Privacy Policy

Who we are

MyTradeBuddy, a product of Beluga AI Ltd, provides AI-powered growth tools (AI receptionist, quoting, email support, live chat with outbound calling, paid ads with AI lead qualification, and a Google review agent) for trade businesses such as plumbers, roofers, electricians, builders, and HVAC engineers.

The data controller is Beluga AI Ltd, a company registered in Scotland (Company No. SC870584) with its registered office at 3/2, 17 Stewartville Street, Glasgow, G11 5HR.

You can contact us about this policy at info@mytradebuddy.co.

Our two roles: controller and processor

We act in two different capacities depending on whose data is involved.

• Controller — for our own business contacts: people who visit tradebuddy.co, sign up for an account, submit a contact form, or correspond with us.
• Processor — for the end customers and leads that our trade business customers capture using the Service. In that case the trade business is the controller and we process the data on their instructions under our Data Processing Agreement.

Information we collect

When you interact with us directly as a prospect, customer, or visitor we may collect:

• Account & contact details: name, business name, email, phone number, billing address.
• Lead form submissions: details you provide via our pricing, booking, and enquiry forms.
• Billing data: processed by Stripe; we do not store full card numbers.
• Usage & device data: IP address, browser type, pages visited, referrer, and analytics events. On this marketing site we use Google Analytics and advertising pixels (with your consent via the cookie banner); in the dashboard we use PostHog (EU-hosted) for product analytics and Sentry for error monitoring.
• Communications: calls, emails, chat messages, and support tickets you exchange with us.

When we provide the Service to a trade business we also process Customer Personal Data — including names, phone numbers, email addresses, call audio, transcripts, calendar availability, message content, and quote requests — on that business's behalf. This is governed by our DPA.

How we use information (as controller)

We use information about you for the following purposes and lawful bases:

• Provide and improve the Service, manage your account, and deliver support (contract).
• Process payments and prevent fraud (contract / legitimate interests).
• Respond to enquiries from our marketing site (legitimate interests / consent where required).
• Send service emails and, where you opt in, marketing communications (consent).
• Measure and improve our marketing and product experience (consent for non-essential analytics).
• Comply with legal obligations and defend legal claims (legal obligation / legitimate interests).

Sharing your information

We do not sell your personal information. We share it only as needed with:

• Service providers acting as our processors (hosting, AI model providers, telephony, email, analytics, payments).
• Professional advisers (lawyers, auditors, accountants) under duties of confidentiality.
• Authorities where required by law or to protect rights, property, or safety.
• A successor in interest in connection with a merger, acquisition, or restructuring — with notice to you.

International transfers

Some of our service providers are based outside the UK and EEA. Where data is transferred we rely on UK adequacy regulations, the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or another lawful safeguard.

Data retention

We keep personal information only for as long as needed for the purposes set out above, to meet legal, accounting, or reporting obligations, or to resolve disputes. Typical retention:

• Account data: while your account is active and up to 7 years after for tax records.
• Marketing leads: up to 24 months from your last interaction, unless you ask us to delete sooner.
• Call audio & transcripts processed for trade business customers: in line with the controller's instructions in the DPA.
• Analytics: aggregated and anonymised where possible; identifiable analytics retained no longer than 26 months.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data deleted, subject to legal exceptions.
• Restrict or object to processing in certain circumstances.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time for processing based on consent.
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk).

To exercise these rights email info@mytradebuddy.co. We respond within 30 days and may need to verify your identity first. If your request relates to data captured by a trade business using the Service, we will route the request to that business.

Security

We implement industry-standard technical and organisational measures to protect personal information, including encryption in transit and at rest, access controls, logging, and staff training — set out in full on our Security page. No system is 100% secure; we will notify you and the ICO of personal data breaches as required by law.

Cookies

We use cookies and similar technologies as described in our Cookie Policy. You can manage your choices via the cookie banner.

AI processing

Our Service uses AI models from providers such as OpenAI and Anthropic, and AI voice calls are orchestrated through voice platforms such as Vapi (which handles call audio, recordings, and transcription). Where personal information is sent to these providers it is processed under data processing agreements and is not used to train their public models unless we tell you otherwise. Callers interacting with our AI receptionist are informed they are speaking with an AI assistant.

Google user data

If you connect a Google account, we read your calendar availability and create or update the appointments we book on your behalf. We also record the email address of the account you connected, so the dashboard can show you which account is linked. We use that data only to run the scheduling features you asked for: we do not sell or rent it, we do not use it for advertising, and we do not use it to train AI models. The connection is stored securely and you can end it at any time from your dashboard or from your Google account's third-party access settings — we delete it when you disconnect, and when you close your account.

Children

The Service is designed for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. Where changes are material, we will tell you directly by email or via the dashboard rather than relying on you to re-read this page.

Complaints

If you are unhappy with how we have handled your personal data, email info@mytradebuddy.co with the subject line "Data Protection Complaint". We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, though we would welcome the chance to resolve your concern first.

Contact

For privacy questions, data subject requests, or to report a concern, email info@mytradebuddy.co with the subject line "Privacy Request".