Third parties and subprocessors

Bottle is built on other people's services, and some of them handle data that belongs to you or to your customers. This page names every one of them, says what reaches them and where they are, and marks the ones that are optional or not switched on yet.

This page is the whole list. If a company is not named here, it does not handle your data, and we keep this page current rather than writing it once.

Before we add anyone new. If we take on a new company that will handle personal data on your behalf, we will tell customers at least 30 days beforehand, so you have time to object or to leave.

Taking payments

Stripe Required for your subscription

Stripe Payments Europe, Ltd. Payments infrastructure.

What it does: Bills you for your Bottle subscription and holds the card you pay us with.
What reaches it: Your name, email address, business name and billing address. Card numbers are typed on Stripe's own pages and never reach our servers.
Where: Stripe processes payment data across its own international infrastructure, under its own terms.
Optional?: No, not if you are paying for Bottle. It is how the subscription is charged.

Stripe Connect Integration, off by default

Stripe Payments Europe, Ltd. Payments infrastructure.

What it does: Lets you take card payments from your own gas customers, through a Stripe account in your own name. The money goes to you, not through us.
What reaches it: Your customer's email address, the amount, and a reference to the order or invoice being paid. Card numbers are typed on Stripe's own pages and never reach our servers. Setting the account up means giving Stripe the details they need to know who you are.
Where: Accounts we open for distributors are set to the United Kingdom. Stripe processes payment data across its own international infrastructure, under its own terms.
Optional?: Yes. It is off until you open an account, and nothing about your customers reaches Stripe before you do. Without it, you take payment however you do today and Bottle records it.

Accounting

Xero Integration, off by default

Xero Limited, New Zealand. Accounting software.

What it does: Keeps your contacts in step between Bottle and Xero, and pushes invoices and payments into your accounts so nobody types them twice.
What reaches it: Customer name, email address, phone number and address; invoice lines, amounts, tax and references; and the payment method used. Contacts also come back the other way, from your Xero organisation into Bottle.
Where: We connect to Xero's global service. Where Xero itself processes and stores the data is governed by Xero's own terms, not by a setting we control, and we are not going to guess at it here.
Optional?: Yes, entirely. It is off until you connect your own Xero organisation, and nothing reaches Xero before you do. Disconnect it and the sync stops.

Online shops

Shopify Integration, off by default

Shopify International Limited, Ireland. Online shop software.

What it does: Brings paid orders from your own Shopify shop into Bottle for delivery, and imports your products so you do not type them twice.
What reaches it: Bottle reads from your shop: products, and for each paid order the customer's name, email address, phone number, delivery address, what they bought, what they paid and any delivery date. Bottle sends Shopify only its own requests, and the setup of the notifications that tell Bottle about a new order. It does not change your products, orders or payments.
Where: Shopify's own infrastructure, under Shopify's terms. Your shop's data is already held there.
Optional?: Yes, entirely. It is off until you connect your own shop. Disconnect it and imports stop.

WooCommerce Integration, off by default

Runs on your own WordPress website, wherever you host it.

What it does: Brings paid orders from your own WooCommerce shop into Bottle for delivery, imports your products, and can copy your website's pages and pictures into Bottle Shop.
What reaches it: Bottle reads from your shop: products, pages and pictures, and for each paid order the customer's name, email address, phone number, delivery address, what they bought, what they paid and any delivery date. The only thing Bottle writes to your shop is the setup of its own order notifications. It does not change your products, prices, orders or payments.
Where: Wherever your website is hosted. That is your choice and your hosting company's, not ours.
Optional?: Yes, entirely. It is off until you connect your own shop. Disconnect it and imports stop.

Email

Resend

Plus Five Five, Inc., trading as Resend. Email delivery.

What it does: Sends every email Bottle sends: invoices, order confirmations, delivery notices, password resets, invitations and email verification.
What reaches it: The recipient's email address, the subject and body, and any attachment. Invoices are attached as PDFs, so the customer's name, address, the lines on the invoice and the total pass through.
Where: Resend is a United States company. Mail passes through its infrastructure on the way to the recipient.
Optional?: No. A product that invoices people has to be able to email them.

Meta Integration, off by default

Meta, which runs WhatsApp. The WhatsApp Business Platform.

What it does: Carries WhatsApp messages between your WhatsApp Business number and your customers, so Bottle can read orders and reply from your number. It also runs the Meta window an owner signs in to when connecting the number.
What reaches it: Every message your customers send to your number, and every reply sent from it, by Bottle or by your staff in Bottle, with any buttons and any invoice sent as a PDF. Meta sees your customers' WhatsApp numbers and profile names, which it already holds as WhatsApp's operator. When an owner connects a number, Facebook's script is loaded in their browser for that step only, and Meta gives Bottle access to send from the number, which Bottle keeps encrypted and deletes when you disconnect.
Where: Meta's own global infrastructure, including the United States. For these messages Meta acts on the business's behalf under WhatsApp's Business Data Processing Terms, which include the UK transfer addendum. What WhatsApp does with messages on people's phones is covered by WhatsApp's own privacy policy.
Optional?: Yes, entirely. It is off until an owner connects a WhatsApp Business number, and nothing reaches Meta from Bottle before then. Disconnect it in Settings and Bottle stops reading and sending. Messages already on the phones are not affected.

Notifications on phones

Apple Push Notification service

Apple Inc. Push notifications to iPhones.

What it does: Delivers notifications to the Bottle driver app on iPhone, so a driver's handset tells them about a round or a message without the app being open.
What reaches it: A device token identifying the handset, and the notification's title, body and the link it opens. See the note below on what that text can contain.
Where: Apple's own global infrastructure.
Optional?: Yes. Without it, notices still appear inside the app; the phone just does not buzz.

Firebase Cloud Messaging

Google LLC. Push notifications to Android phones.

What it does: Delivers notifications to the Bottle driver app on Android phones, so a driver's handset tells them about a round or a message without the app being open.
What reaches it: A registration token identifying the handset, and the notification's title, body and the link it opens. See the note below on what that text can contain.
Where: Google's own global infrastructure.
Optional?: Yes. Without it, notices still appear inside the app; the phone just does not buzz.

What a push notification can contain. Notifications sent through Apple and Google can include a customer's name, an order or invoice reference and an amount, together with staff names and short notes written by your own people.

They never contain a customer's address, phone number or email address, and never any payment details. Your gas customers never receive push notifications from Bottle at all; notifications only go to people who have signed in to your business.

Maps, addresses and routes

postcodes.io

An open-source postcode service, hosted by Ideal Postcodes.

What it does: Turns a postcode into a position on the map so a round can be planned.
What reaches it: A postcode, or a pair of coordinates for a reverse lookup. Nothing identifying anyone travels with it: no name, no reference, no customer.
Where: Not pinned to a region. It is open source, so it can be run on our own machine instead.
Optional?: Yes, though without it there is no map and no route planning.

Ordnance Survey Places Not in use today

Ordnance Survey, United Kingdom. The national address database.

What it does: Offers the list of addresses at a postcode, so an address can be picked rather than typed.
What reaches it: A postcode. That is all. No name, no customer, no account.
Where: United Kingdom.
Optional?: Yes, and it is not switched on today. Addresses are typed by hand and the postcode is checked, which is what every yard did before.

Route distances and drive times are worked out by a routing engine that runs on our own server, on a private network with no way in from the internet. No address, round or coordinate is sent to an outside routing service.

Where Bottle runs

Amazon Web Services

Amazon Web Services EMEA SARL, Luxembourg. Server hosting, the database, uploaded files, backups and help-guide search.

What it does: Hosts the whole product: the website you sign in to, the API the apps talk to, the database and the routing engine. It stores the files uploaded to Bottle, such as signatures, doorstep and delivery-note photographs and invoice logos, and keeps our backups. Through Amazon Bedrock, it also generates the embeddings used to search our help guides.
What reaches it: Everything. Every customer, order, delivery, invoice, address, position and staff record lives in our database here. Uploaded files are encrypted and private: nobody reaches them except through Bottle, and location details are removed from photographs. Backups hold the same data as the database and its files, encrypted, in a separate account used for nothing else, for up to 90 days, and are used only to recover from a failure. See Backups in our privacy policy. For help-guide search, only help-guide text. Account records are not sent to it for this.
Where: London, United Kingdom. Help-guide embeddings are generated in Ireland.
Optional?: No. This is where Bottle runs, where uploaded files live, and how Bottle recovers from a failure.

Anthropic

Anthropic Ireland, Limited, which contracts with customers in the United Kingdom. Hosted AI models.

What it does: Runs the AI models used by Flame AI, Rosie on this website, WhatsApp orders, product-import suggestions, website drafts and service-document reading. Flame AI answers questions using our help guides and, when your business allows it, read-only information from your account. Bottle's day plans use it to choose between options Bottle has checked, to suggest changes after reading the whole day, which Bottle checks against every limit, and to write short reasons. When a business has learning on, it works out what the owner means when they tell Bottle something or answer its questions.
What reaches it: Only the information needed for the feature you use. For day plans it receives figures and fixed codes, with no names, addresses, notes or record identifiers. Flame AI receives your question, relevant conversation and help-guide text, your role and current page, and any account information it is permitted to read. This can include customer, order, product or round details. When the owner tells Bottle something or answers its questions, it receives the text they type, with the names and reference numbers of only those customers, addresses, drivers, vehicles and areas that plausibly match it. It receives no address beyond its name, and no contact details, notes or order history. For WhatsApp orders it receives the messages in each conversation, the business's products and prices, and the names and delivery addresses of the customers whose records hold the number that wrote; when a customer asks about their account, it also receives the deliveries, orders, cylinders, invoices or balance Bottle looked up for them. Bottle's own code chooses those records from the number, so the model cannot ask for another customer's. Other features receive relevant product information, imported website content, or text read from a service document. Names and other personal details can be present in questions, records, documents or instructions you supply. Account records are not added to the shared help-guide search index.
Where: The United States. Anthropic's data processing addendum is part of its commercial terms, and applies the EU Standard Contractual Clauses and the UK Addendum to transfers.
How long it is kept: Anthropic says it deletes API inputs and outputs within 30 days. It keeps them for up to 2 years if its automated checks flag them as breaking its Usage Policy, and classification scores for up to 7 years. It can also keep them longer where the law requires. Its terms say it may not train models on this content. See Anthropic's retention page.
Optional?: Yes. Ordinary orders, deliveries and invoicing do not need AI. An owner or administrator can turn off Flame AI's business-data access in Business Settings; it is on by default. You can still ask about the help guides. Other AI features run when you use them.

Cloudflare

Cloudflare, Inc. Domain names and this website.

What it does: Runs our domain names, and hosts this marketing site along with the register-interest form on it. Its Turnstile check stops automated sign-ups on the form, on Rosie and on the Bottle sign-up page.
What reaches it: For this website: ordinary web request records, anything you type into the interest form, and the visit counts from Cloudflare Web Analytics (the page, where you came from, browser, device and country; no cookies). For the product: domain lookups, and the Turnstile check on the sign-up page, which sees your browser and the address it connects from while you sign up. Cloudflare does not sit in front of the Bottle application itself.
Where: Cloudflare's global network. We have not pinned the interest-form database to a region, so we cannot yet tell you which country it sits in. We are checking, and this page will say so once we know.
Optional?: No, for the website and domains.

What your browser fetches

Nobody on this page receives anything because you looked at a page. The typefaces are served from our own servers, on this website and in Bottle itself, so reading this tells no one that you were here.

One exception, and it is worth naming. The maps in Bottle are drawn from tiles fetched by your browser from OpenFreeMap, a free map service built on OpenStreetMap. They see the address your browser is connecting from and which part of the country is on screen, and nothing else: no customer, no name, no order. The map can be pointed at one we host ourselves, and we expect to do that.

Two more, each on one page only. The sign-up page loads Cloudflare's Turnstile check, described above, so that sign-ups are made by people. And when an owner chooses to connect WhatsApp, the settings page loads Facebook's script so the owner can sign in to Meta. Neither is loaded anywhere else in Bottle.

Tracking on a Bottle Shop

A business can add its own analytics or advertising tags to its Bottle Shop: Google Analytics, Google Tag Manager, Google Ads, the Meta Pixel, Microsoft Clarity, TikTok and Plausible. These are the business's choice and the business's accounts with those companies, not ours, and they run only on that business's shop, never in the Bottle app. Apart from Plausible, which sets no cookies, none of them loads until the shopper agrees in the shop's cookie banner. The shop's cookie page names each one switched on, with a link to its own privacy notice.

Your AI conversations

Flame AI conversations are private to the signed-in user and business. We keep the questions, answers and guide references on Bottle's own servers, and delete a conversation after 30 days without activity. You can delete it sooner from Recent chats. Read-only account lookups check your current permissions and the business's settings; they do not give the assistant permission to change records.

Information read from your account is used to answer that request, not to build the shared help-guide index. The answer itself may contain those facts and is kept with the conversation. Metadata about account lookups is kept for 30 days without the raw records, request arguments or credentials. For more on the data involved, see our privacy policy's AI section.

Asking us about this

If you need something this page does not answer, such as a data processing agreement or a completed security questionnaire, email compliance@getbottle.app and ask. We would rather have the conversation than have you guess.

Sorteo Ltd, trading as Bottle. Registered in England and Wales, company number 16426798.

Registered office: 2nd Floor, 1 Church Square, Leighton Buzzard, Bedfordshire, LU7 1AE, United Kingdom.

Last updated 11 November 2026.