Privacy

The desk collects the minimum it needs to run your case, sell you a box and deliver it. This page lists all of it. Operated by Bunbun Labs Limited, registered in the United Kingdom. Last updated 15 August 2026.

What we collect

Your email address, when you order. It is used to deliver your dossier and your receipt, and to answer you if something goes wrong.
Your order record: which box, which tier, the price, the time, and the order reference. We keep this for delivery, support, and accounting.
Payment is handled entirely by Stripe on their pages. We never see or store your card number. Stripe's own privacy policy covers what they process.

The restock bell

The bell is the one thing on this site that is a mailing list, and it is opt-in twice. When you leave an address we store the address, the time, which page you rang it from, and a one-way hash of your network address used only to stop a script from flooding the form. We then send one message asking you to confirm.

Until you click that link, nothing else is ever sent to you. An unconfirmed address cannot be selected by any send we run.
Every message carries a one-click unsubscribe, honoured immediately and without a login. Your mail app's own unsubscribe button works on it.
We do not store your name, your browsing, or a raw network address.
When you arrive through a campaign link we keep the channel facts the link itself carried (utm_source, utm_medium, utm_campaign, a referral code, the referring page, and the page you landed on). Those facts let us see which of our posts and pages actually bring signups. They are stored with the address and used for nothing else; no identity is derived from them, and no third party receives them.
Unsubscribing marks the row rather than deleting it, because that mark is what keeps you off future sends. Ask us and we will delete it outright.

The case room (the live workspace)

Describing an idea on the front page opens a session. A session stores what it needs to run the case and nothing else: the messages you type and the desk's replies, the framing you choose for the dig, the receipts the dig fetches (source URL, title, date, and a verbatim quote of under 400 characters), the determination, and a one-way hash of your network address used only to rate-limit the door. If you unlock the workspace, the email address you give at checkout is stored on the session for the receipt and the PDF export. Every session, paid or free, is deleted 30 days after it opens; the accounting parts of a paid order are kept as tax law requires and nothing longer. Your idea is never stocked, sold, or listed. A session link (the ?s= address) resumes the free view for anyone who holds it; the paid workspace stays behind the payment, not behind the link.

What we do not do

No analytics trackers, no advertising pixels, no third-party cookies.
We do not sell, rent, or share your email with anyone.
No marketing emails unless you explicitly ask for them. Buying a box does not subscribe you to anything.

What stays in your browser

The machine remembers two preferences locally on your device only: whether sound is on and whether you chose the day or night scene. The case room remembers your current session reference, its short-lived access token and the framing you typed, so a refresh resumes your case. None of it leaves your browser except to run your own session.

Where your data lives

Order records and case sessions live in the lab's own database on our own server. The dig fetches public pages from public sources; it sends them nothing about you. Delivery email goes through our mail provider. Stripe holds the payment record. That is the complete list of systems that touch your data.

Your rights

Write to orders@aibzpro.com to ask what we hold about you, to correct it, or to have your email deleted. We keep the accounting-required parts of order records for as long as tax law requires, and nothing longer than that.