Privacy policy

This policy covers all three parts of Bottle: this website, the Bottle platform you sign in to, and the driver apps for iPhone and Android. It says what we hold, why we hold it, how long we keep it and what you can ask us to do about it.

Who we are

Bottle is delivery software for gas and fuel distributors in the United Kingdom. It is made and run by Sorteo Ltd, a company registered in England and Wales with company number 16426798, whose registered office is at 2nd Floor, 1 Church Square, Leighton Buzzard, Bedfordshire, LU7 1AE, United Kingdom. Sorteo Ltd trades as Bottle.

For anything about your data, email compliance@getbottle.app. A person reads it.

Sorteo Ltd is registered with the Information Commissioner's Office, the United Kingdom's data protection regulator. Our registration number is ZC296441. You can check our entry on the register.

The two roles we play

Data protection law separates the organisation that decides what happens to personal data, called the controller, from the organisation that handles it on the controller's behalf, called the processor. Bottle is sometimes one and sometimes the other. Which one it is changes who you ask for things and who is answerable for them, so it is worth being exact about it.

Where we are the processor

Everything a distributor puts into Bottle to run their business belongs to that distributor. Their customers' names, addresses and phone numbers, their orders and invoices, their proof of delivery, their drivers' details and the position of their vans. The distributor decides why that data exists and what happens to it. We hold it and act on their instructions.

Being the processor covers more than storing what somebody typed. It also covers the work of running the service for them, all of it on their instructions and none of it for our own purposes: providing Bottle and keeping it running, investigating and fixing faults, looking into security alerts and acting on them, helping a business get set up and move their existing records in, changing a setting because they have asked us to, and the ordinary day-to-day administration of the service. We do that work because a business subscribes to Bottle and uses it, and for no other reason.

The honest question behind all of that is whether somebody at Bottle can look at your customers' addresses. The answer is that our staff see nothing inside a business's account unless an owner or an administrator at that business grants access, which can be read-only or allow changes, and which expires. There is one exception, for our most senior staff, where an account can be opened without a grant: it requires a written reason, and it is recorded. Whichever route is used, every single request made while inside an account is written to an audit log, with who made it, what they were looking at or changing and whether it was allowed or refused. We do not record the contents of what was seen.

We do not use anything inside a business's account to train models, to build a product of our own, or for any purpose that business has not asked for.

Where we are the controller

Some data is ours to decide about, and for that we are the controller and answerable for it directly. It covers the account holder's own name and email address, how you sign in, your subscription and what you pay us, the notices the service has to send you such as a password reset or a warning that a trial is ending, replies to anyone who contacts us, anything typed into the form on this website, and any marketing we send. Marketing is sent only with your consent and you can stop it at any time, and stopping it does not affect the notices the service itself has to send.

It also covers the records of our own conduct: who at Bottle was given access to an account, who approved it and why, and the log of what they did while they were in there. Those exist so that our behaviour can be checked, which means the decision about keeping them has to be ours rather than the customer's.

Deciding how to improve Bottle is our own decision rather than something a customer instructs us to do, so it belongs here rather than on the processor side. We record which pages people signed in to the office side of Bottle use, against their name and email, as described under How the office uses Bottle, and we use it only for that.

Where drivers stand

If you drive for a business that uses Bottle, your employer is the controller of your data, not us. Your name, your account, where the van was during your round, what time you finished each drop, the cash you handed in and your time off all belong to your employer. We hold them because your employer asked us to.

That means a request to see or delete your data goes to your employer first, because the decision is theirs to make and we are not allowed to make it for them. If you write to us instead we will not ignore you: we will tell you who to ask and, if you want us to, let your employer know you have been in touch. If you believe your employer is doing something with that data they should not be, you can complain to the Information Commissioner's Office about them, and that route does not depend on us at all.

What we hold, and why

These tables are grouped by who you are, so you can find the row that applies to you. Every row is complete on its own: what the data is, why it exists, who decides about it and how long it lasts, without needing the row above or below it.

If you use Bottle to run your business

We are the controller for everything in this table, which means we decide why we hold it, and the legal basis is given against each row.

If you are a customer of a business that uses Bottle

Your supplier is the controller for everything in this table and we are the processor, which means they decide why it is held and we act on their instructions. It is listed here so you can see exactly what the software holds about you.

If you message a business on WhatsApp

A business can connect its WhatsApp Business number to Bottle. Bottle then reads the messages sent to that number, writes them up as orders, replies from the business's number and answers questions about your account. The business is the controller for everything in this table and we are the processor. This covers anybody who messages the number, whether or not they are already a customer of the business.

Your messages reach Bottle through Meta's WhatsApp service, and Bottle's replies go back the same way. What WhatsApp itself does with them is covered by WhatsApp's own privacy policy. To read your messages and write replies, Bottle sends them to Anthropic, as described under Optional AI features.

Getting your messages deleted. Ask the business you messaged. They can delete your messages in Bottle straight away. If you would rather, email compliance@getbottle.app with the number you wrote from and the business you messaged, and we will pass your request to them. This does not delete the messages on your phone or on the business's phone.

What the business connects. To connect its number, an owner signs in to Meta in a Meta window. Bottle keeps the business's WhatsApp number, the business name Meta has verified, Meta's references for the number and its account, and the access Meta gives Bottle to send from the number, encrypted. These are deleted when the business disconnects WhatsApp.

If you work for one of their suppliers

A business that uses Bottle can keep a list of the people it deals with at its own suppliers. That business is the controller for these details and we are the processor.

If you drive for a business that uses Bottle

Your employer is the controller for everything in this table and we are the processor, which means they decide why it is held and we act on their instructions. This is the fullest list we can give you, because you have the most at stake in it and the least say over it.

If you have only visited this website

We are the controller for everything in this table, and it is much smaller than the rest of the page.

Notifications sent to phones

When Bottle sends a notification to a phone, it travels through Apple's or Google's notification service, because that is the only way to reach a handset. Those notifications can contain a customer's name, an order or invoice reference and an amount, together with staff names and short notes typed by people at the business. They never contain a customer's address, phone number or email address, and never any payment details. Customers of a distributor never receive notifications from Bottle on their phones at all: notifications go only to people who work at the business and have signed in.

How long we keep things

This section says what happens today, not what we would like to happen. Where something is kept until an event rather than for a set time, it says which event.

Fixed periods

• Emails we sent on your behalf. The full text of every email the software sends, including invoices, is kept for one year and then deleted, so the office can answer whether a customer was actually emailed and what it said.
• Addresses that cannot receive our email. If an email the software sends is refused for good by the receiving server, or the person who gets it marks it as spam, the address goes on a list of addresses not to write to, with the reason and the date. It is kept for as long as Bottle runs, because its whole job is to stop the same address being emailed again. No name or other personal details are kept with it.
• Repeat-request records. When the software guards against the same request being sent twice, it keeps the response for seven days and then deletes it.
• Questions Bottle asks. Where a business has turned on Bottle learning how it plans, a question Bottle asks the owner, and the answer, is kept for one year and then deleted. Answers are fixed choices, such as yes or no.
• Chats with Rosie on this website. Two years after the last message, then deleted.
• WhatsApp messages. 90 days, then deleted.
• Register-interest submissions. Until Bottle launches and you either become a customer or tell us you are not interested, or twenty-four months from when you sent the form, whichever comes first.
• Invoices and orders. Six years, because that is what the tax rules require.
• Proof of delivery. Two years, after which the signature or photograph, the name of whoever signed and the driver's note are destroyed. What is left is the fact that the delivery was proved.
• Round history. Two years, after which the route line, the last reported van position and the position of each drop are removed. The round itself stays as the business's record of the day. Closing an account takes that account off its rounds.
• Changes to rounds. Two years from each change, then deleted. This is the record of who changed a round and what happened at each stop. It points to whoever made the change, including office staff and any member of our staff working inside the account. It stays if the round itself is deleted. It holds no name, note or address, so erasing a customer does not alter it. Closing an account takes that account off these records.
• Copies of rounds, and why orders were left waiting. Two years from when each was saved, then deleted. A copy shows a round as the software proposed it, as it was issued and as it really went. It names the driver by their account, and holds no name, note, address or map position, so erasing a customer does not alter it. Closing an account takes that account off these copies.
• Arrival and leaving times at stops. Two years from the arrival, then deleted. They are worked out from the location the app shares while a round is out. They name the driver by their account, and hold times, how close the van was, and whether the stop's location is exact or only known by its postcode, and never a position. Closing an account takes that account off these times.
• A driver's time per delivery. Worked out again each night from the arrival and leaving times still held. It stays until none of those times are left, or ninety days if it stops being worked out, and is deleted when the driver closes their account. Their stops still count towards the business's own figure, which names nobody.
• A customer's usual driver. Worked out again each night from the last twelve months of deliveries on finished rounds, so that the business's round planning can give a customer the driver they know. It names the driver by their account and holds how many days they delivered. It stays until those deliveries no longer count, or ninety days if it stops being worked out. It is deleted when the driver closes their account or the customer is erased. Bottle then stops working it out for that driver or that customer.
• A driver's usual order of customers. Worked out again each night from the last twelve months of finished rounds, from when each stop was finished, so that the business's round planning can arrange a driver's stops in the order they usually do them. For each business the driver works for, it names the driver by their account and holds which customers they usually serve in that order, and on how many days. It stays until those stops no longer count, or ninety days if it stops being worked out. It is deleted when the driver closes their account, and a customer comes out of it when they are erased. Bottle then stops working it out for that driver and leaves that customer out.
• A driver's usual door sales. Worked out again each night from the last three months of finished rounds, so that the business's round planning can keep room on a driver's round for the sales they usually make. For each business the driver works for, it names the driver by their account and holds how many sales they usually make on a round, how many cylinders of each kind, how long a sale takes, and how many rounds that came from. It names no customer. It stays until those rounds no longer count, or ninety days if it stops being worked out. It is deleted when the driver closes their account, and Bottle then stops working it out for them. A round also keeps the room planned for it, with no name of its own, for as long as the round is kept.
• What Bottle learns about a business. Kept while it is still useful. Once Bottle stops using something it learned, it is deleted after one year, along with where it came from. Where something it still uses came from is deleted after two years, and the record of which plans used it after one year. If the owner marks something as wrong, Bottle keeps it so that it is not learned again, until the owner undoes that or the customer or person is erased. A year after that, only the thing itself is left, without where it came from or which plans used it.
• Notifications inside the software. Ninety days, then deleted. They quote customer names and round details, and nobody reads a three-month-old notice.
• Expired sessions. Thirty days after the session expires, then deleted, along with the address you signed in from and the browser you used. A session still in use is left alone however old it is, because ending it would be a sign-out you did not ask for.
• Cash records. Six years, following the tax rules, including any disagreement about a handover. Money nobody has counted in yet is left alone whatever its age, because it is still owed.

Things we keep until something happens rather than for a set time

These have no clock, and each one has a reason.

• Time off, including sickness, for as long as somebody works for the business. An allowance and what has been taken from it only make sense together.
• Invitations, and API keys that have been revoked, so the history of who was invited and who revoked what still makes sense.
• Requests from our staff to come into an account, and the answers to them, for as long as the business exists. They are the evidence of who allowed what.
• The log of what our own staff did inside an account, kept permanently on purpose, because an audit trail that expires is not much of an audit trail.
• The record that an erasure happened, kept permanently and deliberately without the name of the person erased.

Closing your account

You can close your own account from your settings, and you have to enter your password first. Closing it removes your sessions, your stored password, your two-step sign-in secret and backup codes, any connected apps, and your membership of every business. Your name becomes "Closed account" and your email address is replaced with one that cannot receive mail.

If you paid us for Bottle, closing your account does not remove the record of what you paid. We have to keep records of money we were paid for six years from the end of the accounting period, which in practice means up to seven years, and we cannot waive that because it is a duty to HMRC rather than a preference of ours. Those invoices are held by Stripe, who bill on our behalf, and they carry the name, email address and billing address given at the time.

The account record itself stays, so that things other people did still make sense: an invitation you sent still shows who sent it, and cash you carried still shows who held it. Closing your account takes it off rounds you drove, your times at stops, copies of rounds you drove and the record of changes to rounds, and deletes the time per delivery worked out from your stops, your usual order of customers, your usual door sales and any customer's usual driver that names you. Those rounds stay with the business with no driver on them. It also deletes the driver details each business keeps about you: the name it uses for you, your licence details, your home address, your usual vehicle, and your hours and holiday settings. A home address saved as a place a round can start or end is a separate record, and stays until your employer removes it. If you are the last owner of a business, we will not let you close your account until somebody else owns it, because otherwise the business would be left with nobody able to get in.

Retention settings, and what erasing actually does

This section is for two different readers. If you run a gas or fuel business on Bottle, it is the part your own customers will ask you about, so it is written so you can answer them. If you are one of those customers, it explains what your supplier controls and what they do not.

What the business controls

Each business using Bottle sets its own rule for how long a customer who has stopped ordering is kept. There are three settings.

• Whether the sweep runs at all. It can be switched off, in which case nothing is erased automatically and records stay until somebody erases them by hand.
• How many years of no orders before a record is erased. This can be set anywhere from one year to seven years. Seven is the default and it is also the maximum: it cannot be set higher. The reason is that HMRC requires six years of records, so seven years clears that obligation with a year to spare, and keeping customer details for longer than that needs a better reason than habit.
• How much warning before it happens. Thirty days by default. The business is emailed once, before anything is erased, so somebody can step in if a record should stay.

Which date the clock runs from

The clock runs from the customer's last order. Where a customer record exists but has never had an order against it, the clock runs from the day the record was created instead. An account somebody opened and never used is still somebody's name, address and phone number, and leaving it out of the sweep would mean it stayed for ever.

Freezing a record

Any customer record can be put on legal hold, which freezes it against both the automatic sweep and the manual erase button. It still appears on the list of records that are due, marked as held, so it is not forgotten. This is what you would use during a dispute, an insurance claim or an investigation, where deleting the record would destroy something you may be required to produce.

An honest word about the default

The settings for a business are created the first time somebody opens the retention page. A business that has never looked at it is therefore running on seven years and thirty days' notice. That is a deliberate choice of default rather than an accident, but we are not going to describe it as a decision the business made, because they have not made it yet.

What erasing a customer actually does

A business can erase a customer at any time, either because the retention sweep has reached them or because the customer has asked. This is what happens.

• Orders and invoices older than six years are deleted outright, along with everything hanging off them.
• Invoices inside six years are kept whole, including the name and address printed on them. A VAT invoice has to show who it was issued to, so an invoice that has been altered is no longer a valid record. This is a legal obligation on the business, and it is the usual reason a customer cannot be removed from the accounts entirely.
• Orders inside six years keep their money but lose their personal detail. The name, address and notes on the order are removed, while the amounts stay so the books still balance.
• The customer record itself is either deleted or blanked. If nothing is left inside the six-year window, the customer, their addresses and their agreed prices are deleted completely. If something is left, the record stays but is emptied: the name is replaced with a note saying it was erased at the customer's request, and the email address, phone number and notes are removed.
• Map coordinates go with the address. The point worked out from the postcode is removed, and so is any pin somebody placed by hand to mark where the van should pull up. A coordinate identifies a house at least as precisely as the address beside it, so leaving it behind would be an erasure in name only. The position copied onto each delivery stop goes the same way.
• Signatures and doorstep photographs are destroyed. The record that a delivery was proved stays, because that belongs to the order, but the image, the name of whoever signed and the driver's note are removed, and the private link that was emailed for it stops working.
• WhatsApp messages are deleted.
• A record of the erasure is kept. It says that an erasure happened, when, why and how much was removed. It deliberately does not contain the name of the person erased, because a list of everyone who has asked to be forgotten would defeat the point.

Backups

We back up the Bottle database and the files uploaded to it, such as signatures and delivery photographs, so that a fault or a mistake cannot lose anybody's records. Backups are encrypted, held in the United Kingdom, used only to recover from a failure and deleted automatically after 90 days. Nobody looks through them, and they are not used for anything else.

Backups and erasure. When somebody is erased, or their details reach the end of their retention period, they are removed from Bottle straight away. Backups taken before then are left to expire, so within 90 days no backup holds them. If we ever have to restore from a backup, every erasure made since that backup was taken is carried out again before Bottle is back in use, so nobody who has been erased comes back.

Customers can read more about how we protect their data in our trust centre.

Who else sees it

We use a small number of other companies to run Bottle: to bill you, to send email, to send and receive WhatsApp messages for businesses that connect a number, to deliver notifications to phones, to look up postcodes, to host the software and to provide optional AI features. Every one of them is named on our third parties page, along with what reaches them and which country they are in. If a company is not on that page, it does not handle your data.

If we ever take on a new company that will handle personal data on your behalf, we will tell customers at least thirty days beforehand, so there is time to object or to leave.

A business can also use a delivery partner, another company it chooses to deliver some of its orders. When the business sends that partner a day's list, or downloads it to pass on, the list holds the order reference, contact name, address, postcode, phone, products, delivery notes and delivery date for those orders. It has no prices or payment details. The business decides this and answers for it, and the partner is not one of our suppliers.

We record on each order when it was sent or downloaded, how and by whom, with a scrambled fingerprint of those details so that an edit since can be noticed. We do not keep a copy of the file. Our record of the email holds the references of any orders taken off the list, and no names or addresses. Erasing a customer clears the fingerprints, and leaves nothing about them in our record of what was sent apart from those references, which are no longer linked to any name.

Erasing a customer cannot recall a list already sent. The partner holds its own copy, and we cannot reach it. Ask the business to ask the partner to delete it. A customer's export shows which partner had each order.

We do not sell personal data, and we do not share it for anyone else's marketing. We would disclose data if the law required it of us, for example under a court order, and we would tell the affected customer unless we were forbidden from doing so.

Optional AI features

Who runs the AI. Bottle's AI models are run by Anthropic, through its API. What we send for each feature below goes to Anthropic, which processes it in the United States. Anthropic says it deletes API inputs and outputs within 30 days, and keeps them for up to 2 years if its automated checks flag them as breaking its Usage Policy, with classification scores for up to 7 years, and longer where the law requires. Its commercial terms say it may not train models on this content. Its data processing addendum is part of those terms and applies the EU Standard Contractual Clauses and the UK Addendum to them. Help-guide embeddings are generated by Amazon Web Services in Ireland, from help-guide text and not from account records. The details are on our third parties page.

Flame AI. To answer your question, we send it and relevant conversation and help-guide text to Anthropic. We also send useful context such as your role and the page you are viewing. When your business allows account reads, the assistant can look up information you are permitted to see, such as products, customer records, orders and rounds. This can include personal details needed to answer you. It cannot change your records. Owners and administrators can turn business-data access off in Business Settings; it is on by default. Your questions still reach the model when you use the chat, so do not include information you do not want it to process.

Questions, answers and guide references are stored on Bottle's servers and deleted after 30 days without activity. You can delete a conversation sooner from Recent chats. Raw account lookup results are used for the current request and are not stored separately in the conversation or added to the shared help-guide index; any facts quoted in the answer remain part of that answer. Lookup metadata is kept for 30 days without the raw records, arguments or credentials.

Rosie, the sales assistant on this website. To answer you, we send your message, the earlier messages in the same chat, the page you asked from and relevant help-guide text to Anthropic. Rosie answers from our help guides only. She has no access to any business's data in Bottle, and she cannot agree prices or send anything on your behalf.

WhatsApp orders. When a business connects its WhatsApp number, Bottle sends Anthropic the messages in each conversation, the business's products and prices, and the names and delivery addresses of the customers whose records hold the number that wrote. When the customer asks about their account, Bottle also sends what it looked up for them: their deliveries, orders, cylinders, invoices or balance. Bottle's own code picks the customer records from the number before anything is looked up, so the AI cannot ask for anybody else's. A business can turn off answering questions in its WhatsApp settings. Messages reach Bottle through Meta, which runs WhatsApp; see our third parties page.

Bottle's day plans. When Bottle works out a day's plan, parts of the decision go to Anthropic. We send only figures and fixed codes, such as an order's weight, the stops on a round and the driving time. We do not send names, addresses, notes or record identifiers. The figures can still relate to one driver's round when read with Bottle's own records. Bottle checks each plan against its rules, and a plan changes nothing unless somebody at the business chooses to use it.

What Bottle learns about a business. When this is turned on for a business, Bottle learns from what happens on its rounds, such as moves the office makes and how deliveries went, and from what the owner tells it, to make its plans better. It can hold a fact it has worked out, such as a weekday a customer is usually out, or the driver a customer usually has, along with where that came from and which plans used it. This can name a customer or a driver. It is about jobs and places. Bottle does not score or rank drivers. Code works this out, without an AI model. It is off unless turned on, and each business's learning stays with that business. It can also hold a driver's usual time at a stop, for planning only. Nobody sees that as a figure about the driver, the owner included. The driver can see it in their account export, and it is deleted when they close their account. Only the owner can open what Bottle has learned. Apart from that time, they can see all of it, reword or delete what they told it, and mark anything Bottle worked out as wrong, so that plans stop using it and it is not learned again. When something changes overnight the owner gets an email and a notification, which they can turn off. Erasing a customer or a person removes what names them and what was worked out only from them.

What the owner tells Bottle. When learning is on, the owner can tell Bottle something or answer a few questions about how they plan. Bottle first finds the customers, addresses, drivers, vehicles and areas that plausibly match the words they typed. We send Anthropic the text they type with only those names and reference numbers, so that it can work out who and what the owner means. That can include someone with a similar name who the owner did not mean. We send only what matching needs: no address beyond its name, no contact details, notes or order history. Bottle holds back sentences with contact details or facts about a person that it recognises, but this is a pattern check and it can miss things. Bottle keeps nothing until the owner saves it, and what comes back cannot change a plan until the owner has confirmed it.

Other AI features. Product suggestions, website drafts and service-document reading send Anthropic the information relevant to that task. Documents and imported content can contain personal data.

AI can make mistakes.

Where it is held

The Bottle platform, including its database, runs with Amazon Web Services in London. Files uploaded to Bottle, such as signatures, doorstep and delivery-note photographs and invoice logos, are stored there too, apart from the database. They are private and encrypted, nobody reaches them except through Bottle, and location details are removed from photographs when they are uploaded. Our backups are held in London too, as described under Backups.

This website and the register-interest form behind it run on Cloudflare's network. We have not pinned that database to a particular country, so we cannot yet tell you which one it is in. We are finding out and this page will say so once we know.

AI model requests are processed by Anthropic in the United States, as described under Optional AI features. Some of the companies we use process data outside the United Kingdom under their own terms, and the third parties page says which.

Your rights

Under United Kingdom data protection law you can ask for a copy of the personal data held about you, ask for it to be corrected, ask for it to be deleted, ask for the handling of it to be restricted, object to it being handled, and ask for it in a portable form. Where we rely on your consent, you can withdraw it at any time.

Who to ask

• If you are a customer of a distributor, ask them, because the data is theirs and the decision is theirs. If you cannot reach them or you do not know who they are, write to us at compliance@getbottle.app and we will help you find the right person.
• If you drive for a business that uses Bottle, ask your employer for the same reason. We will help you work out who to write to.
• If Bottle is your own account, or you sent the form on this website, ask us directly at compliance@getbottle.app. We answer within one month, which is what the law allows us.

Getting a copy

A business using Bottle can export a customer's record from inside the software, and you can export your own account data from your settings. Your account export includes the changes you made to rounds, the rounds you were put on or taken off, copies of the rounds you drove, when you arrived at and left each stop, the time per delivery worked out from those times, the driver details each business keeps about you, including your licence details and home address, the customers you are named as usual driver for, your usual order of customers, your usual door sales and the rounds Bottle's day plans gave you, with the number of stops but not whose they are. It also includes the answers you gave to questions Bottle asked you, without the customer each was about.

The customer export holds their record, their addresses, their agreed prices and every order with its lines, along with their invoices, each delivery stop and what happened there, what was signed for at the door, cash taken at it, and the messages sent to them. It also shows the record of the days Bottle looked at to work out their usual driver: whether those days found one, how many days there were and when it last looked. It leaves out who the driver is, because that is a staff member's data. It also shows how many times they appear in drivers' usual orders and when that was worked out, leaving out the driver and the other customers. It also holds what Bottle's day plans said about their orders, leaving out the driver and the other stops. It also holds the questions Bottle asked about them and the answers, leaving out who answered. The account export holds the person, the businesses they belong to, their sessions and connected apps, their registered phones, their time off, cash they carried and what the bell has told them.

Two things are deliberately left out of a file, and neither is being withheld. A signature or a doorstep photograph is given as a link rather than pasted into the file, because an image inside a page of data helps nobody, and the link fetches the real thing. A phone's notification token and a password are not in there either: those are locks rather than contents, and handing them over would help somebody else more than the person asking.

Complaining

If you are unhappy with how your data has been handled, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the United Kingdom's data protection regulator, and you do not have to come to us first. If your complaint is about a distributor rather than about us, the Information Commissioner's Office is still the right place, and your complaint is against them.

Children

Bottle is software for running a gas or fuel delivery business. It is not designed for children, not marketed to them, and we do not knowingly hold data about them. If you believe we hold a child's data, email compliance@getbottle.app and we will look into it.

Changes to this policy

We will keep this page current rather than writing it once and leaving it. When something changes that affects what we hold, why we hold it or how long we keep it, we will change this page and update the date at the bottom. Where the change is significant, such as taking on a new company that handles personal data, we will tell customers directly rather than relying on you to notice.