Privacy Policy

Who we are

Beluga AI Ltd is the data controller for personal information collected through our websites and as part of our direct business relationships. Our trading brands include Agent Beluga (autonomous AI agent platform) and mytradebuddy (AI-powered growth tools for UK trade businesses).

You can reach our privacy team at support@agentbeluga.com with the subject line "Privacy Request".

Our two roles: controller and processor

We operate in two different capacities depending on whose data is involved:

• Controller — for our own visitors, prospects, and customers (people who visit our sites, sign up for an account, book a demo, or correspond with us).
• Processor — for the end customers, leads, employees, and contacts that our business customers handle using our platforms (for example AI receptionist callers, lead form respondents, chatbot users). In those cases the business is the controller and we process the data on their instructions under our Data Processing Agreement.

Information we collect

When you interact with us directly, we may collect:

• Account & contact details — name, business name, email, phone number, role, billing address.
• Demo and lead form data — anything you provide through booking, contact, or onboarding forms on our marketing sites.
• Billing data — processed by Stripe; we never store full card numbers.
• Usage & device data — IP address, browser type, pages viewed, referrer, and analytics events.
• Communications — emails, support tickets, chat messages, and call recordings exchanged with us.

When we provide the platform to a customer we also process Customer Personal Data — names, phone numbers, email addresses, message content, call audio, transcripts, calendar data, lead form submissions, and metadata — on their behalf. This is governed by our DPA.

How we use information (as controller)

We use information about you for the following purposes and lawful bases under UK GDPR Art. 6:

• Provide, operate, and improve our platforms and respond to support requests (contract).
• Process payments, prevent fraud, and protect against abuse (contract / legitimate interests).
• Respond to enquiries from our marketing sites (legitimate interests / consent where required).
• Send service notifications and, where you opt in, marketing communications (consent).
• Measure product and marketing performance via analytics (consent for non-essential analytics).
• Train and improve our own systems on aggregated, anonymised usage data (legitimate interests).
• Comply with legal obligations and defend legal claims (legal obligation / legitimate interests).

Sharing your information

We do not sell your personal information. We share it only as needed with:

• Service providers acting as our processors — hosting, AI model providers, telephony, email, analytics, payments. See our DPA for the categories.
• Professional advisers (lawyers, auditors, accountants) under confidentiality obligations.
• Public authorities where required by law or to protect rights, property, or safety.
• A successor in interest in connection with a merger, acquisition, or restructuring — with notice to you.

International transfers

Some of our service providers are based outside the UK and EEA. Where personal information is transferred internationally we rely on UK adequacy regulations, the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or another lawful safeguard. A copy of the relevant safeguards can be requested by email.

AI model processing

Our platforms send data to third-party AI providers (such as OpenAI and Anthropic) to generate responses, transcribe speech, and run agent workflows. These providers process personal data under data processing agreements that prohibit using your content to train their public models, unless you have separately opted in.

Data retention

We keep personal information only for as long as needed. Typical retention periods:

• Account data — while your subscription is active and up to 7 years after for tax records.
• Marketing leads — up to 24 months from your last interaction unless you ask us to delete sooner.
• Call audio & transcripts processed for customers — per the customer's instructions in the DPA.
• Analytics — aggregated and anonymised where possible; identifiable analytics retained no longer than 26 months.
• Security and audit logs — up to 12 months unless a longer period is required for investigation.

Your rights

Under UK GDPR and similar laws you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data deleted, subject to legal exceptions.
• Restrict or object to processing in certain circumstances.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time for processing based on consent.
• Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

To exercise these rights email support@agentbeluga.com. We respond within 30 days and may need to verify your identity first. If your request relates to data captured by one of our customers using the platform we will route the request to that customer as the controller.

Security

We implement industry-standard technical and organisational measures including encryption in transit and at rest, role-based access control, multi-factor authentication for staff, logging, monitoring, and regular backups. More detail is available on our Security page. We will notify affected users and supervisory authorities of personal data breaches as required by law.

Cookies

We use cookies and similar technologies as described in our Cookie Policy. You can manage your choices via the cookie banner.

Children

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date above and, where appropriate, communicated by email or in-product notice.

Contact

For privacy questions, data subject requests, or to report a concern, email support@agentbeluga.com with the subject line "Privacy Request".