacy.
9. HOW LONG DO WE KEEP YOUR INFORMATION?
In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice.
We keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required by law:
- Your subscriber record (name, email, teams, plan, consent record, signup country) — for as long as you are subscribed.
- Email open, click and delivery events — 13 months from the event, then deleted automatically.
- A web copy of each morning’s paper (so its links work in every mail app), filed under a one-way code made from your email address rather than the address itself — 7 days, then deleted automatically.
- After you unsubscribe — we keep your email address and the record that you unsubscribed on a suppression list, so that we never email you again. You can ask us to delete the rest of your record.
- Payment records — kept by Stripe, and by us for as long as tax and accounting law requires.
When we have no ongoing legitimate business need to process your personal information, we delete or anonymise it.
10. HOW DO WE KEEP YOUR INFORMATION SAFE?
In Short: We aim to protect your personal information through a system of organisational and technical security measures.
We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, no electronic transmission over the Internet can be guaranteed to be 100% secure.
11. DO WE COLLECT INFORMATION FROM MINORS?
In Short: We do not knowingly collect data from or market to children under 16 years of age.
You must be 16 or older to subscribe. We do not knowingly collect, solicit data from, or market to children under 16. By using the Services, you represent that you are at least 16. If we learn that personal information from users under 16 has been collected, we will deactivate the account and delete such data. Contact us via our account portal contact path or by post (see section 17) if you become aware of any such data.
12. WHAT ARE YOUR PRIVACY RIGHTS?
In Short: Depending on your location, you may have rights that allow you greater access to and control over your personal information.
In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws, including the right to request access, rectification, erasure, and data portability. You can make a request by submitting a data subject access request, or by writing to us at the postal address in section 17.
Withdrawing your consent: You may withdraw your consent at any time by contacting us.
Opting out of marketing: You can unsubscribe from our emails at any time by clicking the unsubscribe link in the emails we send, or by contacting us directly.
13. CONTROLS FOR DO-NOT-TRACK FEATURES
Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature. As no uniform standard for implementing DNT signals has been finalised, we do not currently respond to DNT browser signals.
14. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you, correct inaccuracies, or delete your personal information.
15. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?
European Union, EEA and United Kingdom
If you are in the EU or EEA and believe we are processing your personal information unlawfully, you have the right to lodge a complaint with your local data protection supervisory authority. A list of authorities is published by the European Data Protection Board. If you are in the United Kingdom, you can complain to the Information Commissioner's Office. We would appreciate the chance to address your concern first, so please contact us (section 17) before you do.
Australia
We collect and process your personal information under Australia's Privacy Act 1988. If you believe we are unlawfully processing your personal information, you have the right to submit a complaint to the Office of the Australian Information Commissioner.
16. DO WE MAKE UPDATES TO THIS NOTICE?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice.
17. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
Sovereign Crown Technologies Inc.
Attn: Privacy contact
6-2160 Highway 7, Suite 465
Vaughan, ON L4K 1W6
Canada
18. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, correct inaccuracies, or delete your personal information. To request to review, update, or delete your personal information, please fill out and submit a data subject access request.