Privacy policy

thebaehq.com is published by Bae HQ. The BAE HQ Impact Ltd is a company limited by guarantee registered in England and Wales, company number 15222824. Registered office: B.04 Clerkenwell Workshops, 27–31 Clerkenwell Close, London EC1R 0AT.

We are registered with the Information Commissioner’s Office under registration number ZB628116.

This policy covers this website, thebaehq.com, and nothing else.

Our community platform at community.thebaehq.com is a separate service with its own privacy policy. If you join the community, register for an event or sign up to anything, that happens there and is covered there. This website links to it, and that is the whole of the relationship between the two.

Only what you send us.

• The contact form. If you use the form on our contact page, we receive your name, your email address, the subject you choose and your message. There are no accounts and no sign-in for visitors to this website.
• Podcast bookings. If you book a recording, we receive your name, your email address, the time you choose, and a phone number if you decide to give one.
• The report form. If you download our State of Asian Funding UK report, we receive your name, email address, job title and company.
• The Bae HQ 100. If you apply to the Female Founders Watchlist, we receive your name, email address, LinkedIn profile, photograph, startup name, logo, biography and your answers to the second form.
• We store nothing on your device. No cookies, no local storage, no session storage. The one exception is our own team's sign-in, described below.
• We run no analytics. There is no Google Analytics, no alternative analytics product, and no advertising or tracking pixel of any kind.

Our team's sign-in. The only cookie this website sets belongs to the private area our own team uses to publish content. It is set only when a team member signs in there, only works on that area, and is never set for or sent by anyone reading the site. It is strictly necessary to keep a team member signed in, so it needs no consent. Team accounts (a work email address, used to email sign-in codes) are held by Supabase, which provides our database and sign-in service and processes that information on our behalf.

This is why there is no cookie banner on this website. There is nothing for you to consent to.

When you send the contact form, your message is delivered to our team inbox by email. We use Resend, an email delivery service, to send it; Resend handles the message only to deliver it to us. The website itself does not store it.

We use what you send to read and reply to your message, and for nothing else. We do not add you to a mailing list. Our lawful basis is legitimate interests: you have asked us to respond.

We keep messages for 12 months after our last reply, then delete them.

Resend is based in the United States, so your message may be processed there. Where it is, it is protected by the safeguards UK data protection law requires for international transfers.

To download the State of Asian Funding UK report, we ask for your name, email address, job title and company. We use them to know who is reading the report and to contact you about our research and our community.

We share them with Joelson, the law firm we produce the report with. They are stored in our database, run by Supabase, and a copy is emailed to our team through Resend. Only our team can see them, and we neither sell them nor pass them to anyone else.

Our lawful basis is your consent, given by ticking the box on the form. You can withdraw it at any time by asking us through our contact page, and we will delete what you gave us.

We keep what you give us for 12 months, then delete it, the same as the messages you send us.

The report itself is a public file. The form records who asked for it; it does not lock the file.

If you apply to the Bae HQ 100: Female Founders Watchlist, we ask for your name, email address, LinkedIn profile, a photograph, your startup's name and logo, and a short biography. The second form asks which industry you are in, your achievements before this startup, your biggest wins with it, how you plan to reach £10m of revenue, and whether you have a pitch deck.

We use all of it to decide who goes on the list. If you are selected, your name, photograph, logo, company name and biography are published on this website, which is what the last box on the form asks you to agree to. Nothing about you is published if you are not selected.

Your answers are stored in our database and your photograph and logo in our file storage, both run by Supabase. The files are private: nobody but our team can open them. The emails about your application are sent through Resend.

If you tell us you have a pitch deck, we check your email address against submissions made to Bae HQ Ventures, which we keep in Attio. That check tells us only whether a submission exists.

Our lawful basis is your consent, given by ticking the boxes on the form. You can withdraw it at any time by asking us through our contact page, and we will delete your application. If you are already on the published list, we will take you off it.

We keep applications for 12 months and then delete them, the same as the messages you send us. What is published on the list stays on this website for as long as the list is published.

A web page can pass information about you to other companies simply by loading, if it pulls in files from them. This one is built so that it does not.

• Typefaces are downloaded when we build the site and served from our own domain. Your browser never contacts Google to load them.
• Event listings are fetched by our server, not by your browser. The service that holds them never sees your visit.
• Every image, including event cover images, is served from our own domain.

There are no embedded maps anywhere on this website, and no embedded video or audio that starts on its own. The one form, on our contact page, sends nothing until you press send.

Each episode page carries a video player, and it loads nothing until you press play. Before that it is a still image served from our own domain: your browser does not contact YouTube, and YouTube is not told you opened the page.

Press play and the video is served by YouTube, which at that point can store things on your device and is covered by their privacy policy rather than this one. That is why there is still no cookie banner here. Nothing is set unless you ask for it, and choosing not to press play is enough to avoid it entirely.

Our About page has one more video, from Loom, which works the same way: nothing loads from Loom until you press play, and after that it is served by Loom and covered by its privacy policy.

Booking happens on our own page. Nothing is embedded from anyone else, nothing loads until you ask for it, and nothing is stored on your device. The times you are shown come from our own calendar, and seeing them tells us nothing about you.

When you book, we collect your name, your email address, the time you chose and, if you give one, a phone number. We use them to hold the booking, to send you a calendar invitation and a confirmation, to remind you a week before and the day before, and to reach you on the day if something goes wrong. The phone number is optional and we never send text messages.

Our lawful basis is our legitimate interests: you have asked us to arrange a recording, and we cannot do it without knowing who you are and how to reach you.

Your calendar invitation is created in our Google Workspace calendar, so Google processes your name and email address as our provider in order to send it and to keep it up to date if the time changes. Google may process this outside the UK, protected by the safeguards UK data protection law requires for international transfers. Our emails are sent through Resend, as described above.

Your confirmation email contains a private link to a page where you can change the time or cancel. That link is the only way into it: we publish it nowhere, and anyone without it cannot see or change your booking.

We keep a booking for 12 months after the recording, the same as contact messages, then delete it.

When you follow a link out of this website, whether to our community platform, to a form we use to send you a report, to the podcast on Spotify or Apple Podcasts, or to one of our social accounts, you leave thebaehq.com and arrive on a service run by someone else.

What those services collect, and what they store on your device, is governed by their own privacy policies and not by this one.

Where we hold personal data about you, UK data protection law gives you the right to ask us for a copy of it, to have it corrected, to have it deleted, to object to how we use it, and to ask us to restrict how we use it.

To make any of those requests, use our contact page.

You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk. You can go to them at any time and you do not have to come to us first.

If this website changes in a way that affects anything above, whether a form, an embedded player or analytics of any kind, we will update this page. The version you are reading is dated 31 October 2026.

Questions about this policy, or about anything else on this website, go to team@thebaehq.com.