Privacy Policy

Information we collect

What you give us. Your name, phone number, and email address. Order details. Pickup or delivery information, including your full delivery address if you order delivery. Your social handle if you message us there. And the content of what you send us — messages, photos, and voice messages.

What we collect automatically. Basic technical information about the device and browser you use, how you move through this website, and operational records our systems generate while handling your order (for example, that a confirmation email was sent, or that an error occurred). When you open a payment link the business sent you, we note the time and whether it was on a phone or a computer, so the business knows you saw it.

Payment details. Card numbers are entered directly with Stripe and never reach our systems. We keep a record that a payment happened, the amount, and Stripe’s reference for it.

Identity documents, only where the business needs them. Some businesses on this platform — vehicle rental, for example — need to verify who you are before handing something over. If that applies, you may be asked to upload a driver’s licence or an insurance document. Those files are encrypted where they are stored, are only viewable by the business, and are automatically deleted 90 days after the rental is complete.

We do not ask for or collect Social Security numbers or bank account numbers.

How we use your information

We use the information you provide to:

• Process your order and send order updates and receipts.
• Send pickup and delivery notifications.
• Work out delivery distance and any delivery fee, for delivery orders.
• Respond to your questions and provide customer support.
• Recognise you as a returning customer so we do not ask for the same details twice.
• Detect and prevent fraud, spam, and abuse, and keep the service running.
• With your consent, send occasional promotions and updates.
• Meet our legal, tax, and accounting obligations.

We do not sell your personal information, and we do not share it with anyone for advertising.

The AI assistant

Messages you send us — over Instagram, by text, or by email — may be read and answered by an automated (AI) assistant. Someone from the Batterup team can step in at any time, and you can ask to speak to a person at any point. The assistant does not make final decisions about pricing, whether an order is accepted, or anything about your credit; a person at Batterup reviews and fulfils your order.

To do this, we send what you write, say, and send to outside AI companies — Anthropic and OpenAI. Here is exactly what reaches them, including the parts we cannot filter:

• Your typed messages go to Anthropic. Before they are sent, we automatically remove email addresses and phone numbers from the text. Some details are deliberately kept in, because the assistant needs them to help you: your name, your Instagram handle, and — if this business delivers — your delivery address.
• Photos and images you send go to Anthropic in full, exactly as you sent them. There is no reliable way to remove personal details from an image, so we do not claim to. If a photo shows your face, an address, a document, or anything else personal, that is what is sent.
• Voice messages are sent to OpenAI as recorded audio, to be turned into text. Audio cannot be filtered either — anything you say out loud, including personal details, is sent as spoken.
• Conversation text is also sent to OpenAI to build a private search index, so the assistant can remember what you told us before. Since September 25, 2026 we remove email addresses, phone numbers, and addresses from that text first. Conversations indexed before that date were sent without that step.

We do not send your information to these companies for advertising, and we do not ask them to use it to train their AI models. We can tell you how we have set our own systems up; we cannot make promises on their behalf about how long they keep what we send them. Under the standard terms these providers publish, information sent through their interfaces may be retained for a limited period for abuse monitoring, and we have not negotiated anything different.

SMS / text messaging

By providing your phone number you consent to receive SMS from Batterup. Message frequency varies. Msg & data rates may apply. Reply STOP to unsubscribe, HELP for help. Consent to receive text messages is not a condition of any purchase.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

All of the above categories exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties.

Payments

Orders and payments are processed securely through Stripe. Your card details are entered directly with Stripe and never touch Batterup’s systems. We do not store your full card number.

Companies that help us run this service

We do not sell your personal information and we do not share it for advertising. We do share it with the companies below, each of which performs a specific job for us and receives only what that job needs:

• Stripe — payments and refunds. Receives your name, email, and the amount.
• Supabase — the database and file storage where your customer record, orders, messages, and any photos or documents you send are kept.
• Anthropic — the AI assistant. Receives your message text with email addresses and phone numbers removed, and any image you send in full. See The AI assistant above.
• OpenAI — turns voice messages into text and builds the assistant’s search index. Receives your recorded audio and your conversation text.
• Meta (Instagram) — if you message us on Instagram, that conversation happens on Meta’s platform and Meta holds it too.
• Telnyx — sends and receives our text messages. Receives your phone number and the message content.
• Resend — sends our emails. Receives your name, email address, and order details.
• LocationIQ, US Census Bureau, and the OpenStreetMap Foundation (Nominatim) — for delivery orders only, we send your full delivery address to one of these address-lookup services to convert it into map coordinates and calculate distance and delivery fees. We try LocationIQ first, then the US Census Bureau’s public geocoder, then Nominatim. Nominatim is a free, volunteer-run public service based outside the United States, and we have no contract with it.
• Google — in two situations. If this business receives orders through a connected Gmail account, the emails you send it pass through Google. And if someone at the business opens a map of your delivery address from their order screen, that address is sent to Google to display the map.
• Sentry — receives automatic error reports when something in the service breaks. We filter contact details out of these reports before they are sent, but an error report can contain almost anything, so we cannot promise that filter catches everything.
• Better Stack — stores our operational logs, on servers in Germany. We remove contact details from log entries before they are sent. Logs are a filtered record, not a perfect one.
• Discord — carries the alerts that tell the business and Wavy Automations about new orders and problems that need a person. Those alerts can include your name and order details.
• Railway, Vercel, and Upstash — host and deliver this website and our systems, and hold data briefly in transit and in a short-lived cache (conversation data for roughly two hours).

This website also loads fonts from Google Fonts, which means your browser’s IP address is visible to Google when the page loads.

We may also disclose information where the law requires it, to protect our legal rights or someone’s safety, or in connection with a sale or transfer of the business.

Where your information is processed

Most of the companies listed above process your information in the United States. Two do not: Better Stack stores our operational logs in Germany, and OpenStreetMap processes delivery addresses outside the United States. We have confirmed the location for those two. For the rest, we rely on what those providers publish and have not independently verified which region our account sits in.

How long we keep your information

Some of this is deleted automatically on a schedule; some is not. We would rather tell you which is which than imply everything expires on its own.

• Your order history and customer record — including your name and contact details, and any photos you sent — kept for as long as the business you ordered from keeps using us. These are that business’s own records: the florist who made your bouquet last spring should still be able to look up what you ordered. They are deleted when you ask us to delete them, or when the business closes its account.
• The assistant’s memory about you — deleted automatically 180 days after your last activity. Conversation history — we keep your most recent 20 messages with each business so the assistant can pick up where you left off, and delete older messages automatically. Ask us and we will delete the rest.
• Identity documents for vehicle rental — deleted automatically 90 days after the rental is complete. These are the most sensitive thing we hold, so they get the shortest life.
• Government ID numbers collected for business filings (such as an SSN) — deleted within days, and never sent to an AI model.
• Technical and audit logs — deleted automatically after 365 days, except important security events, which we keep for up to 7 years. Scheduled-job logs are deleted after 30 days, and our record of which emails were sent, with a copy of each, after 730 days. Short-lived caches clear within hours.
• Order and payment records — kept for our tax and accounting obligations even after a deletion request, with your personal details removed from them.
• Text-message consent records (when and how you agreed) — kept as proof of your choice while you remain subscribed.
• Text-message opt-outs — kept permanently. If you reply STOP we have to remember that forever, otherwise deleting the record would sign you back up.

Your choices and privacy requests

You can stop text messages at any time by replying STOP, and stop marketing emails using the unsubscribe link in any of them.

To request a copy of the information we hold about you, or to ask us to delete it, use our privacy request form, or contact us using the details below. We will email you a link to confirm the request came from you before we act on it.

What a deletion request does, and what it does not do:

• If you messaged us on Instagram, include your Instagram handle on the form. Records linked only to that handle may not be found by an email address alone.
• We remove your personal details from your orders, but keep the order and payment record itself — with your details stripped out — because we are required to keep financial records.
• Photos and files you sent us are not removed automatically by this process. Tell us in your request or contact us directly and we will remove them by hand.
• A deletion applies to our own systems. It is not passed on to the companies listed above; their own retention schedules apply to any copy they hold.

Depending on where you live, you may also have the right to know what we have collected about you, to correct it, to limit how sensitive information is used, and not to be treated differently for exercising those rights. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of on that front.

Children

This service is not directed to children under 13, and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We update this policy when what we do changes — including when we start using a new company to help run the service. When we do, we update the “Last updated” date at the top of this page.

Contact us

If you have any questions about this Privacy Policy or your information, you can reach Batterup by replying to any message or notification we send you, or by contacting us through this website. For requests about your data, the privacy request form is the fastest route.