Privacy Policy

Account data: when you sign up we collect your name, email address, password (stored only as a salted hash), preferred language, and the name and location of your dive center.

Operational data: content you enter to run your center, including diver profiles, certifications, medical declarations, bookings, equipment records, and staff accounts. Where this data describes your divers and customers, you are the controller and we process it on your behalf.

Billing data: subscription plan, billing cycle, and payment status. Card details are collected and stored by our payment processor, Stripe — we never receive or store full card numbers.

Usage data: log data, device and browser information, IP address, and analytics events we use to keep the service secure and to understand how it is used.

To provide and maintain the platform, authenticate you, and keep your account secure.

To process subscriptions, trials, and payments through Stripe.

To send service communications such as confirmations, security alerts, and important changes to the service.

To improve reliability and performance, prevent abuse, and comply with our legal obligations.

We rely on the performance of our contract with you to provide the service, on our legitimate interests to secure and improve it, on your consent for optional analytics and marketing where required, and on compliance with legal obligations for tax and accounting records.

For diver and customer records processed on behalf of dive centers, the dive center is responsible for establishing its own legal basis toward the individuals concerned.

We do not sell personal data. We share it only with service providers who help us operate the platform, under contractual confidentiality and data-protection commitments.

Our key subprocessors are Supabase (database and authentication hosting), Vercel (application hosting and analytics), Stripe (payments), and Google (tag and measurement services). Each processes data only as needed to provide its service.

We keep account and operational data for as long as your account is active. After you close your account we delete or anonymise personal data within 90 days, except where a longer period is required for legal, tax, or dispute-resolution purposes.

Dive centers can export or delete diver records at any time from within the platform.

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, withdraw consent, and request a portable copy of the data you provided.

To exercise these rights, contact us at contact@divinglist.com. If your data is held by a dive center as controller, we will refer your request to them.

If you are in the European Union or United Kingdom, you also have the right to lodge a complaint with your data-protection authority (in France, the CNIL — www.cnil.fr).

If you are a resident of a U.S. state with privacy legislation (such as California under the CCPA/CPRA), you may have the right to know about, access, correct, delete, and opt out of the "sale" or "sharing" of your personal information. We do not sell your personal data.

DivingList is based in the United States, so personal data is processed there and may also be processed by our providers in other countries. For users in the EU/EEA or United Kingdom, international transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We use encryption in transit, row-level access controls, hashed credentials, and least-privilege access to protect personal data. No system is completely secure, so we cannot guarantee absolute security, but we work continuously to reduce risk and will notify you of a breach where the law requires it.

We use strictly necessary cookies to keep you signed in and to secure the service, plus optional analytics and marketing cookies that load only after you consent. Consent is collected and managed through our cookie-consent tool, and you can change or withdraw your choices at any time from the cookie settings on the site or through your browser.

The platform is intended for dive centers and their staff, not for direct use by children. Where a dive center records data about minor divers, it does so as controller and is responsible for obtaining any required parental consent.

We may update this policy from time to time. We will post the new version here and update the date above, and will notify account holders of material changes.

For any privacy question or to exercise your rights, contact us at contact@divinglist.com.