Privacy Policy

1.About this policy

This policy explains how Federal Group Ltd (“Federal”, “we”, “us”) handles personal data when Sellers, sales managers, and other authorised users use the myplays.ai services.

Federal Group Ltd is a company registered in England and Wales (company number 10995182), with its registered office at 20 Bedford Street, Floor 2, London, WC2E 9HP, United Kingdom.

This policy covers the myplays.ai services only. Federal’s consulting business is covered by a separate privacy policy available at federal-group.com.

The myplays.ai services are provided by Federal to organisations that subscribe to them (each, a “Client”). A Client is typically the sales organisation of a B2B company, for example, Cognite, Arkance, or Voith Group. The Client authorises individual employees (each, a “Seller” or “User”) to use the services in the course of their sales work.

If you’re a Seller using the services under your employer’s subscription, your employer is the Client for the purposes of this policy. Your employer determines what data is processed about you and the prospects you research, and how. Federal acts on your employer’s instructions. If you have questions about how your data is used at work, your employer is the right first point of contact. If your concern is specifically about Federal’s handling of your data on the services, you can contact us directly using the details in section 14.

2.The data we process

We process three categories of personal data through the services.

2.1 Seller account data

Data about the individual using the services. This includes:

• Identity data: name, work email address, employer, job title, line manager’s name and email (where provided by the Client), and the sales territory or accounts assigned to the Seller.
• Authentication data: the identity-provider sign-in event (e.g. Microsoft or Google OAuth), session tokens, IP address at sign-in, the device and browser used, and the time of sign-in.
• Configuration data: language and timezone preferences, the Sales Play(s) the Seller is enrolled in, and any role-based access settings.

We receive Seller account data from the Client (usually via an account workbook the Client’s sales operations team maintains), and we receive authentication metadata from the Seller’s corporate identity provider (Microsoft or Google) at sign-in.

2.2 Seller-generated content

Data generated when a Seller uses the services. This includes:

• Conversation data: the prompts a Seller submits to the services’ Sales Play Agents (the Assistants embedded in the services), and the responses generated by those Agents.
• Research outputs: the account research, persona research, and message drafts produced by the services for the Seller.
• Usage telemetry: which features the Seller used, when, and for how long; error logs.

2.3 Prospect and contact data (third-party personal data)

Data about people the Seller is researching or planning to contact in the course of B2B sales activity. This includes:

• Public business data: name, job title, employer, professional email address (where in the public domain or provided by the Client), business phone number, LinkedIn or other professional profile URL.
• Inferred or aggregated data: the Agent’s summary of the prospect’s public-domain professional activity, employer’s strategic priorities, and likely buying interests, based on publicly available sources and the Client’s own first-party data.

We don’t process special category data (such as health, race, religion, or political opinions) intentionally. The services are designed for B2B sales research only. If you become aware that special category data is being processed via the services, please contact us so we can remove it.

We don’t knowingly collect data from or about children. The services are for business use only.

3.Our role as controller and processor

For most of the data described above, the Client is the data controller and Federal is a processor acting on the Client’s documented instructions. This is how it works for:

• Seller account data populated by the Client’s sales operations team.
• Seller-generated content (the Seller works for the Client; the Client determines the purpose of that work).
• Prospect and contact data (the Client determines whom to research and contact).

In these cases, Federal’s processing is governed by the Data Processing Agreement (DPA) the Client signs with Federal as part of its subscription. Sellers wishing to exercise data subject rights over Client-controlled data should contact the Client in the first instance; we’ll support the Client in responding.

For a limited set of data, Federal acts as a controller. This covers:

• Authentication and security logs, which we maintain to detect and prevent abuse, fraud, and unauthorised access.
• Aggregated, de-identified usage metrics used to operate and improve the services.
• Records we are legally required to keep (for example, for tax and accounting purposes).
• Any direct communication between a Seller and Federal’s support function (e.g. messages sent via the “Contact the administrator” form).

Where Federal is a controller, this policy itself describes our purposes, legal bases, and your rights.

4.Why we process data

The legal basis under the UK General Data Protection Regulation depends on the data and the role:

Each Client is responsible for satisfying itself that its use of the services, including the prospecting activity described in 2.3, is lawful under its own jurisdiction’s rules. Federal won’t process Client data for any purpose other than providing the services, unless the Client instructs us otherwise in writing.

5.Data processing

The myplays.ai services use large language models (LLMs) to generate research outputs, persona analyses, and message drafts at the Seller’s request. Sellers should be aware of the following:

• The services draft; the Seller decides. Every Agent output is a draft for the Seller to review, edit, and use as they see fit. The services don’t send any external communication on the Seller’s behalf and don’t make any decision that produces legal or similarly significant effects about a person.
• Article 22 of the UK GDPR isn’t engaged. Because a human Seller remains in the loop for every consequential action, the services don’t carry out solely automated decision-making in the sense of Article 22.
• Prompt and response data is processed by our sub-processors. When a Seller submits a prompt, that prompt and the resulting response are processed by one or more of the providers listed in section 7. The specific provider depends on the Client’s deployment. Sub-processors are contractually prohibited from using Client data to train their general-purpose models.
• AI outputs can be wrong. Sellers should verify any factual claim, name, contact detail, or quotation in an Agent output before relying on it externally. Federal doesn’t warrant the accuracy of any individual Agent output.
• No biometric or sensitive profiling. The services don’t perform facial recognition, voice recognition, sentiment scoring, or any other biometric or sensitive-category profiling.

6.Cookies

At present, the services use only strictly necessary cookies required for authentication and session management. These cookies are set on the .myplays.ai domain by our authentication provider (WorkOS) and our hosting provider (Vercel), and they are essential for the services to function. Under the UK Privacy and Electronic Communications Regulations (PECR), strictly necessary cookies don’t require prior consent, but we identify them here for transparency.

We don’t currently use analytics, advertising, or cross-site tracking cookies on the services. If this changes, we’ll update this policy and, where required, present a cookie banner before any non-essential cookie is set.

7.Sub-processors

We engage the following sub-processors to provide and operate the services. Each is contractually bound by a data processing agreement that obliges it to process data only on our instructions and to maintain appropriate technical and organisational security measures.

7.1 Sub-processors that process Client data as part of delivering the services

Not every Client deployment uses every sub-processor in 7.1. The specific set in use for a given Client is recorded in that Client’s DPA schedule and is available to the Client on request.

7.2 Identity providers (for sign-in)

When a Seller signs in, the Seller’s corporate identity provider is involved in the sign-in flow. The identity provider is determined by the Seller’s email domain and the Client’s configuration:

The identity provider receives only the minimum information necessary to authenticate the Seller. We never receive a Seller’s password.

7.3 Federal’s operational tools that may process Client-related data

In the course of operating the services and the supporting consulting work, Federal may store, edit, or transmit Client-related files (for example, account workbooks, Sales Play documentation, or research outputs) using the following productivity tools:

Both Microsoft and Google are listed in section 7.2 as identity providers and in this section as operational tools. The two roles are distinct: as an identity provider, the sub-processor authenticates a Seller; as an operational tool, the sub-processor stores documents Federal works on.

7.4 Sub-processors used by Federal’s consulting business but not by the myplays.ai services

For completeness, Federal also uses HubSpot (CRM), Xero (accounting), Zoom (video), Slack (internal messaging), GitHub (source control), and Docusign (e-signature) in its consulting business. These services do not process myplays.ai Client data and are listed in Federal’s separate consulting privacy policy.

7.5 Changes to the sub-processor list

We’ll give Clients at least 30 days’ notice before adding or replacing a sub-processor that processes Client data. Notice will be given by updating this policy and notifying the Client’s designated contact.

8.International transfers

Most of our sub-processors are based in the United States. We rely on the following legal mechanisms to transfer personal data outside the United Kingdom:

• The UK Extension to the EU-US Data Privacy Framework for transfers to US sub-processors that have certified to the framework.
• The UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum, for transfers to sub-processors that haven’t certified.
• A transfer risk assessment for each sub-processor relationship, kept on file and made available to Clients on request.

For sub-processors based in the EU (such as n8n GmbH in Germany and Celonis SE in Czech Republic / Germany), we rely on the UK adequacy regulations recognising the EU and EEA as providing adequate protection.

Clients can request copies of the specific transfer mechanisms in place by contacting us at the address in section 14.

9.How long we keep data

We keep personal data only as long as we need it for the purposes described in this policy. The default retention periods are:

Clients can instruct us to delete or return their data at any time during the subscription, and can require deletion at the end of the subscription. Deletion requests are honoured within 30 days, except where a longer period is required by law.

10.Security

Federal is certified to the UK Government’s Cyber Essentials standard. Our current certification is valid from 14 May 2026 to 14 May 2027 and is independently assessed by an IASME-approved certifying body.

Our key technical and organisational measures include:

• Encryption in transit: all connections to the services use TLS 1.2 or higher (HTTPS).
• Encryption at rest: data stored by our sub-processors is encrypted at rest as standard.
• Authentication: multi-factor authentication (MFA) is enforced for all Sellers and all Federal administrative accounts.
• Identity-provider sign-in: Sellers sign in via their employer’s corporate identity provider, so password security is governed by their employer’s policies; Federal never sees, stores, or processes Seller passwords.
• Least-privilege access: Federal staff can access services data only on a need-to-know basis, with administrative actions logged. Separate administrator accounts are used for elevated tasks; standard user accounts are used for routine work.
• Endpoint security: all Federal staff devices run supported operating systems with automatic security updates, host-based firewalls, and managed anti-malware (Bitdefender GravityZone).
• Vulnerability management: critical security updates are applied within 14 days of release; unsupported software is removed.
• Vendor security: every sub-processor is contractually bound to maintain security standards equivalent to ours and to notify us of any incident affecting Client data.
• Incident response: we maintain a written incident response process and will notify affected Clients without undue delay (and in any event within 72 hours of becoming aware) of any personal data breach affecting their data.

No information system can be guaranteed to be 100% secure. We commit to maintaining proportionate, current, independently verified controls, and to being transparent with Clients if anything goes wrong.

11.Your rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access, to ask us for a copy of the personal data we hold about you.
• Right to rectification, to ask us to correct inaccurate or incomplete data.
• Right to erasure, to ask us to delete your data, where there is no overriding reason to keep it.
• Right to restrict processing, to ask us to limit how we use your data, in certain circumstances.
• Right to object, to object to our processing of your data on the basis of legitimate interest, including for direct marketing (we don’t currently use the services for direct marketing).
• Right to data portability, to receive a copy of the data you provided to us in a structured, commonly used format.
• Rights related to automated decision-making, see section 5 above; the services don’t engage in solely automated decision-making.

How to exercise these rights:

• If your data is processed by the services under your employer’s subscription, your employer (the Client) is the controller and should be your first point of contact. We’ll support your employer in responding.
• If your concern relates to Federal’s processing as a controller (for example, security logs or support communications), you can contact us directly using the details in section 14.

We’ll respond to a verified request within one calendar month. There is no fee for exercising these rights, except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at any time:

• ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• 0303 123 1113
• www.ico.org.uk

We’d appreciate the chance to address your concern first, but you aren’t required to contact us before going to the ICO.

12.Prospects: a note about being researched

If a Seller using the services has researched you in the course of B2B sales activity, you may be a “prospect” in the sense described in section 2.3.

Federal processes prospect data only on the instruction of the Client who employs the Seller. The Client is the controller. If you wish to:

• Know what data is held about you in connection with a specific Client’s use of the services,
• Object to that Client’s processing of your data, or
• Request deletion,

please contact the Client directly. If you don’t know which Client is involved, you can contact us at the address in section 14 with as much detail as you can provide (for example, the name of the company whose Seller approached you), and we’ll help route your request.

In any event, the services don’t enable Sellers to send messages directly to prospects. The Seller drafts in the services, copies the draft into their own email or LinkedIn account, and sends from there using their employer’s own infrastructure.

13.Children

The myplays.ai services are intended for use by professional B2B sales people and their managers. They aren’t intended for, marketed to, or designed for use by children under 18. We don’t knowingly process personal data of children.

14.Contact us

For questions about this policy, or to exercise any of the rights described in section 11:

Federal Group Ltd
20 Bedford Street, Floor 2
London WC2E 9HP
United Kingdom

Email: privacy@myplays.ai

For services support questions (not privacy questions), please use the “Contact the administrator” link on the sign-in page, which routes to support@myplays.ai.

Data Protection Officer

Under Article 37 of the UK GDPR, an organisation is required to appoint a Data Protection Officer (DPO) only if at least one of the following applies: it is a public authority, or its core activities consist of regular and systematic monitoring of data subjects on a large scale, or its core activities consist of processing special category data on a large scale. None of these apply to Federal Group Ltd. Federal is a private company with a small team; its core activity is providing B2B sales consulting; it doesn’t carry out large-scale monitoring of individuals; and it doesn’t process special category data. Federal therefore has a Data Compliance Lead, in place of a DPO. Federal nonetheless treats data protection as a senior responsibility. The Data Compliance Lead can be reached at privacy@myplays.ai. The Data Compliance Lead carries out the substantive functions of a DPO (acting as the point of contact for data subjects and the ICO, advising on data protection obligations, and overseeing compliance) without holding the formal title.

15.Changes to this policy

We’ll update this policy from time to time to reflect changes to the services, our sub-processors, or applicable law. Material changes will be communicated to Clients at least 30 days in advance. The current version, with its effective date and a brief summary of recent changes, will always be available at https://myplays.ai/privacy.

A change history is maintained at the foot of this policy from version 1.0 onwards.

16.Definitions

In this policy:

• Agent means a Sales Play Agent on the services, an Assistant configured for a specific sales workflow.
• Client means the organisation (typically the sales function of a B2B company) that contracts with Federal for access to the services. Federal’s Clients have, in turn, their own customers, who are not addressed by this policy.
• Personal data has the meaning given in the UK GDPR.
• Sales Play means a defined sales motion within a Client’s go-to-market, for example, “outbound prospecting into the European industrial sector”.
• Seller or User means an individual employee of a Client who has been authorised to use the services.
• Services means the myplays.ai services, including auth.myplays.ai, atm.myplays.ai, and any other subdomain of myplays.ai operated by Federal Group Ltd.
• Sub-processor means a third party engaged by Federal to process personal data in connection with the services.
• UK GDPR means the UK General Data Protection Regulation, as it applies in the United Kingdom following the UK’s exit from the EU.

Change history

Effective date: 17 October 2026

End of policy.