Fins Tribe & Dana Dive — Privacy Policy

1. WHO IS RESPONSIBLE FOR YOUR DATA

1.1The controller of the personal data covered by this Policy — the entity that decides why and how it is processed — is Dev Dana Software LLC, contactable at admin@scubasign.com and identified in full in the statement above. We are the same company that operates Scuba Sign App.

1.2Dive Shops and Providers that receive your data as described in Article 8 are independent businesses, responsible for their own use of that data.

2. SCOPE OF THIS PRIVACY POLICY

2.1This Policy covers visitors who use the Services without an Account, Account holders, people who make a donation, people who answer an experience survey and, when those features are available, people who use Dana Dive to request Bookings.

2.2Dana Dive features may be introduced gradually. The parts of this Policy that refer to Bookings, Providers and the Service Fee apply when, and to the extent that, those features are made available to you.

3. PERSONAL DATA WE COLLECT

3.1Account data: your email address, your password (stored only as a salted cryptographic hash — we never store or see your password in clear), your interface language, the date your Account was created and, where applicable, the Dive Shop through whose invitation or QR code you signed up.

3.2Data we receive from Scuba Sign App: if you registered as an adult diver with a Dive Shop that uses Scuba Sign App, we receive your first and last name, your email address, the Dive Shop, your language, a registration reference, your check-in date and your dive date, together with the indication that a registration belongs to a minor (used only to exclude it). We never receive your medical questionnaire, your identity photo, your signature or any other registration document.

3.3Surveys and reviews: your rating and comment, the Dive Shop or Provider concerned, the date of the dive, the language, the date you answered, and whether you followed the link to a third-party review site.

3.4Donations and payments: the amount, currency, date and status of the payment, the type of payment method (for example, card), the identifiers assigned by our payment processor and your email address (the address of your Account if you are signed in when you donate; otherwise the address you enter on the payment page), the number of unlock codes you requested and your language, which we use to email you your unlock codes. Unlock codes are stored only as a one-way cryptographic hash; we also record when a code was redeemed and, until your Account is closed, which Account redeemed it. Whether your Account has Full Access is kept with your Account data. If we send you a gift code, we keep your email address and the date it was sent with the code's one-way hash, and we record when and by which Account it was redeemed (the Account is removed from that record when it is closed). We never receive or store your full card number, its expiry date or its security code.

3.5Dana Dive booking data (when available): the Provider Services you request, the dates, the number and names of the participants, the details you provide for the Provider (such as certification level, equipment sizes or special requests), the messages related to the Booking, the amount and status of the Service Fee, and your Booking history.

3.6Technical and security data: your IP address, your browser/device user agent, the date and time of your requests and the address of the page you requested (for some sign-up and password-recovery links, this address includes a single-use link token). This data is recorded in the access logs of our web server, which are rotated automatically and kept for a limited period, and it is used to operate and secure the Services and to investigate abuse. The counters that limit repeated attempts are held in memory for a short time and are not stored. Your IP address and user agent are also stored as part of the acceptance record described in Article 3.7. The application itself is designed not to write your email address in clear text to its operational logs.

3.7Acceptance record: when you accept the Terms of Service and this Policy, we record the identifier, version and cryptographic hash of each document, the date and time, your interface language, the way you signed up, your IP address and your browser/device user agent.

3.8Communications: if you write to us, we keep your message and your contact details.

3.9We do not intentionally collect sensitive data such as health data, precise geolocation, biometric data or government identifiers, and Fins Tribe does not request access to your camera, microphone or location. Please do not include sensitive data in your comments or in your messages to us. Data that stays only on your device is described in Article 7.

4. SOURCES OF PERSONAL DATA

4.1We obtain personal data directly from you; automatically from your device when you use the Services; from Scuba Sign App, as described in Article 3.2; from our payment processor (the status of your payments); and, when Dana Dive Bookings are available, from Providers (the status of your booking requests). We do not buy personal data from data brokers.

5. PURPOSES OF PROCESSING

5.1We use personal data to: (a) create and manage your Account and authenticate you; (b) provide the features of the Services in your language; (c) present experience surveys to you, share your answers with the Dive Shop or Provider concerned and calculate aggregate ratings; (d) process donations; (e) when available, transmit your booking requests to Providers, charge and refund the Service Fee and send you messages about your Bookings; (f) send you service emails, such as account confirmation and password reset; (g) keep the Services secure, prevent fraud, abuse and automated attacks, and enforce our Terms; (h) attribute sign-ups to the Dive Shop that invited you, in aggregated form; (i) keep evidence of your acceptance of our documents and of your transactions, comply with our legal, tax and accounting obligations, and establish, exercise or defend legal claims; and (j) maintain and improve the Services using aggregated or de-identified information.

5.2We do not use your personal data for advertising, we do not build advertising profiles, and we do not take decisions that produce legal effects for you based solely on automated processing.

5.3We currently send only service-related emails. If we introduce newsletters or promotional emails, we will do so only in accordance with applicable law, and every such message will include a way to unsubscribe.

6. LEGAL BASIS FOR PROCESSING

6.1We process your data on the basis of: the performance of our contract with you (the Terms of Service), to provide your Account, the Services, the payments and the Bookings; our legitimate interests in operating and securing the Services, preventing fraud, keeping evidence, producing aggregated statistics and improving the Services; your consent, where we ask for it (for example, when you choose to answer a voluntary survey), which you may withdraw for the future; and our legal obligations, such as keeping tax and accounting records and answering lawful requests from authorities.

7. COOKIES, DEVICE STORAGE AND SIMILAR TECHNOLOGIES

7.1The Services do not use advertising or analytics cookies and do not embed third-party trackers, advertising networks or social-media plug-ins.

7.2Fins Tribe stores the following in your browser's local storage and cache: the session tokens that keep you signed in; your language and display theme; the species you marked as seen, your filters and your selected dive site; your encyclopedia reading progress and saved articles; the installation and offline-download status; the token of the invitation link you used to create your Account, kept so that an interrupted sign-up can be resumed; and an offline copy of the application, the species data and the images. This information stays on your device and is not sent to us, except for the session tokens, which are sent to authenticate your requests. You can delete it at any time by clearing the site data in your browser or uninstalling the application; doing so signs you out and erases your personal lists.

7.3Fins Tribe does not use advertising or analytics cookies, does not load third-party scripts, and does not include third-party trackers.

7.4Payment pages are hosted by Stripe, which uses its own cookies and similar technologies under Stripe's privacy policy.

7.5Because we do not track you across third-party websites and do not sell or share your data for advertising, the Services do not respond differently to "Do Not Track" or Global Privacy Control signals. If our use of these technologies changes, this Article will be updated to describe them and how to control them.

8. HOW WE SHARE YOUR DATA

8.1Dive Shops: when you answer an experience survey, your rating and comment are made available to the Dive Shop concerned together with your name, your email address and the date of the dive. Dive Shops also see an aggregated count of the Accounts created through their invitations, which does not identify you.

8.2Providers (when Dana Dive Bookings are available): we share with the Provider the data needed to handle your booking request — your name, your email address, the participants, the services and dates requested and the details you provide for the Provider.

8.3Public aggregate ratings: we may publish average ratings of Dive Shops and Providers. They never include your name, your email address or your comment.

8.4Within our company: authorised personnel who operate and support Fins Tribe, Dana Dive and Scuba Sign App have access to personal data on a need-to-know basis.

8.5Service providers: we use third-party providers for hosting and infrastructure, content delivery and network security, email delivery, payment processing (Stripe), backup storage and monitoring. They process personal data on our instructions and only to provide their services to us. Stripe also acts as an independent controller of payment data under its own privacy policy.

8.6Legal reasons: we may disclose personal data where required by law or by a valid order of a competent authority, to protect the rights, property or safety of our users, the public or ourselves, to investigate fraud or security incidents, to contest a chargeback, or to establish, exercise or defend legal claims.

8.7Business transfers: if we are involved in a merger, acquisition, financing, reorganisation, sale of assets or insolvency proceeding, personal data may be transferred to the successor, which will remain bound by this Policy with respect to that data.

8.8WE DO NOT SELL YOUR PERSONAL DATA, we do not share it for cross-context behavioural advertising, and we have not done so in the preceding twelve (12) months. We share your personal data in other cases only with your consent or at your direction.

9. ONE ACCOUNT FOR FINS TRIBE AND DANA DIVE

9.1Fins Tribe and Dana Dive are operated by the same company, and the same Account identifies you in both. When you use Dana Dive with your Account, Dana Dive uses your Account identity (your email address and language) and, where relevant, the fact that you are a member of the Fins Tribe community, for example to apply community benefits. Your password is never shared with Providers or with any other third party.

9.2The Fins Tribe activity that is stored only on your device (such as the species you marked as seen) is not shared with Dana Dive or with Providers.

10. PAYMENTS

10.1Donations and Service Fees are processed by Stripe. Your card details go directly to Stripe; we receive only the confirmation of the payment and the limited details described in Article 3.4.

10.2The amounts that you pay directly to a Provider are handled by the Provider and its own payment providers, not by us.

11. INTERNATIONAL DATA TRANSFERS

11.1We are based in the United States and the Services are used by divers around the world. Your data is stored on servers operated by our hosting providers and is processed by service providers that may be located in countries other than your own, including the United States, whose data-protection laws may differ from those of your country. Where we transfer data internationally, we take reasonable steps to ensure that it remains protected consistently with this Policy. When you request a Booking with a Provider located abroad, your data is necessarily sent to that Provider's country.

11.2Transfers between our own servers: we operate servers in more than one region. When you register as an adult diver with a Dive Shop on one of them, your name, email address, Dive Shop, language and dive date are sent to the server that runs Fins Tribe, and the details of the Dive Shop are sent with them, so that your Account can be linked to your dive. Your survey answers (rating, comment, name, email address and dive date) are sent back to the server of the Dive Shop concerned. These transfers use encrypted, digitally signed connections between our own servers. We never send data about minors, medical data, photos, signatures or registration documents. This Policy applies to the data on every server.

12. DATA SECURITY

12.1Your data is transmitted over encrypted connections. Passwords are stored only as hashes produced by a modern algorithm designed to resist brute-force attacks. Sessions use short-lived tokens that are rotated. Sensitive forms are protected by rate limits and email verification. Access to personal data is restricted to what each role needs, and the data of our different products is kept in separate database schemas with separate access credentials.

12.2No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for choosing a strong password, keeping it secret and protecting your device. Tell us immediately at admin@scubasign.com if you suspect unauthorised access to your Account.

13. DATA RETENTION AND DELETION

13.1Account data is kept for as long as your Account is open. You can close your Account yourself at any time with the "Delete my account" option inside Fins Tribe (it asks for your password) or by writing to admin@scubasign.com from the email address of your Account. When you close it from the application, we immediately delete your Account record and your sessions, remove your Account from the unlock codes it redeemed, and anonymise the name and email address attached to your surveys; when you ask by email, we do the same within a reasonable time. The exceptions are described below.

13.2Survey responses: the name and email address attached to a survey are irreversibly anonymised three (3) years after the survey was created. The rating and the comment are kept after that without identifying you.

13.3Donation and payment records (including how many unlock codes were issued and whether each was redeemed) and, when available, Booking records are kept for as long as required for tax, accounting, fraud-prevention and legal purposes, even if you close your Account.

13.4Acceptance records (Article 3.7) are kept for the life of your Account and afterwards for as long as necessary to establish, exercise or defend legal claims.

13.5Technical security records (such as the identifiers of single-use links already used and session records) are kept for as long as needed to protect the Services. Web server access logs (Article 3.6) are rotated automatically and kept for a limited period. The counters used to limit repeated attempts are held in memory for a short time and are not stored.

13.6Deleted data may persist in encrypted backups for a limited period, until those backups are overwritten in the ordinary rotation cycle. Data stored on your device remains there until you clear it.

14. YOUR PRIVACY RIGHTS

14.1Depending on where you live, you may have the right to know what personal data we hold about you and to access it; to have inaccurate data corrected; to have your data deleted; to receive a copy of the data you provided in a commonly used, machine-readable format; to object to or restrict certain processing; to withdraw your consent for the future; and not to be discriminated against for exercising these rights. We extend these rights to all users where reasonably possible, subject to Article 14.2.

14.2We may keep the data that we need to complete a transaction, to detect security incidents and fraud, to comply with the law (for example, tax and accounting rules) or to establish, exercise or defend legal claims — including acceptance records and payment records — as well as survey content that has already been anonymised. Where we cannot fulfil a request, we will explain why.

14.3You can change your language within the application at any time and change your password through the password-reset feature and delete your Account yourself (Article 13.1).

14.4If a U.S. state privacy law applies to you: the categories of personal data we collect, the purposes and the categories of recipients are those described in Articles 3, 5 and 8; we do not sell personal data or share it for cross-context behavioural advertising; we do not use or disclose sensitive personal data for purposes that would give rise to a right to limit its use; you may use an authorised agent who provides written proof of authority; and you may appeal a decision on your request by replying to it.

15. HOW TO EXERCISE YOUR RIGHTS

15.1Write to admin@scubasign.com from the email address of your Account and tell us what you are requesting. We may ask for additional information to verify your identity, and we will not act on requests that we cannot verify.

15.2We will respond within a reasonable time and, in any event, within the period required by applicable law. Requests are free of charge unless they are manifestly unfounded or excessive.

15.3For data held by a Dive Shop, a Provider, Stripe or a third-party review site for their own purposes, please contact them directly.

16. CHILDREN AND MINORS

16.1The Services are open to people of all ages, and minors may create and use an Account. We handle a minor's personal data in the same way as that of any other user, as described in this Policy. Minors who are registered with a Dive Shop through Scuba Sign App are not invited to Fins Tribe by Scuba Sign App, and their registration data is not used by Fins Tribe. A parent or legal guardian who wants to review, correct or delete a minor's personal data, or to close the minor's Account, can contact us at admin@scubasign.com and we will act on the request; the Account holder can also delete the Account at any time (Article 13.1).

16.2When Dana Dive Bookings are available, an adult who requests a Booking may provide the names and details of minor participants solely so that the Provider can handle the Booking. By doing so, the adult confirms that they are the minor's parent or legal guardian, or are authorised by them.

17. SECURITY INCIDENTS

17.1If we become aware of a security incident that compromises your personal data, we will investigate it, take steps to contain it and, where required by applicable law, notify you and the competent authorities without undue delay.

18. THIRD-PARTY SITES AND SERVICES

18.1The Services may link to third-party websites and services (for example Tripadvisor, Providers' own websites or Stripe-hosted payment pages). Their own privacy practices govern the data you provide to them; we encourage you to read their policies.

19. CHANGES TO THIS PRIVACY POLICY

19.1We may update this Privacy Policy. Each version is identified by a version number, and the version you accepted is kept in our records. For material changes we will give you notice (by email or within the Services) and, where required, ask you to accept the updated Policy.

20. EFFECTIVE DATE AND VERSION

20.1This version (1.0.0) of the Privacy Policy is in effect as of its publication date shown in our records. Prior versions remain available on request.

21. PRIVACY CONTACT INFORMATION

21.1Questions about this Privacy Policy, and requests concerning your personal data, may be sent to admin@scubasign.com or by post to our registered office at 30 N Gould St Ste N, Sheridan, Wyoming 82801.