1. Introduction and scope
DiveFlow is a management platform for scuba diving centers, made up of a mobile app, an administration panel used by our team, and the servers behind them. This policy applies to the DiveFlow app, to this website, and to the information processed through them. It is written for dive-center owners and staff who use DiveFlow, and also describes how information about students (participants) that a dive center enters into DiveFlow is handled.
2. Company and contact details
DiveFlow is operated by NATechsys Intelligent Systems Private Limited.
- Email: info@natechsys.com
- Phone: +91 9995718367
3. Information collected
We collect only what DiveFlow needs to work. The categories are described in sections 4 to 9. DiveFlow does not use advertising SDKs, does not sell personal information, and does not collect your precise or approximate location.
4. Information users provide
- Registration details: your name, mobile phone number, email address and a password, and your dive center’s name and address (city, state, country) and, optionally, a logo.
- Profile: your name, email and an optional profile photo, and for team members the role or designation assigned by the dive center.
- Support and feedback: anything you send us through feedback forms, email, phone or WhatsApp.
5. Account and authentication information
- Your phone number is used to sign in and to send one-time verification codes by SMS. Codes are stored only as a hash, expire after a few minutes and can be used once.
- Passwords are stored only in hashed form; we cannot read them.
- Sign-in tokens are kept in your device’s secure storage and expire automatically.
- We record sign-in activity and administrative actions (for example registration approval or a change to a subscription) in an audit log used for security and accountability.
6. Student, participant, course, registration and business records
Dive centers use DiveFlow to record information about their students. Depending on the course form, this can include:
- Name, date of birth, gender, address, phone number and email address.
- Diving background: last dive date and place, certification level and number, and dive insurance (and policy number).
- Signed agreements and declarations, including digital signatures and, for minors, a parent or guardian’s signature.
- Answers to the medical screening questionnaire. This is health information and is treated as sensitive.
- Invoices, invoice customers and payment records, and subscription details of the dive center.
The dive center decides what to collect from its students and is responsible for having the right to do so, including consent from parents or guardians for minors. We process this information on the dive center’s behalf to provide DiveFlow. It is visible only to that dive center’s authorized users and to our authorized staff when needed to operate or support the service.
7. Documents and uploaded files
DiveFlow stores the images you add: a dive center logo and profile photos. Digital signatures are stored with the relevant form. Images are stored in cloud object storage (see section 14). DiveFlow does not currently accept general document uploads.
8. Location data
DiveFlow does not collect location data and does not request location permission.
9. Device, diagnostic and usage data
- The app asks for access to your camera or photo library only when you choose to add a photo or logo.
- Our servers keep technical logs (for example request time, IP address and error details) to keep the service secure and working.
- DiveFlow does not include third-party analytics, advertising or crash-reporting SDKs.
10. How information is used
- To create and secure accounts and verify your phone number.
- To provide DiveFlow: registrations, forms and PDFs, team and permissions, invoices and subscription status.
- To review new dive-center registrations before activating an account.
- To provide support, respond to requests (including account deletion) and send service messages such as verification codes.
- To protect the service, prevent misuse and meet legal obligations.
11. Account and service administration
Our authorized administrators can review registrations, assign or change subscription packages, suspend accounts that breach our terms or are overdue, and process deletion requests. Administrative actions are logged.
12. Legal bases and processing grounds
Where data-protection law requires a legal basis, we rely on: performance of our agreement with you (providing DiveFlow); your consent (for example, choosing to add a photo, or answering the medical questionnaire as a participant); our legitimate interests in securing and improving the service; and compliance with legal obligations. Where we process students’ information for a dive center, the dive center decides the purposes and we act on its instructions.
13. Sharing and disclosure of information
We do not sell personal information. We share it only:
- with the dive center that holds the record (a student’s information is shared with their dive center; team members see what their permissions allow);
- with the service providers in section 14, who process it for us;
- when required by law, legal process or to protect rights, safety and security;
- in connection with a business transfer, in which case this policy will continue to apply or you will be told of changes.
14. Service providers and infrastructure
- SMS delivery: Twilio sends one-time verification codes to phone numbers. Twilio receives the phone number and message text.
- Cloud storage: images (logos, profile photos) are stored with DigitalOcean Spaces (Singapore region).
- Hosting: the DiveFlow servers and database are hosted with our infrastructure provider.
- WhatsApp: the in-app support button opens WhatsApp so you can message us; that conversation is governed by WhatsApp’s own terms and privacy policy.
15. Data storage and retention
We keep information for as long as the account is active and as needed to provide DiveFlow. When an account is deleted at your request (see section 18) we delete or anonymise the account and its associated data. We may keep limited information for as long as needed for legal, tax or accounting obligations, security, and the resolution of disputes. Verification codes are short-lived and removed after use or expiry.
16. Security safeguards
- Information travels between the app, this website and our servers over encrypted (HTTPS) connections.
- Passwords and verification codes are stored hashed, and sign-in tokens are short-lived.
- Each dive center’s records are separated from other centers, and team access is controlled by role-based permissions.
- Verification-code requests and sign-in attempts are rate limited, and administrative actions are logged.
No system is completely secure, and we cannot guarantee absolute security. Please keep your phone and password safe and tell us promptly if you suspect misuse of your account.
17. User rights and choices
Subject to applicable law (including India’s Digital Personal Data Protection Act, 2023, where it applies), you may ask us to give you access to the information we hold about you, correct inaccurate information, delete it, or restrict or object to certain processing, and you may withdraw consent you have given. You can update your profile in the app. Students should contact their dive center, which controls their records; we will help the dive center respond. To make a request, contact us at info@natechsys.com.
18. Account deletion and data deletion
You can ask us to delete your account and associated data at any time, without signing in, at our account deletion page. We verify the request, then delete or anonymise the account and its data, except information we are required or entitled to keep for the reasons in section 15. Deleting an account is permanent and is different from signing out, suspending or deactivating it, none of which delete your information.
19. Children and age restrictions
DiveFlow is intended for dive-center professionals and is not directed at children. Dive centers may record information about participants who are minors, together with a parent or guardian’s signature; the dive center is responsible for obtaining the required consent. If you believe a child has used DiveFlow to create an account, contact us and we will take appropriate steps.
20. International data transfers
Our service providers may process information outside your country. For example, SMS messages are processed by Twilio and images are stored in Singapore. Where information is transferred internationally, we take steps intended to give it appropriate protection, as required by applicable law.
21. Policy changes
We may update this policy as DiveFlow or the law changes. The “Last updated” date above shows the latest version, and we will give additional notice of material changes where appropriate.
22. Contact details
NATechsys Intelligent Systems Private Limited
Email: info@natechsys.com
Phone: +91 9995718367