Privacy Policy

Who we are

MyTradeBuddy, a product of Beluga AI Ltd, provides AI-powered growth tools (AI receptionist, quoting, email support, live chat with outbound calling, paid ads with AI lead qualification, and a Google review agent) for trade businesses such as plumbers, roofers, electricians, builders, and HVAC engineers.

The data controller is Beluga AI Ltd, a company registered in Scotland (Company No. SC870584) with its registered office at 3/2, 17 Stewartville Street, Glasgow, G11 5HR.

You can contact us about this policy at info@mytradebuddy.co.

Our two roles: controller and processor

We act in two different capacities depending on whose data is involved.

• Controller — for our own business contacts: people who visit tradebuddy.co, sign up for an account, submit a contact form, or correspond with us.
• Processor — for the end customers and leads that our trade business customers capture using the Service. In that case the trade business is the controller and we process the data on their instructions under our Data Processing Agreement.

Information we collect

When you interact with us directly as a prospect, customer, or visitor we may collect:

• Account & contact details: name, business name, email, phone number, billing address.
• Lead form submissions: details you provide via our pricing, booking, and enquiry forms.
• Billing data: processed by Stripe; we do not store full card numbers.
• Usage & device data: IP address, browser type, pages visited, referrer, and analytics events. On this marketing site we use Google Analytics and advertising pixels (with your consent via the cookie banner); in the dashboard we use PostHog (EU-hosted) for product analytics and Sentry for error monitoring.
• Communications: calls, emails, chat messages, and support tickets you exchange with us.

When we provide the Service to a trade business we also process Customer Personal Data — including names, phone numbers, email addresses, call audio, transcripts, calendar availability, message content, and quote requests — on that business's behalf. This is governed by our DPA.

How we use information (as controller)

We use information about you for the following purposes and lawful bases:

• Provide and improve the Service, manage your account, and deliver support (contract).
• Process payments and prevent fraud (contract / legitimate interests).
• Respond to enquiries from our marketing site (legitimate interests / consent where required).
• Send service emails and, where you opt in, marketing communications (consent).
• Measure and improve our marketing and product experience (consent for non-essential analytics).
• Comply with legal obligations and defend legal claims (legal obligation / legitimate interests).

Sharing your information

We do not sell your personal information. We share it only as needed with:

• Service providers acting as our processors (hosting, AI model providers, telephony, email, analytics, payments).
• Professional advisers (lawyers, auditors, accountants) under duties of confidentiality.
• Authorities where required by law or to protect rights, property, or safety.
• A successor in interest in connection with a merger, acquisition, or restructuring — with notice to you.

International transfers

Some of our service providers are based outside the UK and EEA. Where data is transferred we rely on UK adequacy regulations, the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or another lawful safeguard.

Data retention

We keep personal information only for as long as needed for the purposes set out above, to meet legal, accounting, or reporting obligations, or to resolve disputes. Typical retention:

• Account data: while your account is active and up to 7 years after for tax records.
• Marketing leads: up to 24 months from your last interaction, unless you ask us to delete sooner.
• Call audio & transcripts processed for trade business customers: in line with the controller's instructions in the DPA.
• Analytics: aggregated and anonymised where possible; identifiable analytics retained no longer than 26 months.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data deleted, subject to legal exceptions.
• Restrict or object to processing in certain circumstances.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time for processing based on consent.
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk).

To exercise these rights email info@mytradebuddy.co. We respond within 30 days and may need to verify your identity first. If your request relates to data captured by a trade business using the Service, we will route the request to that business.

Security

We implement industry-standard technical and organisational measures to protect personal information, including encryption in transit and at rest, access controls, logging, and staff training — set out in full on our Security page. No system is 100% secure; we will notify you and the ICO of personal data breaches as required by law.

Cookies

We use cookies and similar technologies as described in our Cookie Policy. You can manage your choices via the cookie banner.

Our mobile app

The MyTradeBuddy app for iPhone and Android is for trade businesses and their staff. You sign in with your dashboard account and work with the same jobs, customers, quotes and invoices. This section covers what the app uses on your phone and where that information goes.

• Location: the app asks for your location only while you are using it, on the map. The map uses it to show where you are and plan your route between jobs. To draw the route, the app sends your position and the job locations to OSRM (router.project-osrm.org), a public routing service. We don't store your location on our servers, and the app never tracks you in the background.
• Job addresses on the map: to place a job on the map, the app looks up its address. It tries the postcode with postcodes.io first, then the full address with OpenStreetMap's Nominatim service, then your phone's own maps service (Apple or Google). The map images come from CARTO. The app keeps these lookups in memory and clears them when you sign out. If you tap to navigate, the address opens in Apple Maps or Google Maps.
• Camera and photos: the app uses the camera or your photo library only when you add a photo to a job. It receives only the photos you take or pick, and uploads them to that job in your business's account.
• Notifications: if you turn them on, we store a push token for your phone, with its platform (iPhone or Android) and its name, so we can alert you about things like new leads and messages. Alerts are delivered through Expo's push service and Apple or Google. We remove the token when you sign out.
• Staying signed in: the app keeps your sign-in in your phone's secure storage (the iOS Keychain or the Android Keystore). We never receive Face ID or fingerprint data.
• Microphone: the app never uses it. It can play call recordings from your account, but it can't record.
• Card payments: Stripe handles them. When you take a payment from the app, the card details go to Stripe, and we never see or store full card numbers.
• App updates: when it opens, the app checks Expo's update service for a newer version. The check sends the app version, the platform and a random ID for this install.
• Agreeing to our terms: the first time you use the app, it asks you to agree to our terms, even if you have already agreed on the dashboard. We keep a record of that agreement with your name, email address, the time, your IP address, and your phone's model, platform and app version.
• No trackers: the app has no advertising or analytics trackers.

In the app, Settings then Legal shows our terms and policies and lets you delete your account. If you work for a business, your login is deleted straight away. If you own the business, or you're its only admin, deleting your account closes the business's account too, so you send us a request and we have it done within 30 days. Jobs, customers and other records you added for a trade business belong to that business, so they stay with it. Our Delete your account page explains every way to do it, including on the web and by email, and what we keep.

AI processing

Our Service uses AI models from providers such as OpenAI and Anthropic, and AI voice calls are orchestrated through voice platforms such as Vapi (which handles call audio, recordings, and transcription). Where personal information is sent to these providers it is processed under data processing agreements and is not used to train their public models unless we tell you otherwise. Callers interacting with our AI receptionist are informed at the start of the call that calls are recorded.

Google user data

If you connect a Google account, we read your calendar availability and create or update the appointments we book on your behalf. We also record the email address of the account you connected, so the dashboard can show you which account is linked. We use that data only to run the scheduling features you asked for: we do not sell or rent it, we do not use it for advertising, and we do not use it to train AI models. The connection is stored securely and you can end it at any time from your dashboard or from your Google account's third-party access settings — we delete it when you disconnect, and when you close your account.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. In particular, we do not use, transfer, or sell Google user data — raw, aggregated, or derived — to create, train, or improve machine learning or artificial intelligence models.

Children

The Service is designed for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. Where changes are material, we will tell you directly by email or via the dashboard rather than relying on you to re-read this page.

Complaints

If you are unhappy with how we have handled your personal data, email info@mytradebuddy.co with the subject line "Data Protection Complaint". We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, though we would welcome the chance to resolve your concern first.

Contact

For privacy questions, data subject requests, or to report a concern, email info@mytradebuddy.co with the subject line "Privacy Request".