Privacy Policy

Last updated: July 18, 2026

ScubaShop is operated by EmberCrest LLC (dba ScubaShop). This policy explains what personal data we handle, in which role, and what rights you have. The short version: we handle data to run dive shops, we do not sell it, and we do not run ads or trackers.

Two roles: controller and processor

ScubaShop serves dive shops, and each shop stores records about its own customers. That means we act in two different roles:

• For shop owners and staff accounts we are the data controller: we decide how account and billing data is used to provide the service.
• For a shop's customer records (divers, students, trip travelers) we are a data processor: the shop is the controller, and we store and process that data on the shop's instructions. If you are a diver whose data lives in a shop's ScubaShop account, your first point of contact for privacy requests is that dive shop.

What we collect

• Account data: names, email addresses, roles, and login records for shop staff and platform accounts.
• Shop business data: whatever your shop enters to run its business, which can include customer names, contact details, dates of birth, certification history, signed waivers (which may include health-related statements your shop collects), rental and purchase history, trip rosters and photos.
• Payment data: card payments are processed by Stripe. Card numbers never touch or get stored on our servers; we keep only references (such as a payment id, amount and status).
• Technical data: server logs (kept 7 days) and error reports via Sentry, which are configured not to include personal information by default.

What we do with it

We use data solely to provide, secure, support and improve the service: running your shop's app, sending transactional email (receipts, confirmations, reminders, invites), processing payments, preventing abuse, and diagnosing errors. We do not sell personal data, we do not share it with advertisers, and we do not use it to train AI models.

Where it lives and how it is protected

• Each shop's data is kept fully isolated; shops cannot see each other's data.
• All traffic is encrypted in transit.
• Files (waivers, photos, documents) are stored in private object storage, prefixed per shop.
• Backups run continuously and are encrypted before leaving the cluster; see the Security page.
• A short list of vetted providers helps us run the service; see Subprocessors. Data is hosted in the United States.

How long we keep it

• Active shop data: as long as the shop subscribes.
• After cancellation: 90 days for export, then permanent deletion. Encrypted backups age out on their own schedule within about 30 days after that.
• Server logs: 7 days.

Your rights

Depending on where you live (including under GDPR and similar laws), you may have rights to access, correct, export, delete, or restrict the use of your personal data. Shop owners can export their shop's full data from the app at any time. If you are a shop's customer, contact your dive shop first (as the controller); we support shops in fulfilling these requests. For anything else, or if you cannot resolve a request with a shop, contact us at privacy@scubashop.io and we will respond within 30 days.

Children

ScubaShop is business software and is not directed at children. Dive shops do enroll minors in courses (junior certifications); records about minors are entered by the shop, which is responsible for obtaining the necessary parental or guardian consent.

Changes

If we make material changes to this policy we will notify shops inside the app or by email before the changes take effect, and update the date at the top of this page.

Contact

EmberCrest LLC (dba ScubaShop), privacy@scubashop.io.