1. Who We Are
DivePilot is a product of AskAnything GmbH, Zugerstrasse 6, CH-6330 Cham, Switzerland ("we", "us", "our"). Our platform is accessible at my.divepilot.app and our marketing website at divepilot.app.
For data you enter about your own dive center and staff, we act as the data controller. For personal data that dive centers store about their customers (guests, students and divers), the dive center is the controller and we process that data on the dive center's behalf as a processor.
For any privacy-related matters, you can reach us at privacy@divepilot.app.
2. Data We Collect
We collect the following categories of data:
- Account data: Name, email address, password (hashed), role, language preference and last login timestamp for staff users.
- Dive center data: Business name, email, country, timezone, currency and subscription status.
- Customer data: First name, last name, email, phone, date of birth, nationality, sex, certifications, dive history, equipment preferences, medical notes and address, entered by dive center staff or by customers themselves via the self-registration form.
- Waiver and medical data: When a customer signs a digital waiver we store the signed document, signature, full name, timestamp, IP address and browser information as legal evidence of signing. Where a waiver includes a medical questionnaire, the customer's answers are stored as health data with the signature record and are visible only to the responsible dive center.
- Booking and trip data: Booking records, boat trip schedules, dive group assignments and participant information.
- Payment data: Subscription payments are processed by Stripe. To show your billing status and payment history we store invoice summaries and payment method metadata (card brand, last four digits and expiry date) on our servers. Full card numbers and payment credentials never reach our servers - they are held exclusively by Stripe.
- Usage data: Log data including IP address, browser type, pages visited and timestamps, used for security and debugging purposes.
3. How We Use Your Data
We use the data we collect to:
- Provide, operate and maintain the DivePilot platform
- Process subscription payments through Stripe
- Send transactional emails (account verification, password reset, invite links, subscription notifications)
- Respond to support requests
- Monitor security, prevent fraud and maintain platform stability
- Comply with legal obligations
We do not use your data for advertising, profiling or any purpose beyond operating the service.
4. Legal Basis for Processing
We process personal data on the following legal bases under GDPR:
- Contract performance: To provide the service you have subscribed to.
- Legitimate interests: For security monitoring, fraud prevention and service improvement.
- Legal obligation: Where required by applicable law.
- Consent: Where you have explicitly provided consent, such as during customer self-registration.
5. Data Storage and Security
All data is stored on servers located within the European Union. We use industry-standard security measures including:
- TLS/SSL encryption for all data in transit
- Encrypted passwords using bcrypt hashing
- Token-based authentication with short-lived access tokens and rotating refresh tokens
- Role-based access controls within the platform
- Regular security reviews
6. Data Sharing
We share data only with the following third-party service providers who process data on our behalf:
- Stripe: Payment processing. Subject to Stripe's own privacy policy.
- PurelyMail: Transactional email delivery.
- Hosting provider: Cloud infrastructure within the EU.
- Open-Meteo: Weather forecasts shown in the platform. Your browser requests them directly from Open-Meteo; only dive site coordinates are transmitted, never personal data.
Both the platform and our marketing website serve all fonts and assets from our own servers - no font or analytics requests are made to Google or other advertising companies.
We do not sell, rent or trade personal data to any third parties. We will disclose data to authorities only if required by law.
7. Data Retention
We retain data for as long as your account is active.
- When you delete records or your account, the data is deactivated ("soft-deleted") and is no longer accessible in the platform, but remains stored in our systems as a safeguard against accidental deletion.
- Permanent erasure is performed on request: contact privacy@divepilot.app and we will irreversibly delete the data within 30 days, except where retention is legally required.
- Billing records are retained for 10 years as required by Swiss accounting law.
- Log data is retained for 90 days for security purposes.
8. Your Rights
Under GDPR and Swiss data protection law (nDSG), you have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate data
- Erasure: Request deletion of your data
- Portability: Receive your data in a machine-readable format
- Objection: Object to processing based on legitimate interests
- Restriction: Request restriction of processing
To exercise any of these rights, contact us at privacy@divepilot.app. We will respond within 30 days.
You also have the right to lodge a complaint with a supervisory authority - in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), or the data protection authority of your country of residence.
9. Cookies
DivePilot uses only essential cookies required for authentication and session management. We do not use advertising cookies or tracking cookies. No third-party analytics scripts are loaded on our platform.
10. Children's Privacy
DivePilot is a business-to-business platform intended for dive center operators and their adult customers. We do not knowingly collect data from children under 16 without parental consent. If you believe a minor's data has been entered without consent, contact us immediately.
11. Changes to This Policy
We may update this privacy policy from time to time. When we make significant changes, we will notify account holders by email and update the "Last updated" date above. Continued use of the platform after notification constitutes acceptance of the updated policy.
This privacy policy was drafted in English. Translations into other languages are provided for convenience only. In the event of any discrepancy between the English version and a translation, the English version prevails.
12. Contact
For any questions about this privacy policy or how we handle your data: