Privacy
How Bay Three Ltd handles personal data for the marketing site and ops product.
Last updated: 8 September 2026
Bay Three Ltd (“Bay Three”, “we”, “us”) provides a crew operations product at baythree.app (including company spaces at {company}.baythree.app) and this marketing site at baythree.co.uk. This notice explains how we process personal data under UK GDPR and the Data Protection Act 2018.
For privacy questions, email hello@baythree.co.uk.
Who is the controller?
Bay Three Ltd is the controller for personal data we process to operate the platform (accounts, billing, support and the marketing site). Where your organisation enters staff or contractor details into its Bay Three workspace, that organisation is typically the controller for that operational content and we act as a processor on its instructions.
What we collect
Marketing site: pages you visit, standard server and security logs, and any details you send when you email us.
Product: account details (name, work email, optional mobile), organisation membership and role, job and crew records, invoices, receipts and other uploads, usage needed to run the service, and billing/subscription metadata.
Why we use it
To provide and improve the service, authenticate users, support customers, process subscriptions, keep the platform secure, and meet legal obligations. Legal bases include contract (providing the service you or your organisation signed up for), legitimate interests (security, product improvement, B2B marketing of our own service where appropriate), and legal obligation where applicable. We do not sell personal data.
Processors we use
We use carefully chosen service providers who process data on our behalf:
- Supabase — database, authentication and file storage
- Vercel — application hosting and edge delivery
- Stripe — subscription billing and payment processing
- Resend — transactional email (for example invites and account messages)
Cloudflare may process network requests as our DNS and edge provider for baythree.co.uk / baythree.app. Optional integrations you enable (such as Google Sheets sync) process data at your organisation’s direction.
How long we keep it
Account, job and upload records are kept while your organisation uses Bay Three and for a reasonable period afterwards for accounts, support and dispute handling (typically up to 24 months after closure unless a longer period is required by law or ongoing claims). Marketing correspondence is kept only as long as needed to reply and follow up. Billing records may be retained longer where tax or accounting rules require it. When retention ends we delete or anonymise data where practicable.
International transfers
Some processors may store or process data outside the UK. Where that happens we rely on appropriate safeguards (such as UK adequacy regulations or standard contractual clauses) offered by those providers.
Your rights
Under UK GDPR you can ask for access, correction, erasure, restriction, objection, or data portability where those rights apply. Contact hello@baythree.co.uk. You can also complain to the Information Commissioner’s Office (ICO).
If your data was entered by your employer or client organisation, please contact them as well — they may need to action the request in their workspace.
Security
Access is limited to signed-in users within each organisation. Uploads sit in private storage with access controls. No online service is perfectly secure; we apply reasonable technical and organisational measures.
Changes
We may update this notice from time to time. The “Last updated” date above will change when we do. Continued use of the site or product after changes take effect means you acknowledge the revised notice.
Contact
Bay Three Ltd
Email: hello@baythree.co.uk
Registered office details are available on request and will be added here when confirmed.