BottleUp ("we", "us", "our") provides a venue rota, stock and fridge-management app for hospitality businesses. This policy explains what personal data we collect, why, and your rights over it.
Who we are
BottleUp is operated by Aaron Berrow, trading as BottleUp, based in Cardiff, United Kingdom. Aaron Berrow is the data controller for the personal data described in this policy. For any privacy question or request, contact us at support@bottleup.uk.
What we collect
- Account data: your name and email address (used to sign in and to identify you on your venue's roster).
- Venue & work data: venues you belong to, staff rosters, shifts, time-off and swap requests, stock counts, supplier and order information, and — if your manager enters it — your hourly rate for pay estimates.
- Photos you provide: fridge/reference photos you scan and any profile photo you upload.
- Device & usage data: a push-notification token (if you enable notifications) and basic diagnostic/log data needed to operate the app.
We do not collect location data, contacts, or advertising identifiers, and we do not use your data for advertising.
How we use it
- To create and run your account and show you your venue's rota and stock.
- To process fridge-scan photos into drink counts (see "AI processing" below).
- To send you notifications you've opted into (shift changes, swaps, orders).
- To keep the service secure and working (rate-limiting, diagnostics).
Our legal bases (UK GDPR) are performance of a contract (providing the app you signed up for) and our legitimate interests (security and improving the service).
AI processing of scans
Our AI processors — Anthropic (Claude) and Google (Gemini) — are used only for the app's scanning features: identifying drinks in a fridge photo, reading a fridge nameplate, looking up bottle/fridge dimensions, and parsing a scanned price list or invoice. For these, we send only the scan image and the minimal product context needed to return a result (for example your venue's product names).
We do not send your name, email, staff roster, pay information or any other account or personal data to these AI processors — they receive scan/stock data only. Scan images are processed to return a result and are not used for advertising. Please avoid capturing people in scan photos.
Who we share it with
- Your venue: managers and colleagues at a venue you join can see your name, role and rota entries for that venue.
- Processors who run the service on our behalf: Supabase (hosting, database, authentication and file storage), and Anthropic and Google (scan analysis only — they receive scan/stock data, never your account or personal data). They act on our instructions.
- We never sell your personal data.
Some processors may process data outside the UK/EEA; where they do, appropriate safeguards (such as Standard Contractual Clauses) are in place.
How long we keep it
We keep your data for as long as your account is active. When you delete your account (see below), we delete your profile, remove your stored photos, delete your email from every venue roster, and anonymise your name in historical rota records (venues keep the shift hours, no longer attributed to you). Some records may be retained for a limited period where required for legal or security reasons.
Your rights
Under UK GDPR you can access, correct, export or delete your personal data, and object to or restrict certain processing. You can:
- Edit your name and email in the app (Profile → Settings).
- Delete your account in the app (Profile → Delete Account), which removes your profile and scrubs your stored photos.
- Contact us at support@bottleup.uk to exercise any other right. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).
Children
BottleUp is intended for people aged 16 and over and is not directed at children.
Changes
We may update this policy; we'll post the new version here and update the date above.