bottle
Register interest
All policies

Privacy policy

This policy covers all three parts of Bottle: this website, the Bottle platform you sign in to, and the driver apps for iPhone and Android. It says what we hold, why we hold it, how long we keep it and what you can ask us to do about it.

The short version. Most of the personal data inside Bottle is not ours. It belongs to the gas distributor who put it there, and we only handle it because they asked us to. A smaller amount is ours to decide about, such as your account, your billing and anything you send us. The difference matters, so the next section explains it before anything else.

Who we are

Bottle is delivery software for bottled gas distributors in the United Kingdom. It is made and run by Sorteo Ltd, a company registered in England and Wales with company number 16426798, whose registered office is at 2nd Floor, 1 Church Square, Leighton Buzzard, Bedfordshire, LU7 1AE, United Kingdom. Sorteo Ltd trades as Bottle.

For anything about your data, email privacy@getbottle.app. A person reads it.

The two roles we play

Data protection law separates the organisation that decides what happens to personal data, called the controller, from the organisation that handles it on the controller's behalf, called the processor. Bottle is sometimes one and sometimes the other. Which one it is changes who you ask for things and who is answerable for them, so it is worth being exact about it.

Where we are the processor

Everything a gas distributor puts into Bottle to run their business belongs to that distributor. Their customers' names, addresses and phone numbers, their orders and invoices, their proof of delivery, their drivers' details and the position of their vans. The distributor decides why that data exists and what happens to it. We hold it and act on their instructions.

Being the processor covers more than storing what somebody typed. It also covers the work of running the service for them, all of it on their instructions and none of it for our own purposes: providing Bottle and keeping it running, investigating and fixing faults, looking into security alerts and acting on them, helping a business get set up and move their existing records in, changing a setting because they have asked us to, and the ordinary day-to-day administration of the service. We do that work because a business subscribes to Bottle and uses it, and for no other reason.

The honest question behind all of that is whether somebody at Bottle can look at your customers' addresses. The answer is that our staff see nothing inside a business's account unless an owner or an administrator at that business grants access, which can be read-only or allow changes, and which expires. There is one exception, for our most senior staff, where an account can be opened without a grant: it requires a written reason, and it is recorded. Whichever route is used, every single request made while inside an account is written to an audit log, with who made it, what they were looking at or changing and whether it was allowed or refused. We do not record the contents of what was seen.

We do not use anything inside a business's account to train models, to build a product of our own, or for any purpose that business has not asked for.

Where we are the controller

Some data is ours to decide about, and for that we are the controller and answerable for it directly. It covers the account holder's own name and email address, how you sign in, your subscription and what you pay us, the notices the service has to send you such as a password reset or a warning that a trial is ending, replies to anyone who contacts us, anything typed into the form on this website, and any marketing we send. Marketing is sent only with your consent and you can stop it at any time, and stopping it does not affect the notices the service itself has to send.

It also covers the records of our own conduct: who at Bottle was given access to an account, who approved it and why, and the log of what they did while they were in there. Those exist so that our behaviour can be checked, which means the decision about keeping them has to be ours rather than the customer's.

Deciding how to improve Bottle is our own decision rather than something a customer instructs us to do, so it belongs here rather than on the processor side. We do not measure how the product is used today, and if that changes this page will say so before it starts.

Where drivers stand

If you drive for a business that uses Bottle, your employer is the controller of your data, not us. Your name, your account, where the van was during your round, what time you finished each drop, the cash you handed in and your time off all belong to your employer. We hold them because your employer asked us to.

That means a request to see or delete your data goes to your employer first, because the decision is theirs to make and we are not allowed to make it for them. If you write to us instead we will not ignore you: we will tell you who to ask and, if you want us to, let your employer know you have been in touch. If you believe your employer is doing something with that data they should not be, you can complain to the Information Commissioner's Office about them, and that route does not depend on us at all.

What we hold, and why

These tables are grouped by who you are, so you can find the row that applies to you. Every row is complete on its own: what the data is, why it exists, who decides about it and how long it lasts, without needing the row above or below it.

If you use Bottle to run your business

We are the controller for everything in this table, which means we decide why we hold it, and the legal basis is given against each row.

Data we hold about you as an account holder, and what we do with it
What we hold Why we hold it Lawful basis How long we keep it
Your name and email address To give you an account, show your name to colleagues at your business, and send you what the software needs to send you, such as a password reset. Performing our contract with you. Closing your account blanks you in our own database: your name becomes "Closed account" and your email address is replaced with one that cannot receive mail. If you have paid us, that does not reach the record of what was paid. Those invoices are held by Stripe, who bill on our behalf, and they carry your name, email address and billing address. We have to keep records of what we were paid for six years from the end of the accounting period, so closing your account does not remove them.
How you sign in To let you in and keep other people out. This is a scrambled version of your password that cannot be turned back into it, your two-step sign-in secret and backup codes if you use them, and any API keys you create, also stored scrambled so a working key cannot be read out of our database by anyone, us included. Performing our contract with you, and our legitimate interest in keeping accounts secure. Your stored password, your two-step sign-in secret and backup codes, and any connected apps are removed when you close your account. API keys are treated differently on purpose: a key you revoke is kept as a record that it existed and who revoked it, so the history of who had access to what still makes sense. The key itself is stored scrambled and cannot be read back or used.
Your sign-in sessions So you stay signed in, and so you can see and end any session you do not recognise. Each one records the address your browser connected from and what browser it was. Performing our contract with you, and our legitimate interest in keeping accounts secure. Closing your account removes all of your sessions. While an account is open, a session stops working when it expires or when you sign out, but the expired record is not currently deleted, so the address you connected from and the browser you used stay until then. We are setting a period for this.
Your business and subscription To charge you for Bottle and know what your plan allows. This is your business name, company number and registered address, which for a sole trader is often a home address, along with your plan, trial dates, renewal date and any agreed discount and the reason it was given. Your billing details and card are held by Stripe, who bill you on our behalf, and card numbers never reach us. Performing our contract with you, and our legal obligation to keep tax records. Your business details and the state of your subscription stay in Bottle while the business exists, and go when the business is deleted. The record of what you actually paid is a different thing and it is not kept in Bottle: those invoices are held by Stripe with your name, email address and billing address on them. We have to keep records of what we were paid for six years from the end of the accounting period, so they outlive both a cancelled subscription and a closed account.
When you ask us for help To answer you, and to keep a record of it. Where you let our staff into your account to help, we record who asked, why, who approved it, what level of access was given and when it expires. Performing our contract with you, and our legitimate interest in being able to show who was allowed into an account and on whose authority. Kept for as long as the business exists. A request to come into an account, and the answer to it, is the evidence of who allowed what, and it is worth no less in three years than it is today.
What our staff did inside your account So that if you ask what we looked at, there is a truthful answer rather than a reassurance. Every request a member of our staff makes while working inside your account is recorded: who they are, what they were looking at or changing, and whether it was allowed or refused. We deliberately do not record the contents of what they saw. Our legitimate interest in holding our own staff to account, which we believe is plainly in your interest too. Kept permanently, on purpose. An audit trail that expires is not much of an audit trail.

If you are a customer of a business that uses Bottle

Your gas supplier is the controller for everything in this table and we are the processor, which means they decide why it is held and we act on their instructions. It is listed here so you can see exactly what the software holds about you.

Data your gas supplier holds about you inside Bottle
What is held What it is for Who decides How long it is kept
Who you are and how to reach you Taking your orders, delivering to you and invoicing you. This is your name or trading name, your legal name where it differs, your email address and phone number, whether you are a household or a business, your payment terms, and any notes your supplier has typed about you. Your gas supplier. We hold it on their instructions and do not use it for our own purposes. Your supplier sets this, between one and seven years after your last order, and it is seven unless they change it. They can also erase you at any time on request. Even then, your name and address stay on any invoice issued to you inside the last six years, because a VAT invoice has to show who it was issued to and tax law requires your supplier to keep it. Everything outside those invoices is removed.
Where you are, and how to get in So the driver can find you and leave the gas where you asked. This is your delivery address and postcode, the map coordinates worked out from that postcode, and where your supplier has placed one, a pin marking the exact spot the van should pull up, which is often more precise than the postcode. It also covers delivery notes, which in practice hold things like a gate code, which door to use and who to ask for, and where you have asked for cylinders to be left when you are out, whether they go to a safe place or to a named neighbour. Your gas supplier. We hold it on their instructions and do not use it for our own purposes. Your supplier's setting, up to seven years after your last order. If you ask to be erased, the address held for delivering to you is removed, but an address printed on an invoice issued inside the last six years stays on that invoice, because tax law requires your supplier to keep it as issued. Two things also survive an erasure today that we think should not: the map coordinates worked out from your postcode, and any pin somebody placed by hand. We are fixing that.
What you ordered and what you paid Fulfilling your order, invoicing you, chasing late payment and keeping the accounts straight. This is your orders and what was on them, your invoices including the name and address printed on them, what you paid and how, and anything still owed. Each order also carries a tracking reference, which is the key to the page showing where the van is. If you paid by card, those details were typed on Stripe's own pages and are held by Stripe, not by us. Your gas supplier. We hold it on their instructions and do not use it for our own purposes. Six years, because tax rules require it. An invoice inside six years keeps the name and address printed on it even if you ask to be erased, because a VAT invoice has to show who it was issued to. Older ones are deleted outright.
Proof that the gas arrived Settling whether a delivery actually happened, which otherwise comes down to one person's word against another's. If someone signed, the signature itself as an image and the name they wrote, which is often not the account holder but whoever was there. If cylinders were left without a signature, a photograph taken at the door showing where they were put, which can include the house and the street, and whatever the driver typed about it. Each proof has a private link so the customer can see their own photograph without signing in. Your gas supplier. We hold it on their instructions and do not use it for our own purposes. Two years, after which the signature or photograph, the name of whoever signed and the driver's note are destroyed, leaving only the fact that the delivery was proved. Asking to be erased destroys them straight away and stops the private link working. A proof also goes entirely when the order behind it is deleted at six years.
When a delivery did not happen So your supplier knows what happened and can try again or talk to you about it. This records that the drop failed, the reason chosen from a short list that includes nobody being in and the delivery being refused, any note the driver typed in their own words, and the date and time. Your gas supplier. We hold it on their instructions and do not use it for our own purposes. Two years, after which the position of the door and the driver's note are removed, leaving the fact that the drop failed and the reason. Asking to be erased removes them straight away.

If you drive for a business that uses Bottle

Your employer is the controller for everything in this table and we are the processor, which means they decide why it is held and we act on their instructions. This is the fullest list we can give you, because you have the most at stake in it and the least say over it.

Data your employer holds about you inside Bottle
What is held What it is for Who decides How long it is kept
Where the van is Telling the office and the waiting customer when to expect the van. While a round is out the app reports the van's position every few minutes, and each report replaces the one before it, so there is never a trail of where the van has been, only where it is now. Your employer's office staff see that position next to your name. Customers waiting for a delivery see a van on a map and are never shown who is driving it. Your employer. We hold it on their instructions and do not use it for our own purposes. Shown on maps for twenty minutes, then hidden. The last reported position stays on the record of that round afterwards and is not currently deleted. We are setting a period for this.
How your day went Planning rounds, telling customers when to expect a delivery, and working out how long a round really takes. This is the round you were given, the van you took, when it was issued, when you confirmed the load and when you set off, and for every drop its location and the exact minute you completed or failed it. Where the software planned a route, the line it drew along the roads is kept too. Taken together this is a record of where you were and when, to the minute, for every day you have worked with Bottle. Your employer. We hold it on their instructions and do not use it for our own purposes. Two years. After that the line drawn along the roads, where the van last was, and the position of each door you called at are all removed, leaving the round itself as your employer's record of the day. This is the most detailed thing Bottle holds about you, which is why it has the shorter clock rather than the six years the money needs.
Money you handled Knowing how much cash is in which van and settling it when it comes back to the yard. This is each amount you took, whose door you took it at and when, then the amount you handed in, who counted it and whether they agreed with your figure. Where they did not agree, the disagreement is recorded with whatever either of you typed about it, naming both of you. Your employer. We hold it on their instructions and do not use it for our own purposes. Six years, including any disagreement. These are part of your employer's accounting records, which tax law requires them to keep for that long, so a shorter period is not open to them. Money nobody has counted in yet is left alone whatever its age, because it is still owed.
Your time off, including sickness Running the rota, knowing who is available and tracking allowances. Each period of time off is recorded as holiday, sickness or other, with dates down to the half day, who asked, who approved or refused it and when. Each request has a free-text note, so whatever your employer types there is held too. Your holiday allowance and paid sick day allowance are held against your name, and the rota shows how many sick days you have taken this year. Recording that a named person was off sick is health information, which the law treats more carefully than ordinary personal data: your employer relies on the exemption that allows this for managing staff. Inside your employer's business, the people who run the rota, meaning owners and administrators, can see that a day off was sickness rather than holiday. Other drivers cannot: the software shows you your own month and nobody else's. Your employer. We hold it on their instructions and do not use it for our own purposes. Kept for as long as you work for the business, because an allowance and what has been taken from it only make sense together, and because your employer may need to show what leave was given. Ask your employer, who decides this, if you want it removed sooner.
Your phone and your account Signing you in, letting the office know who is driving, and getting notifications about your round to your handset. This is your name, email address and role at the business, and for the driver app the code Apple or Google gives us to reach your handset, which platform and app version you are on, and when the app was last used. Your employer decides your account and role. The code identifying your handset is removed by us when you sign out. The code for your handset is removed when you sign out, or when Apple or Google tell us the handset has gone. If an account is closed, its handset codes are not currently removed, which we are fixing.
Your home address, where a round starts or ends there Planning a round that begins or finishes somewhere other than the yard. Where you take the van home, the address is saved as a place a round can start or end, with its postcode and map coordinates, the same as any other location. Your employer. We hold it on their instructions and do not use it for our own purposes. Until your employer removes that location. It is not deleted automatically.

If you have only visited this website

We are the controller for everything in this table, and it is much smaller than the rest of the page.

Data we hold about visitors to this website
What we hold Why we hold it Lawful basis How long we keep it
The register-interest form To contact you about Bottle: early access, launch news and the occasional question about what we should build. We do not sell, rent or pass your details to anyone else for their own marketing. This is your name, business name and email address, your phone number if you give it, how many vans you run and what you use today if you tell us, anything typed into the box asking what takes up most of your time, and where you came from if your browser says, such as a referring site or campaign tag. Your consent, given by sending the form. You can withdraw it at any time by emailing us and we will delete your record. Until Bottle launches and you either become a customer or tell us you are not interested, or twenty-four months from when you sent the form, whichever comes first.
A scramble of your address, to spot duplicates To notice the same form being sent repeatedly or automatically. We keep a one-way scramble of the address your browser connected from, which cannot be turned back into the address, together with your browser's own description of itself. We do not store the address itself. Our legitimate interest in keeping the form usable and free of automated submissions. Alongside the form submission it belongs to, and deleted with it.
Cookies on this website None. This website sets no cookies at all, runs no analytics, records no sessions and carries no advertising or chat widget. The typefaces are served from this website rather than from another company, so reading these pages tells nobody else that you were here. Not applicable, because nothing is stored on your device. Not applicable, because nothing is stored on your device.
Cookies in the Bottle platform A cookie that keeps you signed in, which is what makes signing in work at all, and a small one remembering whether you chose the light or dark appearance. There are no advertising or analytics cookies. When a map is on screen, your browser fetches the map tiles from OpenFreeMap, who see the address your browser is connecting from and roughly which part of the country is displayed, and nothing else about you. Strictly necessary for a service you asked for, in the case of the sign-in cookie. Your choice, in the case of the appearance cookie. The sign-in cookie lasts until it expires or you sign out. The appearance cookie stays on your device until you clear it.

Notifications sent to phones

When Bottle sends a notification to a phone, it travels through Apple's or Google's notification service, because that is the only way to reach a handset. Those notifications can contain a customer's name, an order or invoice reference and an amount, together with staff names and short notes typed by people at the business. They never contain a customer's address, phone number or email address, and never any payment details. Customers of a gas distributor never receive notifications from Bottle on their phones at all: notifications go only to people who work at the business and have signed in.

How long we keep things

This section says what happens today, not what we would like to happen. Where something is kept until an event rather than for a set time, it says which event.

Fixed periods

Things we keep until something happens rather than for a set time

These have no clock, and each one has a reason.

Closing your account

You can close your own account from your settings, and you have to enter your password first. Closing it removes your sessions, your stored password, your two-step sign-in secret and backup codes, any connected apps, and your membership of every business. Your name becomes "Closed account" and your email address is replaced with one that cannot receive mail.

If you paid us for Bottle, closing your account does not remove the record of what you paid. We have to keep records of money we were paid for six years from the end of the accounting period, which in practice means up to seven years, and we cannot waive that because it is a duty to HMRC rather than a preference of ours. Those invoices are held by Stripe, who bill on our behalf, and they carry the name, email address and billing address given at the time.

The account record itself stays, so that things other people did still make sense: an invitation you sent still shows who sent it, and a round you drove still shows it was driven. If you are the last owner of a business, we will not let you close your account until somebody else owns it, because otherwise the business would be left with nobody able to get in.

Retention settings, and what erasing actually does

This section is for two different readers. If you run a gas business on Bottle, it is the part your own customers will ask you about, so it is written so you can answer them. If you are one of those customers, it explains what your supplier controls and what they do not.

What the business controls

Each business using Bottle sets its own rule for how long a customer who has stopped ordering is kept. There are three settings.

Which date the clock runs from

The clock runs from the customer's last order. Where a customer record exists but has never had an order against it, the clock runs from the day the record was created instead. An account somebody opened and never used is still somebody's name, address and phone number, and leaving it out of the sweep would mean it stayed for ever.

Freezing a record

Any customer record can be put on legal hold, which freezes it against both the automatic sweep and the manual erase button. It still appears on the list of records that are due, marked as held, so it is not forgotten. This is what you would use during a dispute, an insurance claim or an investigation, where deleting the record would destroy something you may be required to produce.

An honest word about the default

The settings for a business are created the first time somebody opens the retention page. A business that has never looked at it is therefore running on seven years and thirty days' notice. That is a deliberate choice of default rather than an accident, but we are not going to describe it as a decision the business made, because they have not made it yet.

What erasing a customer actually does

A business can erase a customer at any time, either because the retention sweep has reached them or because the customer has asked. This is what happens.

Who else sees it

We use a small number of other companies to run Bottle: to bill you, to send email, to deliver notifications to phones, to look up postcodes and to host the software. Every one of them is named on our third parties page, along with what reaches them and which country they are in. If a company is not on that page, it does not handle your data.

If we ever take on a new company that will handle personal data on your behalf, we will tell customers at least thirty days beforehand, so there is time to object or to leave.

We do not sell personal data, and we do not share it for anyone else's marketing. We would disclose data if the law required it of us, for example under a court order, and we would tell the affected customer unless we were forbidden from doing so.

Where it is held

The Bottle platform, including its database, runs on a server in Germany or Finland. Our hosting provider does not offer a United Kingdom location. Moving personal data to the European Economic Area is permitted under United Kingdom data protection law, and we would rather tell you where the data actually sits than leave you to work it out.

This website and the register-interest form behind it run on Cloudflare's network. We have not pinned that database to a particular country, so we cannot yet tell you which one it is in. We are finding out and this page will say so once we know.

Some of the companies we use process data outside the United Kingdom under their own terms, and the third parties page says which.

Your rights

Under United Kingdom data protection law you can ask for a copy of the personal data held about you, ask for it to be corrected, ask for it to be deleted, ask for the handling of it to be restricted, object to it being handled, and ask for it in a portable form. Where we rely on your consent, you can withdraw it at any time.

Who to ask

Getting a copy

A business using Bottle can export a customer's record from inside the software, and you can export your own account data from your settings.

The customer export holds their record, their addresses, their agreed prices and every order with its lines, along with their invoices, each delivery stop and what happened there, what was signed for at the door, cash taken at it, and the messages sent to them. The account export holds the person, the businesses they belong to, their sessions and connected apps, their registered phones, their time off, cash they carried and what the bell has told them.

Two things are deliberately left out of a file, and neither is being withheld. A signature or a doorstep photograph is given as a link rather than pasted into the file, because an image inside a page of data helps nobody, and the link fetches the real thing. A phone's notification token and a password are not in there either: those are locks rather than contents, and handing them over would help somebody else more than the person asking.

Complaining

If you are unhappy with how your data has been handled, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the United Kingdom's data protection regulator, and you do not have to come to us first. If your complaint is about a gas distributor rather than about us, the Information Commissioner's Office is still the right place, and your complaint is against them.

Children

Bottle is software for running a gas delivery business. It is not designed for children, not marketed to them, and we do not knowingly hold data about them. If you believe we hold a child's data, email privacy@getbottle.app and we will look into it.

Changes to this policy

We will keep this page current rather than writing it once and leaving it. When something changes that affects what we hold, why we hold it or how long we keep it, we will change this page and update the date at the bottom. Where the change is significant, such as taking on a new company that handles personal data, we will tell customers directly rather than relying on you to notice.

Sorteo Ltd, trading as Bottle. Registered in England and Wales, company number 16426798.

Registered office: 2nd Floor, 1 Church Square, Leighton Buzzard, Bedfordshire, LU7 1AE, United Kingdom.

Last updated 28 September 2026.