Privacy Policy

This Privacy Policy explains how we process personal data of natural persons in connection with our website and the AI Scan service. We process personal data in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, the "GDPR") and with applicable national data protection law.

Note on scope: our mobile application Pulse: Community News is covered by a separate privacy notice made available in the app and on the app store listing. This Policy does not govern processing carried out through Pulse.

1. Who we are (controller)

1.1 Controller identification

The controller of your personal data is BottleCap SE, a European company (Societas Europaea), with registered office at Hugo Haase 2, 152 00 Prague, Czechia, company ID 23012854, registered in the Commercial Register maintained by the Municipal Court in Prague under file reference H 2731 (the "Company", "we" or "us").

1.2 Our services

We operate the website available at https://www.bottlecapai.com (the "Website") and the online service AI Scan available at https://scan.bottlecapai.com (the "AI Scan"), through which we analyse and report on the behaviour of AI/language models. Where we refer to "Services", we mean the Website and AI Scan together.

1.3 Contact and Data Protection Officer

You can contact us in any data protection matter at [email protected]. Our Data Protection Officer is David Pavlík, who can be contacted at [email protected].

2. Whose data and what data we process

2.1 Depending on how you interact with us, we process personal data of the following categories of data subjects:

• Visitors – persons who browse the Website or AI Scan without an account;

• Registered users – persons who create an account and use AI Scan;

• Business customers and prospects – representatives and contact persons of organisations that request an offer for, purchase or use AI Scan;

• Persons who contact us – anyone who reaches out by e-mail, web form or social media.

(addressed in this Policy as "you")

2.2 In that context we process the following categories of personal data. For AI Scan, the scope is set out below. For the Website we process your e-mail address if you give it to us (for example via a contact form or for the purposes of newsletter sending), the content and metadata of your messages with us and our support, and automatically collected usage data — IP address, browser type and version, the pages you visit, the date, time and time spent on the page, unique device identifiers and diagnostic data:

2.3 Identification and contact data: name and surname, business e-mail, the name of your organisation, and the names of the team members you add to your account;

2.4 Account and service data: login identifier, third-party login identifiers (where you sign in via a third-party provider), account settings, and your token balance and usage;

2.5 Billing and transaction data: billing details, invoices, orders and payment records;

2.6 Payment data: card number and security code (CVC) are entered into and processed directly by our payment provider, Stripe, and are not stored on our servers;

2.7 Technical and usage data, collected automatically: IP address, approximate geolocation, date and time of access, the URLs and pages you visit, and information about your hardware and software (device, browser, operating system), together with cookie identifiers and log data;

2.8 Communications: the content and metadata of your messages with us and our support;

2.9 Marketing data: newsletter subscription status and preferences, and interactions with our communications.

2.10 AI Scan is designed to analyse LLMs, not to identify individuals nor intended to analyse or process personal data. If a business customer uploads or makes available personal data for scanning, we act as a processor on that customer's behalf and such processing is governed by a separate data processing agreement, not by this Policy.

2.11 We do not intentionally process special categories of personal data (Art. 9 GDPR) or personal data of children.

3. Purposes and legal basis

3.1 We process personal data for the purposes and on the legal basis set out below (Art. 6(1) GDPR):

3.2 Where we rely on consent, we process the data for the length of 5 years. You may withdraw the consent at any time with effect for the future by sending an e-mail to [email protected]. Where we rely on a legitimate interest, you may object under Art. 21 GDPR (see Article 8).

4. Cookies and similar technologies

4.1 The Website and AI Scan use cookies and similar technologies, including the PostHog product-analytics and session-replay toolset and Google Tag Manager. Non-essential (analytics, session-replay and marketing) technologies are only set with your prior consent and do not load before you consent. Details of each cookie, its purpose and duration, and how to manage your choices, are set out in our separate Cookies Policy.

5. Recipients and processors

5.1 We may share personal data with the following categories of recipients, who act as our processors under Art. 28 GDPR or as independent controllers where the law so provides:

5.2 Hosting and cloud infrastructure providers: Google Cloud (Google LLC) — AI Scan runs on Google Cloud Run, Cloud SQL and Cloud Storage;

5.3 Product analytics and session replay (AI Scan): PostHog (EU region); tag management: Google Tag Manager; website platform: Cloudflare;

5.4 Website analytics (bottlecapai.com): Google Analytics 4;

5.5 Content delivery and security: Cloudflare;

5.6 Logging and observability: BetterStack (application logs, which may include IP addresses);

5.7 E-mail and newsletter delivery: Resend;

5.8 Payment provider: Stripe (processing of card payments and billing);

5.9 Professional advisers (legal, accounting, audit) bound by confidentiality;

5.10 Public authorities and courts, where required by law.

5.11 You agree that we may authorize other processors to process personal data for the purposes stated above. We bind our processors by written agreements meeting the requirements of Art. 28 GDPR. We do not sell personal data.

6. Where we store your data and transfers to third countries

6.1 For AI Scan, personal data is stored on Google Cloud infrastructure located in the United States (region us-east4); product-analytics data collected via PostHog is processed in the European Union. Some Website providers (for example Google Analytics) may likewise process data outside the European Economic Area. Where we transfer personal data to a third country, in particular the United States, we ensure an adequate level of protection through one of the safeguards under Chapter V GDPR, in particular an adequacy decision or the European Commission's Standard Contractual Clauses, together with supplementary measures where appropriate.

7. How long we keep your data

7.1 We retain personal data only for as long as necessary for the purpose concerned, and thereafter for the period required to meet legal duties or to defend legal claims. Indicative periods:

7.2 Account and contract data: for the duration of your account / the agreement and for 3 months thereafter;

7.3 Accounting and tax documents: 10 years under applicable law;

7.4 Data needed in connection with a dispute or legal claim: until the relevant limitation periods expire, up to 15 years;

7.5 Support and communications: 6 months;

7.6 Cookie and analytics data: per the Cookies Policy.

8. Your rights

8.1 As a data subject you have the right, subject to the conditions in the GDPR, to:

• access your personal data and obtain a copy (Art. 15);

• rectification of inaccurate or incomplete data (Art. 16);

• erasure / to be forgotten (Art. 17);

• restriction of processing (Art. 18);

• data portability (Art. 20);

• object to processing based on legitimate interest, including direct marketing (Art. 21);

• withdraw consent at any time, without affecting prior lawful processing (Art. 7(3)).

8.2 To exercise your rights, contact us at [email protected]. We respond without undue delay and within one month. You also have the right to lodge a complaint with a supervisory authority, in particular the Office for Personal Data Protection of the Czech Republic, www.uoou.cz.

9. Automated decision-making and use of AI

9.1 We do not carry out automated individual decision-making, including profiling, that produces legal or similarly significant effects on you within the meaning of Art. 22 GDPR.

9.2 We do not use your personal data to train our own or third-party LLMs, and we do not input your personal data into generative AI tools, except as strictly necessary to provide the Services and on a lawful basis.

10. Security

10.1 We implement appropriate technical and organisational measures under Art. 32 GDPR to protect personal data against unauthorised access, alteration, loss or disclosure, including access controls, encryption in transit, logging, and staff confidentiality obligations.

11. Children

11.1 The Services are not directed to children. We do not knowingly process personal data of persons under 18 without the consent of a holder of parental responsibility.

12. Changes and effective date

12.1 We may update this Policy from time to time. The current version is always available on the Website. This Policy is effective from June 23, 2026.