Skip to content
Open the app

Privacy Policy

Last updated: 21 October 2026

1. Who we are

DiveHive is operated by AppMinds.dev Inc., a company incorporated in the Philippines (SEC registration no. 2026070257796-63), Behind Aya's Swiss Bakery, Sto. Niño, Puerto Galera, Oriental Mindoro 5203, Philippines ("DiveHive", "we"). Contact for privacy questions: support@divehive.app. Data protection officer: being appointed; until then, please contact support@divehive.app.

2. Our roles: controller and processor

  • DiveHive is the controller of your diver account and your personal data in it: your profile, certifications, personal dive logbook, buddies, follows, notification settings and sign-in data. DiveHive is also the controller of the account data of dive shop owners and staff and of the subscription data of shops.
  • DiveHive is the processor of the data a dive shop collects about its customers through DiveHive: waivers, medical questionnaires, bookings, guest records and notes. The dive shop is the controller of that data. The terms are in the Data Processing Agreement.
  • Where a diver shares a dive log with a shop, the shop is the controller of its own copy and DiveHive remains the controller of the diver's own record.

3. What we collect

  • Account data: name, email address, sign-in provider (email code, Google, Apple, Facebook).
  • Diver profile: nationality, birth date, emergency contact, gear sizes, privacy settings (all optional).
  • Logbook: dives, sites, sightings, achievements.
  • Documents: certification card photos you upload; waivers and medical forms you sign for a shop (held for the shop, see section 2).
  • Shop and subscription data: business name, locations, billing country and subscription status. Card and payment details for subscriptions are handled by Paddle, our reseller and Merchant of Record; we do not receive or store card numbers.

<!-- D165 draft: lawyer review before Plus goes on sale -->

  • DiveHive Plus: if you subscribe, we keep your subscription status, plan, renewal and cancellation dates, and a reference from Paddle or the app store. Card and payment details are handled by Paddle (web) or Apple or Google (in-app purchase); we do not receive or store card numbers. Photos and short video clips you upload to use your Plus storage are your content: we store them in your home region, remove GPS location data from them by default, and scan uploads for illegal content before they can be shared.
  • Booking payments: when a diver pays a shop online, the payment is made to the shop's own merchant account through the payment provider the shop has chosen. We see the status and reference of the payment so that the booking can be marked as paid, not the card details.
  • Technical data: session records, push notification tokens, security logs.
  • Analytics and marketing: only if you consent. Medical and document data is never sent to analytics.

4. Why we use it and the legal basis

  • To provide the service and to manage your account and subscription (contract).
  • To keep the service secure and prevent abuse and fraud (legitimate interests).
  • To send service messages such as booking updates and safety alerts (contract, legitimate interests).
  • To meet our legal duties, for example tax and accounting records (legal obligation).
  • Health data that you or a shop enter, such as medical questionnaire answers: only for the purpose you gave it for, with your explicit consent or as the shop's controller basis allows (GDPR Article 9; Sections 12 and 13 of the Data Privacy Act of 2012, Republic Act No. 10173).
  • Optional analytics and marketing (consent, which you can withdraw at any time in your privacy settings).

5. Philippine Data Privacy Act of 2012

We process personal data in line with the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules. Under Section 16 you have the right to be informed, to object, to access, to rectify, to erasure or blocking, to data portability and to damages. If a personal data breach puts your rights at risk, we notify the National Privacy Commission and the people affected within 72 hours of becoming aware of it. You can complain to the National Privacy Commission (privacy.gov.ph). Where the law requires us to register a data processing system with the Commission, we do so.

6. GDPR (European Economic Area and United Kingdom)

If you are in the European Economic Area or the United Kingdom, the GDPR gives you the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. Our lawful bases are listed in section 4. You can lodge a complaint with the data protection authority of your country. To use your rights, write to us at the contact in section 15.

7. Sharing

  • Dive shops you book with see the data needed for your booking and documents.
  • Service providers (processors): hosting (Singapore), email delivery, push notifications, weather data, on-demand translation (DeepL SE, Germany; only the text you or another user asks to translate), and, if you consent, product analytics.
  • Paddle.com, as reseller and Merchant of Record for shop, club and DiveHive Plus subscriptions, receives the billing details a shop enters at checkout and acts as an independent controller for them.
  • The payment provider a shop connects (for example Stripe, Xendit or PayMongo, depending on the country) processes payments from divers to that shop, under the shop's own agreement with it.
  • Authorities, if the law requires it.
  • We never sell personal data.

8. International transfers

DiveHive is operated from the Philippines and hosted in Singapore, and our users and shops are in many countries, so personal data moves across borders. We use contracts with our providers that require an appropriate level of protection, including standard contractual clauses where the GDPR requires them. For the Philippines, we rely on the accountability rules of the Data Privacy Act.

9. Retention

  • Your account data is kept while your account exists. When you delete your account it is scheduled for deletion and removed after 30 days (you can cancel within that time).
  • Records held by a dive shop (signed waivers, medical forms, bookings) stay with that shop under its own retention period and are not deleted with your account.
  • Exports of your data are available for 7 days.
  • Security and server logs (IP addresses, sign-ins, errors) are kept for up to 90 days. The business audit log of a shop (deletions, retention changes, document downloads, role changes) is kept for as long as the account exists. Backups are rotated on a fixed schedule, and deleted data leaves them when they expire.
  • Records that the law requires us to keep, such as accounting records, are kept for as long as the law requires.

10. Your rights and how to use them

  • Access and portability: request an export of your data in the app (Settings, Export my data).
  • Correction: edit your profile in the app.
  • Deletion: Settings, Delete account.
  • Consent: change your analytics and marketing choices in Settings, Privacy and consent.
  • Questions or complaints: support@divehive.app.

11. Security

We protect personal data with encryption in transit, role-based access control, separation of medical data (visible only to the diver and to the shop's owners and administrators), logging of access to sensitive records, regular backups, and signed and sealed PDFs for waivers and medical forms. No system is perfectly secure; if something goes wrong we act as described in sections 5 and 6.

12. Children

You must be at least 16 to open your own DiveHive account. Divers under 16 can only use DiveHive through a junior profile that a parent or legal guardian creates and manages; a junior aged 13 to 15 can also get their own login if the guardian invites them. Divers under 13 never have their own login. A guardian signs waivers and medical forms for a minor and gives the consents. Minors are excluded from social features with strangers, from personalised recommendations and from marketing prompts.

13. Cookies

DiveHive uses essential cookies for sign-in and security. Analytics and marketing cookies are only set after you agree in the cookie banner.

14. Changes

We may update this policy. For material changes we tell you by e-mail or in the app at least 30 days before they take effect. The date at the top shows the latest version.

15. Contact

AppMinds.dev Inc., Behind Aya's Swiss Bakery, Sto. Niño, Puerto Galera, Oriental Mindoro 5203, Philippines (SEC registration no. 2026070257796-63). E-mail: support@divehive.app. Data protection officer: not appointed.