privacy policy

Last updated: 23 September 2026

This policy explains what we do with personal data at european campaign playbook: when you read the site, create an account, join the membership, register for a workshop, work through the digital bootcamp, or subscribe to the newsletter.

You can read almost everything here without giving us anything. Some parts of the site need an account, because they track your own progress or your registration. Where that is the case, we say so below.

For cookies and similar technologies, see our cookie policy.

Data controller

Controller: ROLLOUT DEMOCRACY, trading as european campaign playbook
Postal address: Avenida Lagartijo 20, 1-3 – Spain
Email: sebastian@campaignplaybook.eu

What we collect, and why

Reading the site

You do not need an account to read articles, browse workshops, or open the prompt library. Our hosting provider records technical data such as your IP address, browser and the pages requested, in server logs used to keep the site running and secure. We also measure page views with a cookieless analytics tool that does not build a profile of you or follow you across other websites.

Creating an account

Accounts are passwordless: you give us an email address and we send you a sign-in link. We store your email address, the dates you signed up and last signed in, and whether you confirmed your address. If you never confirm it, we may send you one final reminder, after which we do not contact you again.

When you set up your profile, we ask for your first and last name and, optionally, your phone number, career stage, organisation type, current employer and areas of interest. You can change or remove these at any time from your account page.

If you arrive through a campaign link, that link carries parameters naming the campaign (for example utm_source and utm_campaign), and your browser tells us which website sent you. Where they are present when you sign up, we record them with your account so we can tell which campaigns bring people to us. This sets no cookie and stores nothing on your device: the values travel with the signup form itself. You can ask us to delete them at any time.

Membership and payments

If you take a paid membership, our payment provider handles the payment and stores the card details. We never see or store your card number. We keep your membership tier, billing interval, status, renewal date and the payment provider's customer and subscription identifiers, so we know what you have access to. Memberships we arrange directly, such as corporate ones, are recorded by us with the plan, price and renewal date.

Workshops and events

When you register for a workshop or event, we record which event it is and when, so we can admit you, send your confirmation with a calendar invitation, and send a reminder before it starts. Online sessions run on a third-party video platform, which processes your data under its own policy when you join.

The digital bootcamp

If you mark a bootcamp episode as complete, we store which episodes you have completed, so the site can show you where you are. That is all we record about how you use the lessons and the prompt library.

If you opt in, we pass your email address to our newsletter platform, which sends you a confirmation email first. You stay unsubscribed unless you click that confirmation. Every newsletter has an unsubscribe link, and you can also opt out from your account page.

Our contact records

When you complete your profile, we copy your name, email address, phone number if you gave one, career stage, organisation type, employer and newsletter preference into our contact database, so we can keep track of who we work with and answer you properly.

Emails we send you

Sign-in links, account emails, event confirmations and reminders are sent through our email provider. Our own team receives a copy of the final reminder sent to unconfirmed accounts, so we can see what went out.

Questions you send us

If you email us, we keep your message and our reply for as long as we need them to deal with the matter and to keep a record of it.

Legal bases

Contract (Art. 6.1.b GDPR):running your account, giving you access to members' content, taking payment, and registering you for events.
Consent (Art. 6.1.a GDPR): the newsletter, and any optional profile details you choose to give us. You can withdraw consent at any time.
Legitimate interests (Art. 6.1.f GDPR): keeping the site secure and available, preventing abuse and bot signups, measuring page views without profiling, maintaining our contact records, and improving what we publish.
Legal obligation (Art. 6.1.c GDPR): accounting and tax records for payments, and responding to lawful requests.

We do not process special categories of data, such as political opinions, about our readers or members. We do not use your data for political profiling or targeted political advertising, and we do not sell it.

Who processes data for us

These providers process personal data on our behalf, under contract and only on our instructions. They run the website and the services around it.

Supabase — accounts, sign-in links and the database holding profiles, memberships, event registrations and bootcamp progress. Privacy policy
Vercel — hosting, server logs, and cookieless page-view analytics. Privacy policy
Stripe — payments and subscription billing. Card details are handled by Stripe, not by us. Privacy policy
Resend — delivery of sign-in links, account emails, and event confirmations and reminders. Privacy policy
Beehiiv — the newsletter, including its confirmation and unsubscribe handling. Privacy policy
Notion — our contact database. Privacy policy
Cloudflare — the bot check on our sign-in and sign-up forms. Privacy policy
Sanity — the content management system behind our articles, images and downloads. It holds published content, not reader data. Privacy policy
Zoom — online workshops and events. Privacy policy

We also use these tools in our wider work:

Mighty Networks — our legacy community platform. New community activity happens here on this site; the platform still holds member data and conversations from that earlier period. Privacy policy
Google Workspace — email, documents and calendars. Privacy policy
Slack — internal team communication. Privacy policy
Zapier — connecting our systems to each other. Privacy policy
Typeform — occasional forms and surveys. Privacy policy

International data transfers

Some of these providers process data on servers outside the European Economic Area. Where that happens, the transfer is covered by the safeguards the GDPR requires, such as the European Commission's Standard Contractual Clauses or an adequacy decision, so your data keeps an equivalent level of protection. You can ask us for details using the contact details above.

How long we keep it

Account and profile: for as long as your account is open. If you ask us to delete it, we act on that as described below.
Membership and payment records: four years after the end of the relationship, and longer where accounting or tax law requires it.
Event registrations: for as long as needed to run the event and keep a record of attendance.
Newsletter: until you unsubscribe, plus a record of the unsubscribe so we do not email you again by mistake.
Unconfirmed accounts: if an address is never confirmed, we send one final reminder and then stop contacting it.
Server logs: kept for a short period by our hosting provider for security and troubleshooting.
Our legacy community platform: member data and conversations from that period stay there until we close the account down. You can ask us to remove your data from it at any time, using the contact details below.

Your rights

You have the right of access, rectification, erasure, objection, restriction and portability, and the right to withdraw consent at any time.

Two of these you can use yourself, from your account page:

Download my data gives you a file with your profile, membership, event registrations and bootcamp progress.
Request account deletion closes your account immediately, cancels any paid membership, and passes the request to us to complete the removal of your data.

You can also contact us directly:

By email to sebastian@campaignplaybook.eu, from the address we hold for you where possible, so we can recognise you.
In writing, with a copy of proof of identity, to:
ROLLOUT DEMOCRACY — Attention to Personal Data
Avenida Lagartijo 20, 1-3 – Spain

Security

Access to member data is limited to the people who need it. Sign-in is passwordless, so there is no password for us to lose. Payment details never reach our servers. Data in our database is protected by per-user access rules, and administrative access is restricted to named accounts.

Supervisory authority

If you think we have handled your data badly, please tell us first so we can put it right. You can also complain to the Spanish Data Protection Agency (AEPD), or to the supervisory authority in your own country.

Use of artificial intelligence

AI is part of what we teach, so it is worth being precise about how we use it ourselves.

We use AI tools to help produce what we publish: researching, drafting, editing, translating and making diagrams for articles, workshops and bootcamp material. A human reviews and approves everything before it goes out.
We do not feed your personal data into AI tools. The website does not send your profile, membership, registrations or progress to any AI provider.
No decisions about you are made by a machine. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects, as described in Article 22 of the GDPR.
In workshops and the bootcamp, you use your own AI accounts, and whatever you type there is governed by the policy of the provider you chose. We tell participants not to paste personal, confidential or sensitive material into those tools.
The AI tools we use in our own production work include OpenAI and Anthropic.

Children

This site is meant for professionals and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes to this policy

When our services or providers change, we update this page and the date at the top. If a change materially affects how we use your data, we will tell account holders directly.

Accessibility

We are committed to making our website and services usable by as many people as possible, regardless of ability or technology.

Standards we aim for. We work towards conformance with the Web Content Accessibility Guidelines (WCAG) 2.1 at level AA and align our efforts with the European standard EN 301 549 and the European Accessibility Act.
What we do. In practice this includes using semantic HTML and clear document structure, supporting keyboard navigation and visible focus states, maintaining sufficient colour contrast, providing text alternatives for meaningful images, and respecting user preferences such as reduced motion.
Ongoing effort. Accessibility is a continuous process. Some content, or material provided by third parties, may not yet fully conform, and we work to identify and correct issues as part of our regular improvements.
Contact and alternative formats. If you encounter an accessibility barrier, or if you need information from this website in an alternative format, please contact us at sebastian@campaignplaybook.eu. We will do our best to respond promptly and to provide the information you need in an accessible way.

This policy describes our own practice. It is not legal advice, and it does not replace the terms of any agreement you have with us.