Terms & Conditions (VERY IMPORTANT THING)
Welcome To Bobcat In A Box Terms Of Service & Privacy Policy
Bobcat In A Box LLC
Privacy Policy & Terms of Service
Applies to all Bobcat In A Box LLC properties
Last Updated: March 31, 2026
| Scope of this document | This Privacy Policy and Terms of Service covers all websites and services operated by Bobcat In A Box LLC, including: • Bobcat In A Box / Shopping Robot — join3600.com / bobcatinabox.com • Video Beehive newsletter — videobeehive.com • Newsletter Traffic Network — newslettertrafficnetwork.com If something is unclear, email alexander@bobcatinabox.com and we’ll explain it. |
1. Who We Are
Bobcat In A Box LLC is the data controller for all personal data described in this document.
Registered address: 26 Josephine Ave, Somerville, MA 02144, USA
Data Protection Officer: Alexander Zebrose — alexander@bobcatinabox.com | +1 617 642 1130
2. Shopping Robot (bobcatinabox.com)
The Shopping Robot is a subscription service that buys surprise packages on your behalf. You describe what you want through a chat-style interface powered by the Anthropic Claude API, and we source and ship products to your door.
2.1 Data We Collect
| Data Collected | Purpose | Legal Basis (GDPR) | Third-Party Processors |
| Name & shipping address | Placing orders with retailers on your behalf | Contractual Necessity (Art. 6.1.b) | Amazon, Etsy, Walmart, Poshmark |
| Chat messages & shopping preferences | Understanding your preferences to select appropriate products via AI | Contractual Necessity (Art. 6.1.b) | Anthropic Claude API (anonymised — see §2.3) |
| Account & order data | Subscription management, order history & status | Contractual Necessity (Art. 6.1.b) | Supabase (Postgres) |
| Payment data (card details) | Processing subscription payments | Contractual Necessity (Art. 6.1.b) | PayWhirl (PCI-compliant; we never see raw card data) |
| Email address (opt-in only) | Marketing newsletter & service communications | Consent (Art. 6.1.a) | Kit, ListMonk (self-hosted on Railway) |
| Anonymised site fingerprint (IP + User Agent, daily-rotating hash) | Audience measurement & site performance | Legitimate Interest (Art. 6.1.f) | PostHog (cookieless mode) |
2.2 Payment
We accept Visa, Mastercard, Discover, and Amex through PayWhirl, a US-based PCI-compliant payment processor. PayWhirl stores all card details on their end — Bobcat In A Box LLC never sees or stores your raw payment information.
2.3 AI Chat Interface & Data Minimisation
Your shopping requests are processed by the Anthropic Claude API to help us understand your preferences and select better products. Before any data is sent to the API:
- Your account is referenced by an internal bot_id only — your name and shipping address are never sent to Anthropic.
- Chat content is anonymised to the extent possible before API transmission.
- We practice data minimisation: only the information needed to fulfil your order is passed to any third party.
2.4 Who We Share Your Data With
Retailers (Amazon, Etsy, Walmart, Poshmark): Your name and shipping address are shared with the relevant marketplace when we place an order on your behalf. These are large marketplaces with many individual sellers, so your address reaches the specific merchant fulfilling your order.
Anthropic API: Anonymised shopping preferences only (no name or address). Used solely to power the chat interface.
Make.com: Workflow automation connecting parts of the order pipeline. Data is anonymised where possible.
Aggregate & anonymised data: We may publish non-identifiable statistics (e.g. most popular product categories, aggregate feedback trends) to share insights about the service. No individual is identifiable.
2.5 Cookies & Analytics
We use only essential cookies on bobcatinabox.com (session cookies to keep you logged in). No advertising or third-party tracking cookies are set.
For analytics we use PostHog in cookieless mode. PostHog generates a daily-rotating anonymised fingerprint from your IP address and browser User Agent. This resets every 24 hours and cannot be used to track you across sessions or sites. Nothing is stored on your device.
2.6 Subscription Terms
Cancellation
You can cancel at any time, for any reason. Email cancel@bobcatinabox.com. Cancellation is effective once you receive email confirmation, which we send within 24 hours.
Refunds
Email alexander@bobcatinabox.com for a 100% refund on any payment made within the last 30 days. We respond to all refund requests within 24 hours.
Packages
Packages are offered as-is. The quantity, quality, and type of items depend on your chat preferences and marketplace availability. Some items may be unexpected — that is part of the surprise format. We cannot guarantee a minimum number of items and are not liable for postal or courier errors, though we will always try to help resolve issues.
If you provide an incorrect address, we cannot recover packages sent there, but will update your address for future orders on request.
Pranks & Gifts
If you sign up another person, you must inform them. If you sign up a minor, you must first obtain parental consent. Please do not sign up children under 5 years old.
How It Works
Bobcat In A Box uses a combination of automated systems and human oversight — in the tradition of the mechanical turk. Some buying and fulfilment steps are automated; others are performed by humans working in a systematised way.
3. Video Beehive (videobeehive.com)
Video Beehive is a free email newsletter for video creators. It is supported by third-party sponsored content.
3.1 Data We Collect
| Data Collected | Purpose | Legal Basis (GDPR) | Third-Party Processors |
| Email address & name (optional) | Delivering newsletter content and integrated advertisements | Consent — explicit opt-in at signup (Art. 6.1.a) | Kit, ListMonk (self-hosted on Railway) |
| Click data via tracking links | Measuring ad performance on behalf of sponsors | Legitimate Interest (Art. 6.1.f) | Newsletter Traffic Network redirect server (Railway) |
3.2 How We Use Your Data
- Your email address is used solely to deliver the newsletter and, where applicable, to notify you of relevant opportunities.
- You subscribe by entering your email address on the Video Beehive signup page. We do not add people to this list without their explicit consent.
- Every email contains a one-click unsubscribe link. You can also unsubscribe by emailing alexander@bobcatinabox.com.
- Ads in the newsletter are clearly labelled as sponsored content. They use tracking links to measure click performance.
3.3 Automated Content Pipeline
Video Beehive content is generated using an automated pipeline: RSS feeds are processed by an LLM, which drafts content in the newsletter’s brand voice. Content is delivered via ListMonk (self-hosted). Ad slots are filled automatically at send time using the Newsletter Traffic Network infrastructure described in Section 4.
3.4 Cookies & Analytics
No cookies are set on videobeehive.com. Email click and open tracking uses standard newsletter tracking pixels (1×1 pixel image) to measure engagement. You can disable image loading in your email client to opt out of open tracking.
4. Newsletter Traffic Network (newslettertrafficnetwork.com)
Newsletter Traffic Network (NTN) is a performance-based CPC (cost-per-click) advertising network. It connects newsletter publishers who have unsold ad inventory with affiliate advertisers. NTN operates as a B2B service; its primary data subjects are newsletter publishers and the B2B contacts used for advertiser outreach.
4.1 Advertiser Discovery & Lead Generation
| Data Collected | Purpose | Legal Basis (GDPR) | Third-Party Processors |
| Company names, ad copy, ad placement data | Identifying active advertisers in the newsletter ecosystem to inform B2B outreach | Legitimate Interest (Art. 6.1.f) — publicly visible commercial activity | Apify (web scraping), Apollo, Hunter.io, Snov.io |
| Professional contact info (name, job title, B2B email, LinkedIn URL) | Targeted B2B outreach to potential advertising partners | Legitimate Interest (Art. 6.1.f) — professional context only | Apollo, Hunter.io, Snov.io, Instantly.ai |
A 12-month data refresh policy is maintained: records are reviewed and updated or deleted within 12 months to ensure accuracy. Recipients of outreach emails can opt out at any time by replying “unsubscribe” or emailing alexander@bobcatinabox.com, after which their domain/email is blacklisted in all outreach tools.
4.2 Publisher Hub & Click Tracking
| Data Collected | Purpose | Legal Basis (GDPR) | Third-Party Processors |
| Publisher name, email & contact details | Onboarding newsletter publishers; contract execution via DocuSeal | Contractual Necessity (Art. 6.1.b) | DocuSeal, Railway |
| IP address & browser User Agent (of newsletter readers clicking ads) | Bot detection & fraud prevention; rapid redirect to advertiser destination | Legitimate Interest (Art. 6.1.f) | Railway (server logs, short retention) |
| Privacy guardrail | IP addresses collected via the NTN redirect server are used solely for traffic validation (bot/fraud detection) and are not used for user profiling, retargeting, or shared with any marketing platform. Redirect speed is typically under 200ms. |
4.3 Publisher Agreement
Publishers joining NTN sign a formal Publisher Agreement (via DocuSeal) covering click definitions, invalid traffic, payment terms (Net-30), and data responsibilities. Publishers are responsible for ensuring their subscriber lists were collected with appropriate consent before running NTN campaigns.
4.4 Elite Entrepreneurs Media (EEM)
Bobcat In A Box LLC occasionally sells advertising on a commission basis in newsletters owned and operated by Elite Entrepreneurs Media (Liam Gill, Canadian national). In this capacity, Bobcat In A Box LLC acts as an advertising broker only:
- We do not have access to the EEM subscriber list.
- We do not process EEM subscriber data.
- EEM’s owner is solely responsible for all privacy and compliance obligations relating to their newsletters.
5. Cookies Across All Properties
| Property | Cookies Used | Details |
| bobcatinabox.com / join3600.com | Essential only | Session cookies for login. PostHog cookieless analytics (daily-rotating fingerprint, nothing stored on device). |
| videobeehive.com | None | No cookies set on the website. Email open tracking via standard 1×1 pixel. |
| newslettertrafficnetwork.com | Essential only | Session cookies for the Publisher Hub login portal. |
No advertising cookies, cross-site tracking cookies, or third-party marketing pixels are in use across any of our properties.
6. Consolidated Data Processing Summary
The table below provides a complete overview of all data processing activities across Bobcat In A Box LLC.
| Business Unit | Data Subject | Data Category | Purpose | Third-Party Processors | Legal Basis (GDPR) |
| Shopping Robot | Customers | Name, shipping address | Order fulfilment | Amazon, Etsy, Walmart, Poshmark | Contractual Necessity |
| Shopping Robot | Customers | Chat messages & preferences | AI-powered product selection (anonymised via bot_id) | Anthropic API, Make.com | Contractual Necessity |
| Shopping Robot | Customers | Account & order data | Subscription & order management | Supabase (Postgres) | Contractual Necessity |
| Shopping Robot | Customers | Payment data | Payment processing | PayWhirl (PCI-compliant) | Contractual Necessity |
| Shopping Robot | All visitors | Anonymised fingerprint | Audience measurement | PostHog (cookieless) | Legitimate Interest |
| Video Beehive | Subscribers | Email address, name (optional) | Newsletter delivery & ad integration | Kit, ListMonk, Railway | Consent |
| Video Beehive | Newsletter readers | Click data via tracking links | Ad performance measurement | NTN redirect server | Legitimate Interest |
| NTN | Publishers | Name, email, contact details | Publisher onboarding & contracts | DocuSeal, Railway | Contractual Necessity |
| NTN | Newsletter readers | IP address, User Agent | Bot detection, redirect | Railway (logs) | Legitimate Interest |
| NTN Leadgen DB | B2B contacts | Name, job title, B2B email, LinkedIn | Advertiser outreach | Apollo, Hunter.io, Snov.io, Instantly.ai | Legitimate Interest |
7. Your Rights
Regardless of which Bobcat In A Box LLC service you use, you have the following rights regarding your personal data. To exercise any of them, email alexander@bobcatinabox.com. We confirm receipt within 24 hours and comply within 30 days.
| Right | What it means |
| Access | Request a full copy of the personal data we hold about you across any or all of our services. |
| Erasure | Request deletion of all your personal data. Upon request, data will be purged from Supabase, all newsletter ESPs (Kit, ListMonk), and any outreach tools within 30 days. |
| Rectification | Ask us to correct inaccurate or incomplete data. |
| Portability | Receive your data in a structured, commonly used, machine-readable format. |
| Object | Object to processing based on Legitimate Interest. We will cease unless we can demonstrate compelling legitimate grounds that override your interests. |
| Withdraw consent | Unsubscribe from marketing or newsletter emails at any time via the one-click unsubscribe link in any email, or by emailing alexander@bobcatinabox.com. Withdrawal of consent does not affect the lawfulness of prior processing. |
| Do Not Contact | B2B outreach recipients can opt out at any time. Reply “unsubscribe” to any outreach email, or email alexander@bobcatinabox.com. Your domain/email will be blacklisted from all outreach tools immediately. |
| Regulator | If you believe your data has been mishandled, you have the right to lodge a complaint with your local data protection authority. EU/EEA residents may contact the CNIL (France) at www.cnil.fr or the authority in their country of residence. |
8. Security & Breach Notification
Personal data is stored securely in Supabase (Postgres). We maintain Data Processing Agreements (DPAs) with all third-party processors listed in this document.
In the event of a data breach that affects your personal data, we will notify you within 72 hours of becoming aware of the issue, in line with GDPR Article 33.
9. Data Retention
| Data Category | Retention Period | Notes |
| Shopping Robot account & order data | Duration of subscription + reasonable dispute resolution period | Deleted on request within 30 days. |
| Chat / preference data | Duration of subscription | Anonymised (bot_id) before any external transmission. |
| Newsletter subscriber email | Until unsubscribe | Deleted from all ESPs within 30 days of request. |
| B2B outreach contact data | 12 months from collection | Reviewed and refreshed or deleted at 12-month intervals. |
| Publisher Hub data | Duration of publisher agreement + reasonable period thereafter | Deleted on request within 30 days. |
| NTN redirect server logs (IP / UA) | Short-term (fraud detection only) | Not retained for profiling or marketing purposes. |
| PostHog analytics fingerprint | Daily rotation — resets every 24 hours | No persistent data stored on user devices. |
10. Changes to This Policy
We may update this document from time to time. When we make material changes, we will update the “Last Updated” date at the top of this document and, where appropriate, notify active subscribers by email. Continued use of our services after the effective date constitutes acceptance of the updated policy.
Bobcat In A Box LLC • 26 Josephine Ave, Somerville MA 02144, USA • alexander@bobcatinabox.com
Last Updated: March 31, 2026