Privacy Policy

Busutto ("we", "us", "our") operates the Busutto website (busutto.com) and the Busutto mobile application. This Privacy Policy describes how we collect, use, share, and protect your personal information when you visit our website, make a purchase, or use our app.

By using our services, you agree to the practices described in this policy.

1. Information We Collect

Information you provide

We collect account details (email address, or sign-in via Apple or Google), hydration intake logs and preferences, order information (name, email, shipping and billing address, payment details) when purchasing through our website, and support communications.

Health and fitness data (with your permission)

With your permission, we access data via Apple HealthKit, including activity metrics, biometric data, and workout history. We also collect fitness activity data from connected services such as Strava, and calendar data from connected services such as Google Calendar. We write hydration data back to Apple Health with your permission.

Information collected automatically

We automatically collect device identifiers for Bluetooth connectivity with Busutto hardware, push notification tokens, and local weather conditions for environmental hydration adjustments (we do not store your location). On our website, we collect device information (IP address, browser type, time zone, operating system, referring URLs, and how you interact with the site) and use cookies (necessary and marketing, with your consent).

2. How We Use Your Information

We use your information to provide and personalise the hydration tracking service, calculate daily hydration targets based on your activity, health data, and environment, sync data across your devices, and deliver push notifications you have opted into. We also use it to process purchases and manage subscriptions, fulfil and ship product orders, screen orders for potential risk or fraud, and improve our services and resolve issues.

We do not use your health data for advertising. We do not sell your personal data to third parties.

3. How We Share Your Information

We share your information only with service providers necessary to operate our services:

• Google Firebase — app infrastructure, authentication, and data storage (EU). Firebase Privacy
• RevenueCat — subscription and purchase management (US)
• Apple HealthKit — health and fitness data integration (on-device)
• Strava — fitness activity integration (US). Strava data is displayed only to the authenticated user, is not used for AI/ML purposes, and is not sold or transferred to third parties. Raw Strava activity data is automatically deleted after 7 days. When you disconnect Strava, all stored Strava data is deleted immediately.
• PostHog — product analytics (EU). PostHog Privacy
• Apple WeatherKit — weather data (Apple servers)
• Firebase Cloud Messaging — push notification delivery (Google servers)
• Shopify — website e-commerce and payment processing (Canada/US). Shopify Privacy
• Meta Pixel (ID: 110950505176072) — website ad performance measurement, with cookie consent (US)

We do not share your personal data with any additional third parties. We will not share your personal information with other companies for their marketing purposes.

We may share information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request, or to otherwise protect our rights.

4. Data Storage and Security

App data is stored in Google Firebase, hosted in the United Kingdom (europe-west1 region). Website and order data is processed by Shopify and may be transferred to Canada and the United States. For more information on Shopify's data handling practices, see Shopify's GDPR Whitepaper.

All data is encrypted at rest and in transit. Access to your app data is restricted to your authenticated account, and security rules prevent users from accessing other users' data. Sensitive credentials (e.g. third-party OAuth tokens) are stored in Apple Keychain on your device and in server-only storage inaccessible to the app client.

5. Data Retention

Account data and hydration logs are retained while your account is active, and deleted upon account deletion. Raw data from connected fitness services is automatically deleted after 7 days, though derived calculations are retained. Push notification tokens are removed when they become invalid.

After account deletion, anonymised transaction records (transaction IDs, subscription dates, purchase status) are retained for tax and legal obligations. These records contain no personally identifiable information. Website order data is retained as required for tax, legal, and shipping obligations unless you request erasure.

6. Cookies

When you first visit our website, a banner asks for your consent before any marketing cookies are set.

Necessary cookies

These cookies are required for the site to function and are set by our platform provider, Shopify. They cannot be disabled.

Marketing & measurement cookies

These cookies are only set if you give consent via our cookie banner. We use the Meta Pixel to measure how visitors interact with our site and to optimise our advertising on Meta platforms (Facebook and Instagram).

When you consent, the Meta Pixel sends page view and signup events to Meta. This data is used to measure ad performance, track signups, and build audiences of similar potential customers. Meta may also process this data under their own Data Policy. You can manage your Meta ad preferences at Facebook Ad Settings.

We do not use Google Analytics, Bing, or any other third-party advertising platforms on our website.

Managing cookies

You can change your cookie preferences at any time by clearing your browser's local storage for busutto.com, which will cause the consent banner to reappear. You can also block or delete cookies through your browser settings. See allaboutcookies.org for instructions specific to your browser.

7. Do Not Track

We do not currently respond to "Do Not Track" or "Global Privacy Control" browser signals.

8. Apple HealthKit

Our use of HealthKit data:

• We do not use HealthKit data for advertising, marketing, or data mining purposes, including by third parties.
• We do not sell HealthKit data to third parties or data brokers.
• We do not share HealthKit data with third parties except where you have given explicit permission and the third party provides a health or fitness service to you.
• We do not use HealthKit data for purposes unrelated to health and fitness.
• We do not store HealthKit data in iCloud.
• We do not write false or inaccurate data to HealthKit.
• We do not serve targeted or behavioural advertising based on sensitive health data.

9. Your Rights

EEA and UK (GDPR)

We process your data under the following legal bases:

• Consent — health data, connected services, marketing cookies
• Contract — account and order fulfilment
• Legitimate interest — security and service improvement
• Legal obligation — tax and regulatory compliance

You may withdraw consent at any time for optional integrations (HealthKit, Strava) through the App or your device settings.

Your personal information is stored in the United Kingdom (Google Firebase, europe-west1 region). If you are located outside the UK (including in the United States), your data is transferred to and stored in the UK.

You may request access to, correction of, or deletion of your personal data by contacting us at team@busutto.com. We will provide a copy of your data on request. You can also delete your account and data immediately using the in-app deletion feature (Settings > Delete Account).

Consumer health data

We do not sell your personal information. We do not share your personal information for advertising.

Hydration data, fitness activity data, and related wellness information may constitute "consumer health data" under certain state laws. We maintain a separate Consumer Health Data Privacy Policy at busutto.com/pages/consumer-health-data. That policy describes how we collect, use, and share this data and what rights you can exercise regarding it.

10. Account Deletion

You can delete your account and all associated data at any time:

• In the app: Settings > Delete Account
• By email: team@busutto.com

Upon deletion, we remove all personal data, hydration logs, health data, connected service authorisations, and notification registrations. We also revoke access on connected third-party services. Anonymised financial records are retained as described in Section 5.

11. Children's Privacy

Our services are not directed at children under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us and we will delete it promptly.

12. SMS Communications

For any questions about SMS marketing, transactional text messages, or to opt out, please contact us at team@busutto.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. For material changes affecting health data, we will notify you in the app.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights:

Busutto Ltd
Irish Square, Upper Denbigh Road, St Asaph, Denbighshire, LL17 0RN
Email: team@busutto.com

Last updated: June 2026