Privacy Policy

Effective Date: January 1, 2026  |  Last Modified: September 12, 2026  |  Version 3.2

1. Introduction and Scope

Bottle Blue LLC ("Bottle Blue," "we," "us," or "our") respects your privacy and is committed to protecting your personal information through our compliance with this Privacy Policy ("Policy").

This Policy describes: (a) the types of information we collect from you or that you provide when you use our Services; (b) how we use, store, protect, and disclose that information; and (c) your rights and choices regarding your information.

This Policy applies to information we collect through:

• Our website at https://bottlebluellc.com (the "Website");
• Our mobile application(s) ("Mobile App");
• Our newsletters and email communications;
• Our software products, APIs, and data services (collectively, "Services");
• Any interactive features, tools, or AI-powered features on or through the foregoing platforms.

This Policy does not apply to:

• Information collected offline or through any channels not listed above;
• Information related to employment or job applications;
• Information collected by third parties whose websites or services you access through links on our platforms, those third parties govern their own data practices.

Please read this Policy carefully. By accessing or using our Services, you agree to the data practices described herein. If you do not agree, please do not use our Services. If you have any questions, see Section 16.

This Policy is incorporated into and governed by our Terms of Use. Capitalized terms not defined here have the meanings given in the Terms of Use.

2. Children's Privacy

Our Services are not directed to, and we do not knowingly collect personal information from, children under 18 years of age. If you are under 18, do not use our Services, create an account, make a purchase, or submit any information about yourself.

If we learn that we have inadvertently collected personal information from a child under 18 without verifiable parental consent, we will promptly delete such information. If you believe we may have information from or about a child under 18, please contact us immediately at support@bottlebluellc.com.

Our Services are for adults. We offer no feature intended for children, and we do not knowingly collect information from anyone under 18. We do not currently verify age at signup. If you are a parent or guardian and believe a child has created an account, write to support@bottlebluellc.com and we will close it and delete the information.

3. Information We Collect

Throughout this Policy, "Personal Information" (or "Personal Data") means any information that identifies, relates to, describes, references, or could reasonably be linked, directly or indirectly, to a particular individual or household. It does not include de-identified, anonymized, or aggregated information that cannot be linked back to an individual.

3.1 Information You Provide Directly

We collect information you provide when you:

• Create or register an account (name, username or alias, email address, password);
• Make a purchase or subscribe (billing address, ZIP/postal code, payment method, processed directly by Stripe; we do not store full card numbers);
• Contact us or submit support requests (name, email, and content of your message);
• Subscribe to our newsletter;
• Respond to surveys or participate in research;
• Submit User Content, prompts, feedback, or other inputs to AI or interactive features;
• Apply for API or developer access (company name, use case description, contact details).

3.2 Information Collected Automatically

When you interact with our Services, we automatically collect certain technical and usage data, including:

• Device and Technical Data: IP address, device type, operating system and version, browser type and version, device identifiers, and mobile carrier;
• Usage Data: Pages or features viewed, time spent, clicks, search queries, referring and exit URLs, date and time of visits, features used, and interaction events;
• Log Data: Server logs including IP addresses, request timestamps, HTTP status codes, and error information;
• Location Data: Approximate geographic location derived from your IP address (city/region level). We do not collect precise GPS location unless you explicitly grant permission in a Mobile App;
• Local Storage: Your sign-in session, stored in your browser. We set no cookies. See Section 7 below.

3.3 Information from Third-Party Sources

We may receive information about you from third parties, including:

• Payment processors (Stripe): Transaction confirmations, payment status, fraud signals. See the Stripe Privacy Policy;
• Authentication providers: If you use single sign-on (SSO) or third-party login (e.g., Google OAuth), we receive profile information permitted by your settings with that provider;
• Publicly available sources: Publicly accessible professional profiles or business contact information in connection with business-to-business outreach.

3.4 Information You Create Inside Our Products

Our products exist to store things for you, so most of what we hold is what you put there. Depending on which products you use, this includes:

• Apparatus Ready: training entries (the CPAT event, how long you trained, and any note you type), gear checklist items and their status, practice question answers, practice and simulation exam results, streaks, and personal records;
• Trackless: asset records, checkout and maintenance history, reservations, work orders, and notes;
• PocketQuant: budget categories, expenses, recurring bills, and saved searches;
• Aqua Botany: plants, devices, automation settings, and readings reported by sensors you connect;
• All products: notes, lists, tasks, and links between items.

We use this information to provide the product to you, to show you your own history and progress, and to keep the service working. We do not use it for advertising and we do not sell it.

4. Sensitive Personal Information

We do not collect government identification numbers, precise GPS location, racial or ethnic origin, religious or philosophical beliefs, genetic or biometric data, sexual orientation, immigration status, or financial account credentials. If you voluntarily put information like that into your own notes or into a support message, we will treat it with care, but we cannot always separate it from the rest of what you give us. Please do not submit sensitive information you do not need to.

If you voluntarily include sensitive information in User Content or support communications, we will treat it with appropriate care but cannot always segregate it from other data you provide. Please avoid submitting sensitive personal information unnecessarily.

We do not use sensitive personal information to infer characteristics about you, and we do not carry out targeted advertising at all.

4.1 Training Information

Apparatus Ready records the training you log. In ordinary language that is health information, and we treat it that way, so we want to be plain about it:

• What we collect: the CPAT event you trained, how long you trained, and any note you type, plus the date and time. We collect no body measurements, no weight, no heart rate, and nothing from wearables or health apps. We do not read your device's health data;
• Why: so you can see your own history, streaks, and progress. That is the entire purpose;
• Who sees it: you. We do not share it with employers, departments, examining bodies, insurers, or advertisers, and we do not sell it;
• How long: for as long as your account exists. It is deleted when you delete it or close your account.

We are not a healthcare provider, a health plan, or a healthcare clearinghouse, and we are not a business associate of one. The Health Insurance Portability and Accountability Act (HIPAA) does not apply to what you record here, and nothing in our Services is a medical record.

If you need your training recorded for an employer, a department, or a medical purpose, keep that record with them and not only here.

5. How We Use Your Information

We use the information we collect for the following purposes:

5.1 Service Delivery and Operations

• To create, maintain, and manage your account and subscriptions;
• To process transactions and fulfill orders;
• To provide, personalize, and improve the Services and their features;
• To authenticate your identity and maintain security;
• To provide technical support and respond to inquiries.

5.2 Communications

• To send transactional and operational notices (billing receipts, renewal notices, security alerts, policy updates);
• To send newsletters and marketing communications about our products and services, where you have opted in or where we have a legitimate interest to do so under applicable law;
• To respond to your questions, comments, and requests.

5.3 Product Development and Research

• For internal analytics, testing, research, and product development;
• To debug, identify errors, and improve existing features;
• To evaluate the effectiveness of our marketing campaigns;
• To develop new products, features, and services.

5.4 Legal and Compliance

• To comply with applicable laws, regulations, legal processes, and government requests;
• To enforce our Terms of Use and other agreements;
• To protect the rights, property, or safety of Bottle Blue LLC, our users, or others;
• To detect, investigate, and prevent fraud, abuse, or security incidents.

5.5 Legal Bases (for EEA/UK/Swiss Users)

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR and applicable implementing legislation:

• Performance of a contract: to deliver the Services you have requested;
• Legitimate interests: for security, fraud prevention, internal analytics, and direct marketing to existing customers (where our interests are not overridden by your rights);
• Compliance with a legal obligation: to comply with applicable laws and regulations;
• Consent: for optional features such as marketing emails, where consent is required by law. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Disclosure and Sharing of Your Information

We do not sell, rent, or lease your personal information to third parties for their own independent marketing or advertising purposes. We may disclose your personal information in the following circumstances:

6.1 Service Providers and Processors

We share information with third-party vendors and service providers that perform services on our behalf, including:

• Payment processing: Stripe, Inc. - stripe.com/privacy
• AI processing: some of our internal and non-account services use OpenAI (openai.com/privacy) and Anthropic (anthropic.com/privacy) to generate text, under API terms that do not permit use of inputs to train their general-purpose models. No product feature available to account holders sends your content to an AI provider. If we add one, we will say so here and at the point of use before it processes anything of yours;
• Cloud hosting and infrastructure: Amazon Web Services and other providers who store data on our behalf under contractual data processing agreements;
• Email: Amazon SES delivers our outbound mail. Mail you send to our support address is received through Google Workspace before it reaches us;
• Customer support tools: Platforms used to manage support tickets and communications.

All service providers are contractually required to process personal information only on our behalf, in accordance with our instructions, and with appropriate data protection safeguards in place.

6.2 Business Transfers

In the event of a merger, acquisition, asset sale, financing, reorganization, bankruptcy, or other corporate transaction, your personal information may be transferred to the relevant successor entity. We will use reasonable efforts to notify you of such a transfer and to describe any material changes to data practices via this Policy or email.

6.3 Legal Requirements and Protection

We may disclose your personal information when we believe in good faith that disclosure is:

• Required by applicable law, regulation, court order, or governmental or regulatory request;
• Necessary to enforce our Terms of Use or other agreements;
• Necessary to protect the rights, property, or personal safety of Bottle Blue LLC, our users, or the public;
• Necessary to detect, prevent, or address fraud, security incidents, or technical issues.

6.4 With Your Consent

We may share your information with other third parties with your prior consent, including when you authorize integrations with third-party platforms.

6.5 Aggregated and De-identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be linked back to you with third parties for research, analytics, marketing, or other purposes.

7. Cookies, Local Storage, and Tracking

7.1 Cookies and Local Storage

Our Services set no cookies. When you sign in, we keep your session in your browser's local storage so that you stay signed in, and we clear it when you sign out.

We use no tracking pixels, no tag managers, no session recording, and no third-party analytics or advertising technology of any kind. Nothing on our Services follows you to any other website.

7.2 Managing Local Storage

Because we set no cookies, there is no cookie banner and no preference center to configure. You can clear the sign-in session we store at any time by signing out, or by clearing site data for our domains in your browser settings. Doing so signs you out and does not otherwise affect the Services.

7.3 Global Privacy Control

We honor the Global Privacy Control ("GPC") signal. If your browser or device transmits a GPC opt-out signal, we will treat it as a request to opt out of the sale and sharing of your personal information for cross-context behavioral advertising, consistent with the requirements of the California Privacy Rights Act ("CPRA") and other applicable laws.

7.4 Do Not Track

Some browsers send a "Do Not Track" (DNT) signal. At this time, there is no uniform industry standard for responding to DNT signals; we do not currently alter data collection practices in response to DNT signals. However, we do honor GPC as described above.

8. We Do Not Sell or Share Your Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California and other state privacy laws. We run no advertising on our Services, we use no advertising networks, and we load no advertising or cross-site tracking technology.

We honor the Global Privacy Control signal (see Section 7.3). If the law of your state gives you an opt-out right, you may exercise it by emailing support@bottlebluellc.com, and we will not treat you differently for doing so.

9. Automated Decision-Making and AI Processing

9.1 Automated Processing

We may use automated systems, algorithms, and artificial intelligence tools to process your data for purposes such as fraud detection, security screening, content personalization, usage analytics, and AI-powered feature delivery.

9.2 No Solely Automated Decisions with Significant Legal Effects

We do not make decisions that produce legally significant or similarly significant effects on you based solely on automated processing, without human review, unless you have explicitly consented or such processing is required by law. If we implement such processing in the future, we will update this Policy and provide appropriate disclosure.

9.3 AI Feature Inputs

No product feature available to account holders currently sends your content to an AI provider. Where an internal or non-account service does use the providers identified in Section 6.1, it operates under confidentiality and data processing agreements, we do not use identifiable prompts or inputs to train general-purpose AI models, and prompts and results are retained for the period stated in Section 10 and then deleted. If we add an AI feature to a product, we will update this Policy and tell you at the point of use before it processes anything of yours.

9.4 Profiling

We may create aggregate usage profiles or personas to understand how groups of users interact with our Services. These are used to improve product design and are not used to make individual decisions about you without human involvement.

If you are located in the EEA, UK, or a US state that grants rights related to profiling (see Section 11), you may have the right to opt out of or object to certain profiling activities.

10. Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying legal, regulatory, accounting, or reporting requirements. The criteria we use to determine retention periods include:

When the applicable retention period expires, we securely delete or anonymize personal information. In some cases, we may retain data longer if required by a legal hold, ongoing litigation, regulatory investigation, or to comply with a specific legal obligation.

You may request earlier deletion of your personal information as described in Section 11. Certain data cannot be deleted if retention is required by law (e.g., financial records) or if deletion would impair our legitimate legal interests.

11. Your Privacy Rights by Jurisdiction

Depending on where you reside, you may have specific rights regarding your personal information. We honor all rights that apply to you under applicable law. To exercise any right, see Section 16.

11.1 Rights Available to All Users

Regardless of location, all users may:

• Access or correct personal information held in their account via account settings or by contacting us;
• Opt out of marketing emails via the unsubscribe link in any marketing email or by contacting us;
• Get a copy of your data, or have it deleted (subject to legal retention obligations). Write to support@bottlebluellc.com and we will export or permanently delete everything we hold for you. We are working on making both available directly in your account settings.

Two things are separate from deletion, and you may need to ask for them as well:

• Billing. Cancel your subscription first. Deleting your data does not cancel a paid subscription, and Stripe keeps payment records it is legally required to keep;
• Your sign-in account. Deleting your data empties your account but does not by itself remove your sign-in identity and email address. Ask us in the same message and we will remove that too.

11.2 California Residents (CPRA / CCPA)

California residents have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, our business or commercial purposes for collecting or sharing it, and the categories of third parties with whom we share it;
• Right to Delete: Request deletion of personal information we have collected from you, subject to certain exceptions;
• Right to Correct: Request correction of inaccurate personal information;
• Right to Opt Out: Opt out of the sale or sharing of your personal information (see Section 8);
• Right to Limit Use of Sensitive Personal Information: Limit our use of sensitive personal information to purposes necessary for providing the Services;
• Right to Data Portability: Receive a copy of your personal information in a portable format;
• Right to Non-Discrimination: We will not discriminate against you for exercising your CPRA rights.

To submit a verifiable consumer request, contact us as described in Section 16. We will verify your identity before fulfilling requests. You may designate an authorized agent to make requests on your behalf.

Categories of personal information collected in the past 12 months include: identifiers; commercial information; internet or other network activity information; geolocation data (approximate); inferences drawn from the above; and professional or employment-related information (for business customers). We have not sold personal information as defined under CCPA/CPRA and have not disclosed personal information for cross-context behavioral advertising.

11.3 Residents of Other U.S. States

Residents of the following states have privacy rights under their respective state laws. Where applicable, those rights include rights to access, correct, delete, and obtain a portable copy of personal data, to opt out of targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects, and to appeal our decisions:

• Virginia (Consumer Data Protection Act, VCDPA)
• Colorado (Colorado Privacy Act, CPA)
• Connecticut (Connecticut Data Privacy Act, CTDPA)
• Texas (Texas Data Privacy and Security Act, TDPSA)
• Montana (Montana Consumer Data Privacy Act)
• Oregon (Oregon Consumer Privacy Act)
• Iowa (Iowa Consumer Data Protection Act)
• Indiana (Indiana Consumer Data Protection Act)
• Tennessee (Tennessee Information Protection Act)
• Delaware (Delaware Personal Data Privacy Act)
• New Hampshire (New Hampshire Privacy Act)
• New Jersey (New Jersey Data Privacy Act)
• Kentucky (Kentucky Consumer Data Protection Act)
• Nebraska (Nebraska Data Privacy Act)
• Minnesota (Minnesota Consumer Data Privacy Act)
• Maryland (Maryland Online Data Privacy Act)
• Rhode Island (Rhode Island Data Transparency and Privacy Protection Act)
• And any additional states that enact comprehensive privacy legislation effective as of the date you use our Services.

We honor all rights granted to you under the law of your state of residence. To exercise your rights, contact us as described in Section 16. We will respond within the timeframe required by applicable law (generally 45 days, with a possible 45-day extension for complex requests). If we deny your request, you may have the right to appeal; we will describe the appeal process in our denial notice.

11.4 EEA, UK, and Swiss Residents: GDPR and UK GDPR

If you are located in the European Economic Area ("EEA"), the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and/or the UK GDPR, as applicable:

• Right of Access (Art. 15 GDPR): Obtain confirmation of whether we process your personal data and receive a copy;
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data;
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations;
• Right to Restriction of Processing (Art. 18): Request that we restrict processing of your personal data in certain circumstances;
• Right to Data Portability (Art. 20): Receive personal data you provided to us in a structured, machine-readable format;
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes;
• Rights related to automated decision-making (Art. 22): Not be subject to solely automated decisions that significantly affect you, and to request human review;
• Right to Withdraw Consent: Where processing is based on consent, withdraw at any time without affecting prior processing.

Our data controller contact for GDPR purposes is: Bottle Blue LLC, 415 3rd Street SW, Montgomery, MN 56059, USA | support@bottlebluellc.com.

You have the right to lodge a complaint with your local supervisory authority. In the EU, this is the data protection authority in your member state. In the UK, this is the Information Commissioner's Office (ICO): ico.org.uk.

11.5 Canadian Residents: PIPEDA / Bill C-27

Canadian residents may have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) or applicable provincial privacy legislation, including rights to access and correct personal information we hold about you. Contact us at support@bottlebluellc.com to submit a request.

12. Data Security

We implement administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, alteration, disclosure, and destruction. Our security measures include:

• Encryption of data in transit using TLS/SSL protocols;
• Encryption of sensitive data at rest;
• Access controls limited to personnel with a need-to-know basis;
• Regular security assessments and vulnerability monitoring;
• Incident response procedures designed to detect, investigate, contain, and remediate security events;
• Payment card data is processed exclusively by PCI-DSS compliant third-party payment processors; we do not store raw card numbers.

Despite our efforts, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. You are also responsible for maintaining the security of your account credentials (see our Terms of Use, Section 5).

Data Breach Notification: In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected individuals and applicable regulatory authorities as required by law (e.g., within 72 hours under GDPR, or within applicable state law timeframes in the U.S.). Notifications will include the nature of the breach, categories and approximate number of individuals affected, likely consequences, and steps we are taking to address it.

If you discover or suspect any security vulnerability or breach involving our Services, please report it promptly to support@bottlebluellc.com.

13. International Data Transfers

Bottle Blue LLC is based in the United States. If you are located outside the United States, please be aware that information we collect about you will be transferred to and processed in the United States, which may not provide a level of data protection equivalent to your home country's laws.

For transfers of personal data from the EEA, UK, or Switzerland to the United States, we rely on the following lawful transfer mechanisms as applicable:

• Standard Contractual Clauses (SCCs) approved by the European Commission, and the UK's International Data Transfer Addendum (IDTA);
• Adequacy decisions, where applicable;
• Your explicit consent, where other mechanisms are not available and you have been informed of the risks.

We update our transfer mechanisms as required when regulatory frameworks change. To obtain a copy of the safeguards applicable to your personal data transfer, contact us at support@bottlebluellc.com.

Your personal data may also be processed in other countries where our service providers operate. We require all processors to adhere to appropriate data protection standards via contractual data processing agreements.

14. Third-Party Links and Services

Our Services may contain links to third-party websites, applications, and services. This Policy does not apply to third-party platforms, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you access through our platforms.

When you connect third-party integrations or extensions to our Services, those third parties may independently collect data about you subject to their own privacy policies.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other reasons. When we make changes, we will update the "Last Modified" date at the top of this page.

For material changes, meaning changes that affect how we collect, use, or share your personal information in ways you would not reasonably expect based on this Policy, we will provide advance notice by: (a) posting a notice on our Website or in the Mobile App; and/or (b) sending an email to the address associated with your account, where required by law.

Your continued use of our Services following the posting of any changes to this Policy constitutes your acceptance of those changes. If you do not accept the revised Policy, you must discontinue use of the Services.

We maintain an archive of prior versions of this Policy. To request a prior version, contact us at support@bottlebluellc.com.

16. Contact Us and How to Exercise Your Rights

If you have any questions, concerns, or complaints about this Privacy Policy, our data practices, or our handling of your personal information, or if you wish to exercise any privacy rights described in this Policy, please contact us at:

Bottle Blue LLC
Attn: Privacy & Data
415 3rd Street SW
Montgomery, MN 56059
United States
Email: support@bottlebluellc.com
Website: https://bottlebluellc.com

Our only official email addresses are no-reply@bottlebluellc.com and support@bottlebluellc.com. Email about Bottle Blue LLC from any other address is not from us.

When submitting a privacy rights request, please include your full name and email address associated with your account, the right you wish to exercise, and a description of your request. We will verify your identity before processing requests involving personal data access, correction, deletion, or portability.

We will acknowledge receipt of your request within five (5) business days and respond substantively within the timeframe required by applicable law (typically 30 to 45 days). If we need additional time, we will notify you and explain the reason.

For verifiable requests from authorized agents (California and other applicable states), the agent must provide written authorization from you, and we may separately verify your identity directly with you.

EEA/UK/Swiss Supervisory Authorities: If you are not satisfied with our response, you have the right to lodge a complaint with the data protection authority in your country or region of residence.