Beluga Privacy Policy

Last updated: October 27, 2026

This Privacy Policy explains how Beluga Technologies, Inc. ("Beluga," "we," "us" or "our") collects, uses and shares personal information. It applies to trybeluga.ai, belugalabs.ai and their subdomains (including go.trybeluga.ai and our notifications subdomains), the Beluga dashboard and the Beluga command-line interface (together, the "Service"), and to our creator discovery, outreach and payment activities.

Beluga runs creator marketing campaigns for brands. That means this policy covers three main groups of people:

• Brand users: people at our brand customers who use the Service.
• Creators: people who make content and whom we research, contact, work with or pay. Creators do not have accounts on the Service.
• Website visitors: people who visit our websites, fill in our contact form or book a call.

You can contact us about this policy at privacy@trybeluga.ai.

1. Information we collect

Brand users and customers

• Account information: your email address, organization and role.
• Activity in the Service: your approvals and rejections of creators and content, feedback, responses to blockers, and notification preferences.
• Billing and contracts: invoices, which we send through HubSpot and are paid through Brex, and contracts signed through PandaDoc.
• Communications: messages you exchange with us by email, Slack or other channels.
• Connected PostHog account: if your organization connects its PostHog account, we send its campaign and short-link click data to that account through Amazon S3.

Creators

Information from public sources. To find creators who fit our brands' campaigns, we collect publicly available information about creators. Our sources include Instagram, TikTok and LinkedIn (collected through Apify), the YouTube Data API, the X API, public web pages (collected through Firecrawl) and search results (collected through SerpAPI). The information includes:

• account handles and profile information;
• profile statistics, such as follower counts and engagement;
• public posts; and
• contact email addresses published on public pages.

Outreach and communications. We contact creators by email from belugalabs.ai addresses, using Google Workspace (Gmail) and Instantly, and we store the full email threads. We use ZeroBounce to check that email addresses are valid before we send to them. We may also communicate with creators through WhatsApp, Discord and Slack Connect.

Campaign information. If you work with us, we keep information about your campaigns, such as links to your content drafts, brands' feedback and approvals, and campaign performance.

Payment and tax information. To pay you, we collect your payout details, such as bank account, ACH, IBAN or SWIFT numbers, or your PayPal or Wise email address. We store these details encrypted in Supabase Vault, only Operators (Beluga staff who run the Service) can see them, and we use them only to make payouts. We pay by wire, ACH, PayPal or a Stripe payment link you provide. We collect IRS Form W-9 or W-8 by email for tax reporting; it includes your taxpayer identification number.

Website visitors

• Contact form: your name, email address, company, website, budget, message and the services you are interested in.
• Scheduling: if you book a call through our embedded Calendly scheduler, Calendly collects the details you enter and shares them with us.

Short-link clicks

When someone clicks a Beluga short link on go.trybeluga.ai, we record the device's user agent, an approximate location (city, region and country, as provided by Cloudflare), the referring website's host name and any UTM campaign parameters in the link. We do not store IP addresses with these records and do not set cookies for short-link clicks.

Automatically collected information

When you use our websites or the Service, our hosting providers automatically log technical information such as your IP address, browser type and the pages you request. We use it to run and secure the Service. Cookies are described in Section 5.

2. How we use information

We use personal information to:

• provide, operate and secure the Service, including signing users in and sending notifications;
• find creators who may be a good fit for brand campaigns, contact them, and manage campaigns we run with them;
• show brands creator information, campaign progress and results;
• pay creators and meet our tax and accounting obligations;
• respond to inquiries and booked calls, and communicate with customers;
• understand how the Service is used and improve it;
• prevent fraud and abuse, and comply with law; and
• use de-identified or aggregated information to improve our services, including how we match creators to campaigns. We keep de-identified information in de-identified form and do not try to re-identify it.

3. How we use AI

We use AI services from two providers:

• Anthropic (Claude) processes creator profiles and posts, email replies from creators, brand briefs and brand preference ("taste") profiles.
• Voyage AI creates embeddings (numerical representations) from creator text.

We use these services to help match creators to brand campaigns and manage our outreach. Anthropic's terms do not allow it to train its models on this data. Beluga does not currently train its own AI models. We may use de-identified or aggregated data to improve how we match creators to campaigns.

Brands, not automated systems alone, decide which creators we work with. We do not make decisions with legal or similarly significant effects based solely on automated processing.

4. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

We share personal information in these situations:

• With brands. We share creator information, such as profiles, statistics, content and campaign results, only with the brands whose campaigns it relates to, and only for those campaigns. Our contracts limit how brands may use it. Short-link click data for a brand's links is shared with that brand.
• With service providers. We use vendors to host, run and support the Service and our business. They process personal information on our behalf under contract. See Section 8 for the list.
• For legal reasons. We may share information if we believe it is required by law or legal process, or needed to protect the rights, safety or property of Beluga, our customers, creators or others.
• In a business transfer. If Beluga is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction.
• With your consent. We may share information in other ways if you ask us to or agree to it.

5. Cookies and analytics

• Sign-in cookies. We use cookies from Supabase, our authentication provider, to keep you signed in to the Service. These are needed for the Service to work.
• Product analytics. We use PostHog to understand how our websites and the Service are used, including session replay, which records your clicks, mouse movements, scrolling, the pages you view and what appears on your screen. Text you type into inputs and other sensitive fields is masked. For signed-in users, PostHog data is linked to your user ID, role and organization. We configure PostHog not to store your IP address. PostHog and session replay run only after you accept analytics cookies in our cookie banner. You can change your choice at any time through the cookie settings link on our websites or, if you have an account, in your account's privacy settings. If your browser sends a Global Privacy Control signal, we treat it as a rejection.
• Record of your cookie choice. We store your choice in a Beluga cookie (beluga_consent) with a random identifier. Each time you choose, we log that identifier, your choice, the notice version, where you made it, your browser's user agent, the time and, if you are signed in, your user ID, but not your IP address. Retention is in Section 9.
• Scheduling. If you book a call through the Calendly scheduler embedded on our website, Calendly may set its own cookies, as described in Calendly's privacy policy.
• No advertising trackers. We do not use advertising pixels or third-party advertising cookies, and we do not allow advertising networks to collect information about your activity across websites through our Service.

Do Not Track. We do not respond to Do Not Track signals.

6. Google and YouTube data

Gmail. We use Google APIs to read and send email from Beluga staff mailboxes (the gmail.readonly and gmail.send scopes) so we can manage creator outreach. Beluga's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data for advertising and do not sell it. We do not use Gmail data to develop, improve or train generalized AI or machine-learning models, including our matching.

YouTube. The Service uses YouTube API Services to collect public information about YouTube channels and videos, which we use and share as described in this policy. See the Google Privacy Policy. If you authorize access to Google data, you can revoke it at any time at myaccount.google.com/permissions.

7. Your choices and rights

• Unsubscribing. Creators can unsubscribe from our outreach using the link or instructions in our emails, or by emailing privacy@trybeluga.ai.
• Objecting and deletion. You can ask us to stop processing your information or to delete it by emailing privacy@trybeluga.ai.
• Do-not-contact list. When we delete a creator's information, we keep a minimal do-not-contact entry, such as your email address or handle, so we don't contact you again.

If you work with us under a creator agreement, we may need to keep some information to perform that agreement, pay you and meet our legal and tax obligations.

Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To make a request, email privacy@trybeluga.ai. We verify requests by confirming you control the email address or account involved. You may use an authorized agent; we may ask for proof of their authority. If we deny your request, you can appeal by replying to our decision. We will not discriminate against you for exercising your rights.

Brand users can update notification preferences in the Service. Your organization controls which email domains can access the Service; contact your organization's administrator or us to change your access.

8. Service providers

To pay creators, we also send payout details to the banks and payment providers involved in the payment, such as PayPal, Wise or Stripe.

9. Data retention

We may keep information longer where needed to meet legal obligations or resolve disputes.

10. Security

We use administrative, technical and physical safeguards designed to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. California notice

In the last 12 months we collected: identifiers (name, email, social handles, user ID); professional and commercial information (organization, role, campaign, contract and invoice records); internet activity (Service use, session replay, short-link clicks, user agent); approximate location (city-level, from short-link clicks); audio/visual information (public photos and videos in creators' posts); inferences (creator-fit and brand-preference profiles); and sensitive personal information (financial account details for payouts and taxpayer ID numbers). Sources and purposes are described in Sections 1 and 2. We disclose each category to our service providers (Section 8), and creator identifiers, content, inferences and campaign data to the brands those campaigns are for. We use sensitive personal information only to pay creators and meet tax obligations, as the law permits, so we do not offer a right to limit its use. We do not sell or share personal information, have not done so in the last 12 months, and have no actual knowledge of selling or sharing personal information of anyone under 16.

12. International users

The Service is designed for users in the United States, and we store data in the United States. If you are in the European Economic Area (EEA), the United Kingdom or another country with data protection laws, this section also applies to you.

Controller. Beluga Technologies, Inc. is responsible for the personal information described in this policy.

Legal bases. We process personal information on these bases:

• Legitimate interests: discovering, researching and contacting creators for brand campaigns; running, improving and securing the Service; and keeping records of consent choices. You have the right to object to this processing, as described below.
• Contract: providing the Service to our customers and performing creator agreements, including paying creators.
• Legal obligation: meeting tax, accounting and other legal requirements.
• Consent: analytics and session replay, and any other processing where the law requires consent. You can withdraw consent at any time.

Your rights. In addition to the rights in Section 7, you have the right to object at any time to processing based on our legitimate interests, and we will stop contacting you for outreach if you object. You also have the right to complain to your local data protection authority.

International transfers. We process information in the United States. Where the law requires a transfer safeguard, we rely on Standard Contractual Clauses or our vendors' equivalent safeguards.

13. Children

You must be at least 18 years old to use the Service. If you are a parent or guardian and believe we hold information about your child, contact us at privacy@trybeluga.ai and we will review it and delete it where appropriate.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy on this page with a new "Last updated" date. For material changes, we will also email signed-in users at least 30 days before the changes take effect, unless a change is required by law or needed to address security or abuse, in which case it may take effect sooner.

15. Contact us

Beluga Technologies, Inc. 535 Mission St, 14th Floor San Francisco, CA 94105 privacy@trybeluga.ai

To report spam or abuse, email abuse@trybeluga.ai or abuse@belugalabs.ai, or see our anti-spam policy.