Privacy Policy

Who we are

DiveOS is a dive-center operations platform built by Tafuros. Dive centers and their staff use it to run registrations, bookings, schedules, boat lists, equipment and finances, and divers use the DiveOS app to keep a verified logbook. This policy covers the DiveOS web application, the DiveOS iOS application (on iPhone, iPad and Mac), and this website (diveos.co).

What data DiveOS handles

Staff accounts. Name, email address and role, used to sign in and to attribute actions inside the platform (who approved a registration, who checked gear out).

Customer records kept by a dive center. Contact details, date of birth, gender and nationality, booking, course and payment records, signed liability forms and medical declarations (which can include health information), certification details, and photos uploaded as proof of certification. This data belongs to the dive center that operates the account; DiveOS processes it on the dive center's behalf so the center can run its operation and meet training-agency requirements.

Diver accounts. A diver can create an account in the app with an email address and a one-time code. With it the diver keeps:

• a logbook - dive date, site, depths, times, gas and equipment details, notes and buddy name;
• dive photos and photos of their certification cards;
• dive verifications - when a professional or a buddy verifies a dive, DiveOS stores what that person provides: their name, training agency, member number, dive center and email address, a drawn signature, the data read from a scanned agency card QR code, or a photo of their card or of a dive center's stamp;
• booking requests the diver sends to a dive center, which reach that center as a registration.

Location (app). When a diver logs a dive or looks for dive sites around them, the app asks for permission to use the device's location, only while the app is in use. The location is sent to DiveOS to list the nearest dive sites. It is not saved to the diver's account or logbook, but the request - including the coordinates - can appear in our server request logs. Location is never used for advertising and never runs in the background. It can be turned off at any time in the device's settings; the diver can still choose a site by name.

Device push tokens. If a user enables notifications, a device token is stored so DiveOS can deliver alerts (for example, a new registration awaiting approval). Disabling notifications in system settings stops delivery; tokens for unreachable devices are removed.

Camera and photos (iOS app)

The iOS app asks for camera or photo-library access only when a user chooses to capture or attach an image - a certification card, a dive photo, a dive center's stamp, a signed form - or to scan an agency card's QR code to verify a dive. Images are stored with the diver's logbook or the dive center's account and are not used for anything else.

What DiveOS does not do

• No advertising and no advertising identifiers in the DiveOS app.
• No tracking of users across other companies' apps or websites.
• No sale of personal data - to anyone, ever.

A dive center's public online registration page (a web page, not the app) may carry that center's own advertising-measurement tag, so the center can tell which of its ads led to a booking. That tag is never loaded inside the DiveOS app.

Who else processes data

Data is stored on DiveOS servers and processed only to provide the service. A few providers handle specific parts of it for us:

• Email delivery (sign-in codes and booking emails) - our transactional email provider.
• Payments - PayPal processes card payments; DiveOS never sees or stores card numbers.
• Push notifications - Apple Push Notification service, for users who enable them.
• Fonts - the web app loads typefaces from Google Fonts, which receives the visitor's IP address as part of that request.

Retention and deletion

Divers can delete their account at any time in the app, under Profile - Delete account. This permanently deletes the login, the dives the diver logged or imported with their photos and verifications, and every card in their wallet. Records a dive center holds about the diver - bookings, payments, signed forms and dives the center logged - stay with that center, because they are the center's business and training-agency records; the diver can ask that center directly about them.

Dive-center records are retained for as long as the center's account is active, and as required for financial and training-agency record-keeping. A dive center can request correction or deletion of records, and individuals can direct requests about their personal data to the dive center they registered with or to us directly.

Contact

Questions about this policy or your data: use the contact form on diveos.co.