Privacy Policy

1. Who we are

Abyss ("we", "us") is a digital logbook and social platform for certified scuba divers, operated by Filippo Bonazzoli. This policy explains what personal data we collect, why, and how we handle it under the GDPR. We are the data controller for the personal data described here.

2. Data we collect

• Account: email, password (hashed — we never see or store it in plain text), display name, username, date of birth (used only to verify you're 18 or older).
• Certification: agency, level, number, and a photo of your card, plus — if you submit it for verification — the instructor you name and their confirmation decision.
• Dive data: sites, coordinates, depths, durations, gas, photos, notes, and who validated the dive (a buddy, a dive centre, or an instructor).
• Location: if you use the map, your device's precise location is requested only to centre the map view — used on your device, not stored on our servers unless you separately save a dive with a location you chose.
• Business & instructor profiles: for dive centre and instructor accounts, the business/contact details you choose to make public (address, phone, WhatsApp, email, booking link, agencies taught).
• Social activity: follows, comments, likes, group memberships, reports you submit, and who you've chosen to block (never shared with the blocked person).
• Payments: your subscription plan and billing provider (Stripe or Google Play). We never receive or store your card number — that's handled entirely by Stripe or Google.
• Technical: device type, language, and anonymised crash/error reports used to fix bugs — never linked to your dive content.

3. How we use it

To run your account, verify your age and certifications, show your logbook to the people you've chosen, connect you with the dive centres and instructors you interact with, process payments, generate aggregated community statistics, and fix bugs.

4. We do not sell your data

We do not sell, rent, or trade your personal data to anyone, for any purpose — this is a firm policy, not just a legal minimum. We share data only in these cases: with infrastructure providers who process it strictly on our behalf and under a data-processing agreement (our database and file storage, our payment processors, our hosting provider, and an error-monitoring tool); when required by law; or if you separately choose to use a third-party service linked from the app, such as DAN insurance (see below) — in that case, you provide your own information directly to that third party, and we do not share your Abyss data with them.

4bis. DAN and other third-party services

If Abyss offers a link or referral to DAN (Divers Alert Network) or another dive insurance or safety service, clicking it takes you to that organisation's own site or process. We do not transmit your Abyss account data to them automatically; any information you provide to DAN is governed by DAN's own privacy policy, not this one.

5. International transfers

Some of our infrastructure providers may process data outside the European Economic Area. Where that happens, we rely on safeguards recognised by the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

6. Your rights

You can export all your data or permanently delete your account from Settings → GDPR. Under the GDPR you can also request access, rectification, erasure, restriction, portability, or object to our processing, by emailing abyss@allblue.it. If you believe we haven't handled your data correctly, you have the right to lodge a complaint with the Garante per la Protezione dei Dati Personali (the Italian data protection authority), garanteprivacy.it, or your own country's equivalent authority.

7. Minors

Abyss requires all users to be at least 18 years old, with no exception — we do not knowingly collect data from anyone under 18. If we become aware that a minor has created an account, we will delete it.

8. How long we keep your data

We keep your data while your account is active. Deleting your account removes your profile, dives, comments, and social activity within 30 days. Records we're required to keep for tax or accounting purposes, such as invoices, are retained separately for the period required by law, even after your account is deleted.

9. Security

Data is encrypted in transit (HTTPS). Access to your data inside our database is restricted row-by-row, so that, for example, another user's app session cannot read your private dives even if our own application code had a bug — not just a promise, but an enforced database rule. Only the access each part of the app actually needs is granted.

10. Automated decisions

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Content moderation may be assisted by automated tools, but every decision to block or remove content or an account is made by a person.

11. Contact

For any privacy question, write to abyss@allblue.it.