Privacy

Who we are

This site is run by LunithLabs, at 62 Gates St, Lowell, MA 01851, United States. We decide what personal data the site collects and why, which makes us its controller under UK and EU data protection law.

For anything on this page, write to support@lunithlabs.com. We aim to reply within one business day.

What we keep when you buy

You type your card details into Stripe's checkout page, and Stripe processes the payment. If you choose a bank payment or Klarna, Stripe (and Klarna, under its own privacy notice) handles those details instead. We never see or store your card number. Stripe's page also asks for your email address and the name on the card and, when it needs them, billing details such as your country and postal code.

When the payment goes through, our own order book keeps the order reference, the product and what you paid, your email address and name as you gave them to Stripe, Stripe's references for the payment, the exact wording you agreed to at checkout, when the order was placed and paid, when the order email went out, when each file was downloaded, and, if the link that brought you to the site carried them, the campaign and click identifiers described in the section on cookies and tracking, with the page you arrived on and when.

We use this to deliver the files, send the order email, answer you about the order, put right anything that does not work, answer a disputed payment, keep the accounting records the law requires, and see which advertisement or post led to the sale.

Stripe's dashboard also shows us the card's brand, its last four digits and the billing details you gave, which is how we find a payment when you ask about it.

If you start a checkout and do not pay, the unfinished order is kept, marked as failed, with the email address and name you typed on Stripe's page, if any, and the campaign and click identifiers, if any. We never write to you because of it.

If a payment is refunded in full or disputed, the order is marked as reversed, with a note of which of the two it was.

There are no accounts on this site. The link to your order page carries a private key for your order, and each download is checked against the order book at the moment you ask for the file.

Your order also keeps a link made for it alone. It opens the current version of what you bought, after checking that the order is paid. The link works for your order only, and stops working if the payment is reversed or refunded in full. It is in your order email and on your order page, and nowhere else.

When you open it, our order service checks that the order is paid, then sends your browser on to Notion's site, where the current version lives. From then on Notion handles your visit under its own privacy policy, as any site you visit does. We send Notion nothing about you or your order, and the forward does not pass Notion the address of your link. To copy what you bought into your own workspace you need a Notion account, which is between you and Notion Labs, Inc.

Of that, our own log keeps one line: whether a link was opened or refused, and the order reference when there is one. The line does not hold the link, where it led, or your IP address, and nothing is written to your order. Cloudflare's request log, described under "What happens when you visit", covers the request like any other, for at most seven days.

The page at lunithlabs.com/access, the address printed in the guide, has no form and asks nothing. It only points you to the link in your order email, or to Find my order. It keeps nothing of its own. Like most pages here, it is counted by the visit counting, and Google's script runs on it, as described below.

The order page asks one optional question: "What almost stopped you from buying today?" If you answer, we keep your words, up to 500 characters, with the order reference and the campaign and click identifiers stored with the order, if there are any. Nothing else goes with it: not your email address, your name or your order's download links. If you skip it, nothing is stored. There is no reward for answering, and answering changes nothing about your order.

We also note which buy button you used, and whether you used a phone, a tablet or a computer. We work that out from the description your browser sends with each request, and we do not keep the description itself. If your browser sends Global Privacy Control, we note neither.

If you leave Stripe's page by its back link, we note when you came back.

We count visits to an old page address. The count holds nothing about you.

We also count, for each day, how often each product's buy buttons are used, button by button. If your browser sends Global Privacy Control, the use is counted without the button. The count holds the day, the product, the button and a number, and nothing about you.

When you ask for your links again

The find-my-order page sends the links for every paid order to the address you type, and only to that address. We note the address and the time of each request, so that one address can be sent its links at most three times an hour, and we clear out notes older than a week.

When you write to us

We keep your email address and whatever you put in the message, and use them to answer you and, if the message is about an order, to find that order. Mail to our support address passes through Cloudflare's email routing to the mailbox we answer from.

Emails after you buy

After a purchase we may email you three times about what you bought, at the address you bought with: a check-in about two days after you paid, to ask whether it opened and made sense; another about a week after, to ask what would make it more useful; and a request about two weeks after for a few words about what you bought. There is no reward for a review, and we ask for your honest view.

These emails, and the update notices below, go only to orders placed on or after 10 October 2026. If you bought before that day, we send you none of them. Every update is listed on the updates page, which anyone can read.

We publish a review only if you tell us in your reply that we may, and only with the name you ask us to show. Every buyer gets the same request and the same question about publishing: we do not choose who is asked. Published words stay on the site until you ask us to take them down, and they come down within 7 days of your asking. We keep every review we receive, critical ones included, whether or not it is published. If we show reviews on the site, they are the ones we had permission to show, not every review we received. A reply to one of these emails reaches us like any other support email, and we keep it the same way.

When we release an update to something you bought, we may email you once about it. That email points to the updates page and to lunithlabs.com/access, never to your own link.

Every one of these emails says who it is from and carries our postal address, the one on the terms page. Each is about what you bought and nothing else: it never advertises or offers anything, not even our other products. Each has a link at the foot that stops them in one click, without signing in. The link stops these emails for that order, and for any other order placed with the same address, and does nothing else: it opens no download, no order page and no link to what you bought. Emails about the order itself, such as your files or a reply from support, still come. You can also write to us and we stop them by hand.

For these emails we keep, with the order: when each one went out, and the time you asked us to stop. We do not know whether you open them or which links you click.

If you leave the payment page without paying

If you come back from Stripe's page without paying, the page you land on asks one optional question: "What stopped you?" If you answer, we keep your words, up to 500 characters, the name of the product the page was about, and the day you answered, not the time. We store it without your email address, your order or anything about your browser or connection, and we do not link it to you. There is no discount or offer for answering. If you close the question, nothing is stored.

Mailing list

Buying does not add you to any list. The sign-up forms are a separate choice: you enter your address, we send one email asking you to confirm it, and you are on the list only once you open the link in it. If you never confirm, we send you nothing more.

Before we store an address, Cloudflare Turnstile checks that a person is using the sign-up form, not a program. It runs only where that form is on the page. For the check, Cloudflare's own Turnstile Privacy Addendum, at www.cloudflare.com/turnstile-privacy-policy/, says it reads signals from your browser and your connection, such as your IP address, the way your browser connects, your browser's description of itself, and our site key with the page's address, and that Cloudflare cannot identify a person from them. Cloudflare uses them to tell people from programs, on our behalf, and to improve that check, on its own account. Our own call to Cloudflare sends it the widget's token and nothing about you. We learn only whether the check passed, and we keep nothing from it. It sets no cookie. The confirmation link we then send works for 14 days.

We keep the address, the page you signed up from, and when you signed up, confirmed and left.

Every email to the list says it is from LunithLabs, carries our postal address, and has a one-click way off the list that works without signing in. Leaving takes effect at once. We keep an address that has left, marked as unsubscribed, only so that it is never mailed again.

The list is kept in our own order book and sent through Resend. It is never shared or sold.

What happens when you visit

The pages and the order service run on Cloudflare. Like any web host, Cloudflare handles your IP address and basic browser details to deliver each page and to protect the site from abuse. Cloudflare also asks your browser to report failed connections to it, so that network faults can be found.

Cloudflare keeps a log of each request to the order service, with its technical details, for at most seven days. We use it only to find and fix faults.

We count visits with Cloudflare Web Analytics. A small script from Cloudflare runs on each page, except the pages that show an order, take a payment or find your order. It sets no cookie and stores nothing on your device. It reports to Cloudflare the address of the page, without the part after any question mark, the address of the page that linked to it, how quickly the page loaded and responded, your browser, its operating system and your type of device as your browser describes them, and the country your connection comes from. Cloudflare discards your IP address at the data centre that receives the report, and does not track visitors from one site to another. We see totals, such as how many visits a page had and where they came from, and cannot see who any visitor is.

We count visits because we have a legitimate interest in knowing how the site is used, so that we can improve it. If you would rather not be counted, a content blocker in your browser stops the script, and every page works the same without it.

Our order service also counts how many times each product's page is opened each day. The count holds the day, the product and a number, and nothing about you.

We do not use any of this to build a profile of you.

Google's advertising measurement script also runs when you visit; the section on cookies and tracking says what it does.

Cookies and tracking

Apart from Google's advertising cookies, described below, this site sets no cookies.

If you pick the light or dark theme with the switch at the foot of a page, your browser keeps that one word in its own storage on your device, so the next page opens the same way. It is stored only when you choose it, it is never sent to us, and clearing your browser's site data removes it.

If Cloudflare ever has to check that a visitor is not an automated attack, it can set a short-lived security cookie for that check alone. It is not used to track you.

Stripe's checkout page is on Stripe's own site. Stripe sets the cookies there that it needs to take the payment and prevent fraud, under its own cookie policy at stripe.com/legal/cookies-policy.

One advertising measurement script runs on this site: Google Ads conversion tracking, a script from Google. We use it to count the purchases that follow a click on one of our Google advertisements, and for nothing else: it is set so that Google does not use what it measures here to personalise advertising. It runs on every page except the pages that take a payment or find your order. No other advertiser's script runs on the site, and the one analytics service is the visit counting described above, which sets no cookie.

Advertising cookies are set only when Google can tell you're outside the EEA, UK, Switzerland, Gibraltar, Jersey, Guernsey and the Isle of Man. If it can't tell where you are, or your browser sends Global Privacy Control, none are set. When they are set, the script stores them on your device, under this site's address: _gcl_aw, which keeps the click identifier that Google adds to the link of our advertisement, and _gcl_au, which keeps a random identifier for your browser. It also keeps click information in your browser's storage, under the name _gcl_ls. They let a purchase made days after the click be counted. When the script contacts Google, your browser may also send Google the cookies it holds for Google's own sites, if it has any.

In those countries, and anywhere for a browser that sends the Global Privacy Control signal, the script stores nothing on your device and reads no advertising cookie. It still contacts Google from each page it runs on, without cookies, in what Google calls cookieless pings. They carry the page's address, including any click identifier in it, your browser's details and the consent settings described here and, from the order page, the purchase's amount, currency and order reference. Google shortens your IP address when it collects it. Which of the two applies depends on where Google's script judges your connection to come from.

Wherever it runs, Google receives your IP address and your browser's details with each request, as any website does. On the order page the script is given the page's address without the private key for your order. After a purchase it sends the amount, the currency and our order reference, and nothing about what you bought.

Google, whose script runs here, may collect information about your activity over time and across other sites that use its services, under Google's own privacy policy; policies.google.com/technologies/partner-sites explains it. On this site its script is set so that Google does not use what it collects here to personalise advertising.

After a purchase, the order page keeps a note in your browser's storage, ll-conv- followed by the order reference, that the purchase has been counted, so that opening the page again does not count it twice. It is never sent anywhere, and clearing your browser's site data removes it.

A content blocker in your browser stops Google's script, and every page, the order page included, works the same without it. You can also object by sending the Global Privacy Control signal or by writing to us. What Google has already received it holds under its own terms; Google's privacy policy says how to reach it.

Some links to this site carry campaign or click identifiers in their address. When you arrive from one, the page keeps exactly these, if the link has them: the campaign tags utm_source, utm_medium, utm_campaign, utm_term and utm_content, and Google's click identifiers gclid, gbraid and wbraid. With them it keeps the page you arrived on, without the part after any question mark, and the time you arrived. It keeps nothing else from the link. A value longer than 200 characters is cut or left out, and a value that holds an email address, a web address or a hidden character is left out. They are kept in your browser's storage for that tab alone. Your browser clears them when the tab is closed, unless it later restores that tab. If you buy in that tab, they are stored with your order, so that we know which advertisement or post led to the sale. This record is our own: we send it to no one, it sets no cookie, and a page reached from this site's own pages, or from no other site, adds nothing to it. Google's script, described above, reads the gclid from the same address for itself.

If you arrive from another site without a tracking link, we note only that site's name (for example google), not its address, plus the page of our site you landed on and the time. When you buy, we also note which page you bought from. These are saved with your order. If your browser sends Global Privacy Control, we don't store any of this.

When you arrive from a link, we note where you came from (a short source word such as 'pinterest', and the article that sent you, if any). That note stays in your browser tab during your visit and is saved with your order if you buy, so we can tell which pages lead to sales. It holds no name, email or payment details. If your browser sends Global Privacy Control, we don't keep it.

If you follow a link between our own pages, we note which part of our site sent you (for example the calculator, or the name of one of our articles). This is kept in your browser tab until you close it and saved with your order. If your browser sends Global Privacy Control, we don't store this.

If your browser sends the Global Privacy Control signal, the page keeps none of them. You can also object at any time to our keeping them with your order: write to us, and we delete them from the order and keep the rest.

Our emails carry no images and no tracking. We do not know whether you open them or which links you click.

The site does not respond to the older 'Do Not Track' browser setting. It does respond to Global Privacy Control, as described above.

Who else handles your data

Stripe takes the payment and keeps its own record of it. Stripe also uses payment data for its own purposes, such as preventing fraud and meeting its own legal duties, as a controller in its own right, under its privacy policy at stripe.com/privacy.

Cloudflare hosts the site and the order service, counts visits to the site with its Web Analytics, holds the order book and the list in its database service, stores the files you download, and routes mail sent to our support address.

Cloudflare also runs the Turnstile check on the sign-up form, under the addendum linked above.

Resend sends the order email, the find-my-order email, the sign-up confirmation, and the check-in, review-request and update emails described above, each to the address you gave. Its tracking of opens and clicks is switched off.

The mailbox we answer support from is kept by an email provider, which stores those messages for us.

Google receives what Google Ads conversion tracking sends, as the section on cookies and tracking describes. For counting conversions Google is a controller in its own right: it uses that data under its privacy policy at policies.google.com/privacy and the Google Ads Controller-Controller Data Protection Terms at business.safety.google/adscontrollerterms/, and explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites.

Notion Labs, Inc. runs the site your access link leads to. We send Notion nothing about you. Your browser visits Notion's site as it would any other, and Notion handles that visit, and any account you make there, under its own privacy policy at www.notion.com/trust/privacy-policy.

We do not sell your data or rent it. Apart from the Google measurement described above, which counts our own advertising, we give none of it to anyone in advertising. We disclose it only where the law requires it, for example to a tax authority, or where we must show an order's record to answer a disputed payment.

Where it is processed

We are based in the United States, and our providers process your data mainly there. When you buy from us or write to us, you give your data to us in the United States, where the law does not protect personal data in the same way as in the UK or the European Union.

Stripe, Cloudflare, Resend and Google each take part in the EU-US Data Privacy Framework and its UK extension. Cloudflare's and Resend's data processing terms also provide standard contractual clauses as a fallback.

Notion's site, which your access link leads to, is run by Notion Labs, Inc. in the United States. Notion's privacy policy says that the information it processes "may be transferred, processed, and stored anywhere in the world, including but not limited to, the United States or other countries", and that "when we engage in such transfers, we endeavor to safeguard your information consistent with the requirements of applicable laws". It names no transfer framework or clauses. We send Notion nothing: what it receives comes from your own visit to its site.

How long we keep it

Order records: for seven years after the end of the year of the order, because US tax rules can require us to show them for up to six years after we file the tax return that includes the sale. Then they are deleted automatically.

Unfinished checkouts, and sign-ups to the list that were never confirmed: deleted automatically after 30 days. We send nothing more to either.

Notes of find-my-order requests: deleted automatically after seven days.

Campaign and click identifiers: on your device, until the tab they were kept in is closed. With an order, for as long as the order record, and deleted with it.

Visit counts: Cloudflare keeps each page's report, without your IP address, in full for seven days and then only a sample of them, and shows us six months of totals.

Google's advertising cookies, _gcl_aw and _gcl_au, and any other cookie of Google's whose name begins _gcl_: 90 days on your device, as Google's own cookie pages give them, unless you clear them sooner. The _gcl_ls entry stays in your browser's storage until Google's script or you clear it. What Google receives, it keeps under its own terms, linked above.

The note that a purchase has been counted: in your browser's storage until you clear its site data.

The mailing list: while you are on it. After you leave, the address stays marked as unsubscribed so that it is never mailed again. Ask and we delete it outright.

Support emails: for as long as the order record they are about. Other messages: for as long as we need them to answer you, and no longer than two years after the last reply.

Cloudflare's request logs: at most seven days. Cloudflare's database keeps a recovery history, so a deleted record can remain there for up to 30 days. Resend keeps each email it sends for 30 days. Stripe keeps its own records for as long as its own legal duties require.

Answers to the two optional questions: 24 months, or with the order record if that is deleted sooner. They are then deleted automatically.

The link made for your order, and the notes of which check-in emails went out and of your asking them to stop: with the order record, and deleted with it.

Reviews, and every reply to a check-in email: like other support emails, for as long as the order record they are about. Words we publish from a review: on the site until you ask us to take them down, and down within 7 days of your asking.

Which buy button you used, your type of device, and when you came back from Stripe's back link: with the order record, and deleted with it. The count of visits to an old page address: 25 months. It holds nothing about you.

Whether a reversed order was refunded or disputed: with the order record, and deleted with it. The daily counts of buy buttons used and of product pages opened: 25 months. They hold nothing about you.

The result of the sign-up form's Turnstile check: not kept. Cloudflare keeps what its own addendum and privacy policy say.

What Notion keeps of your visit to its site: what its own policy says.

Why we are allowed to use it

If you are in the UK or the European Union, the law asks us to name a legal basis for each use.

Delivering your order, sending the order email and your links, and answering you about an order: performing our contract with you, or taking the steps you asked for before buying.

Keeping order records for tax and accounting: a legal obligation.

The mailing list: your consent. You can withdraw it at any time by leaving the list; that does not affect what was sent before.

Protecting the site, limiting repeated requests, checking payments for fraud, answering messages that are not about an order, keeping an address that has left the list so it is never mailed again, and answering a disputed payment: our legitimate interest in running a shop that works and is not abused.

Counting visits: our legitimate interest in knowing how the site is used. Keeping the campaign and click identifiers with an order: our legitimate interest in knowing which advertising works.

Measuring our Google advertising, with Google's script and its cookies: our legitimate interest in knowing which of our advertisements lead to sales. This site asks no one for consent. Advertising cookies are set only when Google can tell you're outside the EEA, UK, Switzerland, Gibraltar, Jersey, Guernsey and the Isle of Man. If it can't tell where you are, or your browser sends Global Privacy Control, none are set. When none are set, the script stores nothing on your device and sends only the cookieless pings described above.

The check-in emails, review requests and update notices about something you bought: our legitimate interest in supporting what we sold and hearing how it worked. They are about your purchase only and never advertise anything else. You can stop them at any time with the link in each email, and we never send them to an address that did not buy from us.

The two optional questions: your consent, which you give by answering. You can leave either one blank, and nothing changes.

Noting which buy button you used, your type of device and whether you came back from Stripe's back link: our legitimate interest in knowing how the site is used, the same as counting visits. The Turnstile check on the sign-up form: our legitimate interest in keeping programs off it.

Counting, each day, the buy buttons used and the product pages opened: our legitimate interest in knowing how the site is used, the same as counting visits. Noting whether a reversed order was refunded or disputed: our legitimate interest in keeping our records right and answering a disputed payment.

You have the right to object to any of these at any time. A content blocker stops the counting and Google's script; for the identifiers and for Google's measurement, send the Global Privacy Control signal or write to us, as the section on cookies and tracking says.

Your email address is needed to buy: without it we cannot deliver the files. Everything else is your choice.

Automated decisions

We make no decisions about you by automated means. Stripe screens every payment for fraud automatically and can decline one it judges risky; that is Stripe's decision, under its own privacy policy.

Your rights

You can ask for a copy of the data we hold about you, in a common format you can take elsewhere. You can ask us to correct it, delete it or limit how we use it, and you can object to how we use it. That includes the check-in emails, the answers to the two questions and any review of yours we publish: write to us and we stop the emails, delete the answers and take the review down within 7 days, keeping only what tax rules require. Write to support@lunithlabs.com from the address the data is about, or tell us how we can check that it is you. We answer within one month, free of charge. We may keep what tax rules require us to keep, and we will tell you when that applies.

If you are unhappy with how we have handled your data, tell us first at the same address. We aim to reply within one business day, and we tell you what we have done about it.

You can also complain to a data protection authority: in the UK, the Information Commissioner's Office at ico.org.uk; in the European Union, the authority in the country where you live or work.

California's privacy law, the CCPA, applies only to businesses above size thresholds that we are below. Wherever you live, you have the rights on this page. We do not sell personal information, or share it for what those laws call cross-context behavioral advertising: Google's measurement on this site is set so that Google does not use it to personalise advertising, and a browser that sends Global Privacy Control is treated as having opted out.

Keeping it safe

The order book and the files are reached only through our own order service, which checks each request, and only the business can open them, through its Cloudflare account. The site is served over HTTPS only. We hold no card numbers: Stripe holds them, and Stripe is certified as a PCI Service Provider Level 1, the most stringent level of the card industry's security standard.

Massachusetts law (M.G.L. c. 93H) requires a business to tell affected residents, the Attorney General and the Director of Consumer Affairs and Business Regulation when certain personal information, such as a name together with a card or account number, is breached. We hold no card numbers, but if a breach of our records put you at risk, we would tell you without delay, and tell the authorities wherever the law requires it.

Children

The site is for adults running a business. We do not knowingly collect personal data from anyone under 16. If you think a child has given us their details, write to us and we will delete them.

Changes to this page

When this page changes, the date at the top changes with it. If a change affects how we use data we already hold, we will tell the people it affects by email before it applies.