Last updated: 5 November 2026
EasyPass Scuba helps diving students prepare for water skills. This policy explains what data the app handles. You can use the app without an account: in that case your data stays on your phone.
Dronelab, registration no. 40003855421, Tūristu iela 2 - 5, Saldus, Saldus nov., LV-3801, is the data controller. Contact: app@b2c.lv.
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email, password (stored only as a salted hash), optional name | Your account, login and password recovery | Contract, Art. 6(1)(b) |
| Progress: lessons opened, skill ratings, pause plan, questions, experience level, chosen skill | To back up your progress and show it on your devices | Contract, Art. 6(1)(b) |
| Check-ins, moods, private notes and small wins | Stay on your phone. They reach our server only if you turn on "Back up my check-ins and notes" | Explicit consent, Art. 9(2)(a), because they may reveal information about your wellbeing |
| Ghost net reports: location, depth, visibility, object type, your note, photos, video or a link to them, and your email if you add it | To pass information about the net to the association "Vesala jūra" for net retrieval. Your email is kept separately and is used only if we need to ask you a question. Sent only when you tap Send. Your location is read only when you tap Save my location, never in the background | Consent, Art. 6(1)(a) |
| Subscription status and an anonymous purchase ID | To open the sections you paid for. Apple or Google handle your payment details, and we never see them | Contract, Art. 6(1)(b) |
| Crash reports (technical device and error details, no notes or email) | To fix errors. Off unless you turn them on | Consent, Art. 6(1)(a) |
| Short-lived server logs (route, time, IP address for rate limiting) | Security | Legitimate interest, Art. 6(1)(f) |
We do not sell your data, show ads, build advertising profiles or track you across other apps.
Hosting: Leaseweb, in Germany. Email delivery and our mailbox: Google Workspace. Google may process data outside the EU, under the European Commission's standard contractual clauses or another transfer mechanism allowed by the GDPR. Crash reports, if you opt in: a crash reporting provider, with data stored in an EU region. Subscriptions: Apple or Google, and RevenueCat, which checks purchases and may process data in the United States under standard contractual clauses. Ghost net reports: our reports mailbox, app@b2c.lv, hosted on Google Workspace, and the association "Vesala jūra" (reg. no. 40008312570), which receives only information about the net: location, depth, type, visibility, your note, and photos, video or links. It does not receive your email from us. If you choose to donate, you do so on the website of the association "Vesala jūra", which handles your payment under its own privacy policy. The app does not pass your data to it.
Until you delete your account. Ghost net reports are not stored on our server: they are kept in the reports mailbox for up to 12 months. Inactive accounts are deleted after 24 months of no use, with notice by email. Backups are overwritten within 30 days. Server logs are kept for 14 days.
You can access, correct, download or erase your data, withdraw consent and object to processing. In the app, go to Profile: Download my data and Delete my account and data. You can also delete your account on the web at account deletion page, or write to app@b2c.lv. Turning off backup erases your check-ins and notes from our server. You may complain to your data protection authority; in Latvia this is the Data State Inspectorate.
Data travels over encrypted connections (HTTPS). Passwords are stored only as salted hashes. Login tokens are stored in your phone's secure storage.
Accounts are for people aged 16 or over. Younger students should use the app without an account or with a parent or guardian's consent.
We will tell you in the app about important changes to this policy.