Privacy and retention
Open Privacy and retention from your user menu to manage inactive customer records. Choose settings that meet your business’s retention obligations; Bottle’s defaults are not legal advice.
Reviewing Bottle’s updated policies
Section titled “Reviewing Bottle’s updated policies”When Bottle updates a policy that needs your review, a full-screen review opens before you can continue in the web app. It shows what changed and links to each updated document in a new tab.
Read the documents, then tick the confirmation for each one and select Confirm and continue. Terms require agreement; the privacy policy requires acknowledgement. Nothing is accepted automatically, and closing a tab does not record acceptance. You can sign out and return later if you need more time.
If you have questions about the changes or need help accessing or exporting your data before accepting, contact Bottle using the details in the privacy policy.
How long you keep a dormant customer
Section titled “How long you keep a dormant customer”Inactivity is measured from the last order, or the date the customer was added if they have never ordered.
Bottle defaults to seven years and supports shorter periods. Before automatic erasure, it notifies you and lists the affected customers. The default notice period is thirty days.
The erasure process retains recent financial records according to Bottle’s six-year safeguard. Where records must remain, personal contact details are cleared and the customer record is anonymised. Retained invoices keep their original billing details.
You can disable automatic erasure and manage requests manually. You remain responsible for choosing appropriate retention rules.
Legal hold
Section titled “Legal hold”Open the customer’s data section and apply Legal hold to prevent automatic or manual erasure while records are needed.
The customer remains on the retention list, marked as held. Remove the hold when it is no longer required.
Exporting a customer’s data
Section titled “Exporting a customer’s data”Use Download everything held on the customer record to export their details, addresses, agreed rates, orders with their lines, anything Bottle has learned about them, what Bottle’s day plans said about their orders, and any questions Bottle asked about them with the answers. Bottle keeps a record of the days it looked at to work out a customer’s usual driver. The export shows whether those days found one, how many days there were and when it last looked. It doesn’t name the driver, because that is a staff member’s data. Bottle also works out the order each driver usually serves their repeat customers. The export shows how many times this customer appears in drivers’ usual orders and when that was worked out. It doesn’t name the driver or the other customers. Erasing a customer takes them out of every driver’s usual order. The export also lists which delivery partner had each of their orders, and on which day.
Review the export before responding to a data request.
Erasing a customer’s data
Section titled “Erasing a customer’s data”Use Erase their details in the customer’s data section.
- If there are no orders or invoices within the last six years, Bottle removes the customer and older associated records.
- If recent financial records exist, those records remain. The customer is anonymised and contact details, notes and addresses are removed. Retained invoices preserve their original billing name and address.
- Their WhatsApp chats are deleted, including chats from any phone number on their record.
Somebody who messaged your WhatsApp number but is not a customer can’t be erased this way. Open their chat in Messages and choose Delete chat. See WhatsApp orders.
Erasure cannot be undone. Review the records and any applicable obligations before confirming.
Erasure records
Section titled “Erasure records”The erasure log records when the action happened, its reason, the affected record ID and counts of records removed or retained. It does not keep the erased customer’s name.
Bottle’s day plans
Section titled “Bottle’s day plans”When Bottle works out a day’s plan, it keeps a working copy for 14 days after that day and the plan for two years, so your plans can be measured across the seasons. That measuring is for your business only. Erasing a customer or a person deletes the plans that include them and all of that business’s working copies straight away. Counts comparing each plan with what was sent, and a record of each time Bottle works out a day’s plan, stay for as long as the business uses Bottle. They hold no names and no orders. The privacy policy says what goes to AI models.
What Bottle’s own staff can do
Section titled “What Bottle’s own staff can do”Authorised staff can manage service-level settings such as trials, allowances and suspensions. Staff actions are recorded.
Access to the contents of your business is controlled separately, as described below.
Support access
Section titled “Support access”In Business settings → Support access, turn on the switch and choose what to allow, for a day or a week:
- Look only: staff can inspect the account without changing it.
- Look and change: staff can make changes to help resolve the issue.
Turn the switch off to end access at once.
Staff can also request access with a reason. You receive the request by email and notification and can approve or decline it.
Access expires automatically and staff activity is logged. Authorised senior staff have an emergency-access option that requires a written reason and is also logged for review.
Your own account
Section titled “Your own account”In Login and security → Your data, download your personal account data or close your account. The download includes your driver details at each business, such as your licence details and home address. It also lists the orders you gave to a delivery partner or took off one, and the rounds Bottle’s day plans gave you, with the number of stops but not whose they are.
Closing requires your password. It removes sign-in credentials, active sessions and connected-app access. It takes your account off rounds, stop times, round copies, round changes and the orders you gave to a delivery partner or took off one, and deletes the time per delivery worked out from your stop times, your usual order of customers, your usual door sales and any customer’s usual driver that names you. It also deletes questions Bottle put to you and the answers you gave. Those rounds stay with the business with no driver on them. It also deletes your driver details at each business, such as your licence details, home address and usual vehicle. A home address saved as a location stays until the business removes it. Other records of work you did, such as cash you carried, still show the closed account.
If you are a business’s last owner, transfer ownership before closing your account.
Through the API
Section titled “Through the API”privacy:read allows access to retention settings, pending erasures and the erasure log. Customer export requires customers:read.
privacy:write controls retention changes and erasure. It cannot be granted to API keys or connected apps.