All policies

Third parties and subprocessors

Bottle is built on other people's services, and some of them handle data that belongs to you or to your customers. This page names every one of them, says what reaches them and where they are, and marks the ones that are optional or not switched on yet.

This page is the whole list. If a company is not named here, it does not handle your data, and we keep this page current rather than writing it once.

Before we add anyone new. If we take on a new company that will handle personal data on your behalf, we will tell customers at least 30 days beforehand, so you have time to object or to leave.

Taking payments

Stripe Required for your subscription

Stripe Payments Europe, Ltd. Payments infrastructure.

What it does: Bills you for your Bottle subscription and holds the card you pay us with.
What reaches it: Your name, email address, business name and billing address. Card numbers are typed on Stripe's own pages and never reach our servers.
Where: Stripe processes payment data across its own international infrastructure, under its own terms.
Optional?: No, not if you are paying for Bottle. It is how the subscription is charged.

Stripe Connect Integration, off by default

Stripe Payments Europe, Ltd. Payments infrastructure.

What it does: Lets you take card payments from your own gas customers, through a Stripe account in your own name. The money goes to you, not through us.
What reaches it: Your customer's email address, the amount, and a reference to the order or invoice being paid. Card numbers are typed on Stripe's own pages and never reach our servers. Setting the account up means giving Stripe the details they need to know who you are.
Where: Accounts we open for distributors are set to the United Kingdom. Stripe processes payment data across its own international infrastructure, under its own terms.
Optional?: Yes. It is off until you open an account, and nothing about your customers reaches Stripe before you do. Without it, you take payment however you do today and Bottle records it.

Accounting

Xero Integration, off by default

Xero Limited, New Zealand. Accounting software.

What it does: Keeps your contacts in step between Bottle and Xero, and pushes invoices and payments into your accounts so nobody types them twice.
What reaches it: Customer name, email address, phone number and address; invoice lines, amounts, tax and references; and the payment method used. Contacts also come back the other way, from your Xero organisation into Bottle.
Where: We connect to Xero's global service. Where Xero itself processes and stores the data is governed by Xero's own terms, not by a setting we control, and we are not going to guess at it here.
Optional?: Yes, entirely. It is off until you connect your own Xero organisation, and nothing reaches Xero before you do. Disconnect it and the sync stops.

Email

Resend

Plus Five Five, Inc., trading as Resend. Email delivery.

What it does: Sends every email Bottle sends: invoices, order confirmations, delivery notices, password resets, invitations and email verification.
What reaches it: The recipient's email address, the subject and body, and any attachment. Invoices are attached as PDFs, so the customer's name, address, the lines on the invoice and the total pass through.
Where: Resend is a United States company. Mail passes through its infrastructure on the way to the recipient.
Optional?: No. A product that invoices people has to be able to email them.

Notifications on phones

Apple Push Notification service

Apple Inc. Push notifications to iPhones.

What it does: Delivers notifications to the Bottle driver app on iPhone, so a driver's handset tells them about a round or a message without the app being open.
What reaches it: A device token identifying the handset, and the notification's title, body and the link it opens. See the note below on what that text can contain.
Where: Apple's own global infrastructure.
Optional?: Yes. Without it, notices still appear inside the app; the phone just does not buzz.

Firebase Cloud Messaging

Google LLC. Push notifications to Android phones.

What it does: Delivers notifications to the Bottle driver app on Android phones, so a driver's handset tells them about a round or a message without the app being open.
What reaches it: A registration token identifying the handset, and the notification's title, body and the link it opens. See the note below on what that text can contain.
Where: Google's own global infrastructure.
Optional?: Yes. Without it, notices still appear inside the app; the phone just does not buzz.

What a push notification can contain. Notifications sent through Apple and Google can include a customer's name, an order or invoice reference and an amount, together with staff names and short notes written by your own people.

They never contain a customer's address, phone number or email address, and never any payment details. Your gas customers never receive push notifications from Bottle at all; notifications only go to people who have signed in to your business.

Maps, addresses and routes

postcodes.io

An open-source postcode service, hosted by Ideal Postcodes.

What it does: Turns a postcode into a position on the map so a round can be planned.
What reaches it: A postcode, or a pair of coordinates for a reverse lookup. Nothing identifying anyone travels with it: no name, no reference, no customer.
Where: Not pinned to a region. It is open source, so it can be run on our own machine instead.
Optional?: Yes, though without it there is no map and no route planning.

Ordnance Survey Places Not in use today

Ordnance Survey, United Kingdom. The national address database.

What it does: Offers the list of addresses at a postcode, so an address can be picked rather than typed.
What reaches it: A postcode. That is all. No name, no customer, no account.
Where: United Kingdom.
Optional?: Yes, and it is not switched on today. Addresses are typed by hand and the postcode is checked, which is what every yard did before.

Route distances and drive times are worked out by a routing engine that runs on our own server, on a private network with no way in from the internet. No address, round or coordinate is sent to an outside routing service.

Where Bottle runs

Hetzner

Hetzner Online GmbH, Germany. Server hosting.

What it does: Hosts the whole product: the website you sign in to, the API the apps talk to, the database and the routing engine, all on one machine.
What reaches it: Everything. Every customer, order, delivery, invoice, address, position and staff record lives in a database on this machine, along with the copies of it we keep as part of running the service.
Where: Germany or Finland. Hetzner has no United Kingdom region. Transfers to the European Economic Area are permitted under UK data protection law, but we would rather say plainly where the data sits than leave you to find out.
Optional?: No. This is where Bottle runs.

Cloudflare

Cloudflare, Inc. Domain names and this website.

What it does: Runs our domain names, and hosts this marketing site along with the register-interest form on it.
What reaches it: For this website: ordinary web request records, and anything you type into the interest form. For the product: domain lookups only. Cloudflare does not sit in front of the Bottle application itself.
Where: Cloudflare's global network. We have not pinned the interest-form database to a region, so we cannot yet tell you which country it sits in. We are checking, and this page will say so once we know.
Optional?: No, for the website and domains.

What your browser fetches

Nobody on this page receives anything because you looked at a page. The typefaces are served from our own servers, on this website and in Bottle itself, so reading this tells no one that you were here.

One exception, and it is worth naming. The maps in Bottle are drawn from tiles fetched by your browser from OpenFreeMap, a free map service built on OpenStreetMap. They see the address your browser is connecting from and which part of the country is on screen, and nothing else: no customer, no name, no order. The map can be pointed at one we host ourselves, and we expect to do that.

Planned, and not built yet

We would rather tell you what is coming than change this page quietly later. Neither of the following exists in Bottle today.

Amazon Bedrock Planned

Amazon Web Services, Inc. Hosted AI models.

What it would do: Power a support assistant inside Bottle that can answer questions from our help guides and from your own data.
What would reach it: The conversation, and whatever the assistant looked up to answer it.
Where: London. We chose Bedrock partly because the data stays inside AWS, is not used to train models, and can be kept in the United Kingdom.
When: Not built. This page will be updated before it handles anyone's data.

We will also keep our own record of what the assistant was asked and what it answered, so we can tell when it gets something wrong and put it right. That is held on our own servers and goes to no one else, which is why there is nothing to list here.

Asking us about this

If you need something this page does not answer, such as a data processing agreement or a completed security questionnaire, email privacy@getbottle.app and ask. We would rather have the conversation than have you guess.

Sorteo Ltd, trading as Bottle. Registered in England and Wales, company number 16426798.

Registered office: 2nd Floor, 1 Church Square, Leighton Buzzard, Bedfordshire, LU7 1AE, United Kingdom.

Last updated 28 September 2026.