top of page

Privacy Policy

PRIVACY POLICY

Beluga Twin Inc.

Effective Date: February 27, 2026

​

1. Introduction

Beluga Twin Inc. (“Beluga Twin,” “we,” “our,” or “us”) is a business-to-business (“B2B”) software-as-a-service (“SaaS”) company that provides commercial building insights derived from mechanical system data. This Privacy Policy describes how we collect, use, disclose, and protect information when you visit our website, use our platform, or otherwise interact with us.

By accessing or using our website or platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our services.

​

2. Scope of This Policy

This Privacy Policy applies to information collected through:

  • Our website (belugatwin.com and any associated subdomains)

  • The Beluga Twin SaaS platform (app.belugatwin.com & api.belugatwin.com)

  • Email, telephone, and SMS communications with us

  • Any other interactions with Beluga Twin in connection with our services
     

Our services are designed for business use and are not intended for consumers or individuals under the age of 18. We operate exclusively within the United States.
 

3. Information We Collect

3.1 Business Contact Information

While providing our services, we collect business contact information from authorized personnel of our clients and prospective clients, including:

  • Full name

  • Business email address

  • Physical addresses of client business locations

  • Business phone number (optional)

  • Mobile phone number (optional)

  • Job title and role (optional)
     

3.2 Account Information

When authorized users are provisioned into our platform, we collect a username. Passwords are securely generated and stored in an irreversible format using bcrypt to ensure Beluga Twin personnel are never provided with a plaintext version of the user’s credentials.
 

3.3 Building Mechanical Data

Our core service involves collecting data from commercial building mechanical systems, including but not limited to HVAC systems, water pumps, pool equipment, and other connected devices. This data is pushed from building automation systems (BAS) or building control systems (BCS) to Beluga Twin’s secure cloud, typically via the BACnet protocol.
 

Important: Our data flow is strictly one-way (read-only). We receive data from building systems for monitoring and analysis purposes only. We do not send commands to, control, or write data back to any building system or equipment. This architecture was designed deliberately to ensure that our platform does not present inherent risks to connected buildings and Beluga Twin end users.
 

Building mechanical data is generally non-personal and does not constitute personally identifiable information (“PII”). It includes equipment performance metrics such as temperature readings, equipment status, supply temperatures, zone temperatures, and similar operational data points.
 

3.4 Website and Platform Usage Data

We use analytics and tracking technologies on our website and platform to understand usage patterns and improve our services. These may include cookies, web beacons, and similar technologies. 

  • MixPanel – Platform user behavior analysis, USA

  • Google Analytics – Website user analytics (Assuming we’ll utilize this), USA
     

Information collected through these technologies may include IP addresses, browser type, operating system, referring URLs, pages visited, time spent on pages, business email addresses, and similar usage data.
 

3.5 Communications Data

When you communicate with us via email, telephone, or SMS, we may retain records of those communications, including message content, timestamps, and contact information, to provide and improve our services.
 

4. How We Use Your Information

We use the information we collect for the following purposes:

  • Providing, operating, and maintaining our SaaS platform and related services.

  • Generating building performance insights and analytics for our clients

  • Creating and Managing user accounts.

  • Communicating with clients and prospective clients via email, telephone, and SMS regarding our services, including service notifications, updates, and support.

  • Improving and developing our platform, through aggregated and de-identified analysis of building data.

  • Responding to inquiries and providing customer support.

  • Complying with legal obligations and enforcing our agreements.

  • Ensuring the security and integrity of our platform and services.
     

5. SMS Communications

We may send SMS text messages to client personnel who have provided their prior express written consent in accordance with the Telephone Consumer Protection Act (“TCPA”) and applicable state laws.
 

5.1 Types of Messages

SMS messages may include service notifications, assignment alerts, status updates, and other communications related to the operation of our platform. We do not use SMS for marketing or promotional purposes unless separate consent is obtained.
 

5.2 Consent and Opt-Out

By opting in to receive SMS messages through our platform, you consent to receive automated text messages from Beluga Twin at the phone number provided. Consent is not a condition of purchasing or using our services.
 

You may opt out of SMS messages at any time by:

  • Replying STOP to any SMS message from us

  • Disabling SMS notifications within your platform account settings
     

Message and data rates may apply. Message frequency varies based on your platform activity and notification preferences. For help, reply HELP to any message or contact us at the information provided in Section 12 below.
 

5.3 SMS Service Provider

Our SMS messages are transmitted through Microsoft Azure Communication Services. Your phone number and message data are shared with this provider solely for the purpose of delivering text messages on our behalf.
 

6. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties. We may share information in the following limited circumstances:
 

6.1 Service Providers

We engage third-party service providers to assist in operating our platform and delivering our services. These providers may have access to building mechanical data in connection with hosting, data processing, and infrastructure services. 

Our current service providers: 

  • Microsoft Azure - Cloud infrastructure Phoenix, AZ.

  • Microsoft Azure Communication Service - Email and SMS delivery, USA.

  • MixPanel – Product user analytics, USA.

  • Google Analytics – Website analytics, USA.

  • GitLab Service Desk – Data Subject Request Portal, USA.

  • Auth0 – Identity Provider, USA.

  • BetterStack Telemetry – System Uptime Monitoring, Global.

These providers are contractually obligated to use data only for the purposes of providing services to Beluga Twin and in accordance with applicable data protection requirements.
 

6.2 Legal Requirements

We may disclose information if required to do so by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, the safety of our users, or the public.
 

6.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify affected clients of any change in ownership or control of their information.
 

7. Data Ownership and Licensing

Building mechanical data collected through our platform is considered the property of the client from whose building systems the data originates. Beluga Twin retains a limited, fully paid-up, irrevocable, non-exclusive license to use building data that passes through the platform for purposes including platform improvement, analytics development, benchmarking, and service enhancement. This license survives the termination of the client relationship. Detailed terms regarding data ownership and licensing are set forth in our Terms of Service.
 

8. Data Retention

We retain information as follows:

Business Contact Information: We retain business contact information for as long as the client relationship is active and for a reasonable period thereafter for recordkeeping and legitimate business purposes.
 

Account Information: Account credentials are retained for the duration of the account. Upon account termination, login credentials are deactivated and deleted in accordance with our internal procedures.
 

Building Mechanical Data: We retain building mechanical data indefinitely to support ongoing analytics, benchmarking, and platform improvement. Former clients may request deletion of their building data by contacting us at the address provided in Section 12 below, and we will honor such requests within a commercially reasonable timeframe.
 

Communications Data: Records of email, telephone, and SMS communications are retained for a reasonable period for service and compliance purposes.
 

9. Data Security

We implement administrative, technical, and physical safeguards designed to protect the information we collect. 

These measures include:

  • Encryption of data in transit using TLS 1.2+ for all system communication.

  • Encryption of data at rest using Advanced Encryption Standard (AES) and a key length of 256 bits.

  • Secure user authentication utilizing securely hashed credentials.

  • One-way (read-only) data architecture that prevents write-back to building systems, reducing cybersecurity risk.

  • Role-based access controls for platform users.

  • Regular review of security practices and infrastructure including:

  • Static Application Security Testing (SAST) of all Beluga Twin application code.

  • Open-Source Dependency and Vulnerability Analysis.

  • Weekly patching cycles.

  • Quarterly vulnerability scanning of core infrastructure.

  • Quarterly Dynamic Application Security Testing (DAST) of all public facing Beluga Twin assets.

  • Manual penetration testing of core application features on demand.
     

While we strive to protect your information, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security but are committed to continuously improving our security posture.
 

10. Cookies and Tracking Technologies

Our website and platform use cookies and similar tracking technologies to facilitate functionality, analyze usage, and improve user experience.
 

Essential Cookies: These are necessary for the operation of our website and platform, including session management and authentication.
 

Analytics Cookies: These help us understand how users interact with our website and platform so that we can improve performance and usability.

  • MixPanel – Platform user behavior analysis, USA

  • Google Analytics – Website user analytics (Assuming we’ll utilize this), USA
     

Most web browsers allow you to manage cookie preferences through browser settings. Please note that disabling certain cookies may affect the functionality of our platform.
 

11. Your Rights and Choices

Depending on your jurisdiction, you may have certain rights regarding your personal information, including:

  • The right to access the personal information we hold about you

  • The right to request correction of inaccurate information

  • The right to request deletion of your personal information, subject to our legal and contractual obligations

  • The right to opt out of SMS communications as described in Section 5

  • The right to manage cookie preferences through your browser settings
     

Certain states, including California, Virginia, Colorado, Connecticut, and others, provide additional privacy rights to their residents. If you are a resident of one of these states and wish to exercise your rights, please contact us using the information in Section 12.
 

We do not discriminate against individuals who exercise their privacy rights. We will respond to verifiable requests within the timeframes required by applicable law.
 

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Beluga Twin Inc.

Email: privacy@belugatwin.com

 

Beluga Twin

967 E Parkcenter Blvd #450

Boise, ID 83706
 

13. Children’s Privacy

Our services are intended for use by businesses and their authorized adult personnel. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have inadvertently collected information from a minor, we will take steps to delete it promptly.
 

14. Third-Party Links

Our website or platform may contain links to third-party websites or services that are not operated by Beluga Twin. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.
 

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the “Effective Date” at the top of this policy and, where appropriate, notify clients through our platform or via email. Your continued use of our services after any changes constitutes your acceptance of the updated policy.
 

16. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Idaho, without regard to its conflict of laws principles.

​

​

bottom of page