Privacy Policy

Effective date: 2026-06-04 · Version 1.1

1. Who we are

DivePass is the operator of the DivePass scuba-diving service, based in Cozumel, Quintana Roo, Mexico (the "Controller" / "Responsable" for the purposes of Mexico's LFPDPPP, and "data controller" for the purposes of the GDPR). Contact: hello@divepass.app.

2. What we collect

  • Account data: email, name, certification level, preferred language. (Sign in with Apple may provide a relay email.)
  • Profile data: emergency contact, gear, insurance status, dive count, comfort level (you choose what to share). Some of these fields are health- or safety-adjacent; they are always optional and are processed only with your affirmative consent.
  • Dive logs: date, dive site, depth, time, conditions, partner notes you record.
  • Location: only when you actively log a dive at a specific site. Background location is never collected.
  • Device telemetry: anonymized analytics events, app version, crash logs.
  • Server logs: IP address (hashed daily before storage), user agent, request paths.

3. Why we use it

Primary purposes (necessary to provide the service):

  • Provide and operate the service
  • Sync your data across your devices
  • Diagnose and fix bugs and maintain security
  • Send transactional emails (account, password reset, booking confirmations once enabled)

Secondary purposes (not necessary to provide the service):

  • Aggregate, anonymized analytics to understand product usage
  • Future product or marketing communications, if and when offered

You may opt out of secondary purposes at any time — from in-app settings (analytics) or by emailing hello@divepass.app — without affecting your use of the service.

4. Legal bases

  • Consent: for processing of optional health-/safety-adjacent profile fields, and for any future marketing communications
  • Performance of a contract: for service operation, account management, and dive log storage
  • Legitimate interest: for security, fraud prevention, and aggregate anonymized product analytics

5. Who we share data with

  • Supabase (database, auth, storage, real-time) — primary processor, under a Data Processing Agreement
  • TelemetryDeck (iOS analytics, anonymized)
  • Vercel (web hosting + Vercel Analytics)
  • Apple / Google — only if you sign in with their identity provider; they receive only what's required for the auth handshake
  • Operators you contact — they receive your booking inquiry and contact details if you reach out

We do not sell your personal data. We do not share your data with advertisers.

6. Where your data lives

Supabase region: US-East. Backups encrypted at rest. Data in transit is encrypted with TLS.

International transfers from Mexico to the United States are performed under a Data Processing Agreement with Supabase that incorporates standard contractual clauses. You may object to such transfers by contacting hello@divepass.app, though doing so may limit our ability to provide the service.

7. How long we keep it

  • Account data: for the lifetime of your account, plus 30 days after account deletion (recovery window)
  • Dive logs: for the lifetime of your account; you can export and delete at any time
  • Aggregate analytics: 12 months
  • Server logs: 30 days

When a retention period ends, data is deleted or irreversibly anonymized. We may retain limited records longer where required to comply with a legal obligation or to establish or defend legal claims.

8. Your rights

Mexico (LFPDPPP — primary)

You have ARCO rights:

  • Acceso — request a copy of your data
  • Rectificación — request correction of inaccurate data
  • Cancelación — request deletion
  • Oposición — object to specific processing

You may also revoke consent for any processing based on consent at any time. We respond to ARCO requests within 20 business days. Email hello@divepass.app to exercise any right. To protect your data, we may ask you to reasonably verify your identity before we act on a request.

European Economic Area (forward-compat)

If you are in the EEA, you also have the rights to access, rectification, erasure, restriction, portability, objection, and to withdraw consent at any time. You may lodge a complaint with your local supervisory authority.

California (forward-compat)

If you are a California resident, you have the right to know what we collect and why, to access and delete your information, to correct inaccurate information, to opt out of any sale or sharing (we do not sell or share for cross-context behavioral advertising), to limit use of any sensitive personal information, and not to be discriminated against for exercising these rights. We aim to respond within 45 days. You may use an authorized agent to submit a request.

9. Security

Supabase Row Level Security restricts access to your records. Passwords are hashed (never stored in plaintext). All traffic is over HTTPS. We do not store payment card data (no payments during beta).

10. Data breach notification

If we become aware of a security breach that materially affects your personal data, we will notify affected users without undue delay and, where applicable, the competent authorities, and will describe the nature of the incident, the data involved, and the steps you can take to protect yourself.

11. Cookies and analytics consent

Web uses Vercel Analytics, which is cookieless and aggregates only anonymized data. iOS uses TelemetryDeck, which is anonymized. You may opt out of analytics from the in-app settings.

12. Children

The service is intended for users 18 and older. We do not knowingly collect data from children under 18. If you believe we have, contact us and we will delete it promptly.

13. Changes to this Policy

Material changes will trigger an in-app re-acceptance flow with at least 30 days' notice. Non-material changes take effect on posting. The "effective date" above always reflects the current version.

14. Contact

hello@divepass.app — for ARCO requests, GDPR requests, or any privacy question.