Last updated: November 2026

Privacy Policy

At theoceanguide.com we respect your privacy and are committed to protecting the personal data you share with us, in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Spain's Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). You do not need to give us any personal data to browse the site.

1. Data Controllers

  • Joint controllers: Francisco Hernández Vich and Bruno Pardo Subira.
  • Postal address: Sa Rectoria, 15, 07100 Sóller, Balearic Islands, Spain.
  • Contact email: support@theoceanguide.com

Full identification details, such as tax ID numbers (NIF), are available to users and the competent authorities upon formal request to the contact email.

You can exercise your rights with either of them.

2. What Data We Collect, Why and on What Legal Basis

We process your personal data for the following purposes and on the following legal bases:

A. Browsing and security

  • Data: IP address, browser type, operating system and pages visited.
  • Purpose: Delivering the pages and maps, protecting them against attacks and keeping the site running smoothly.
  • Legal basis: Our legitimate interest in keeping the site secure and running (Art. 6(1)(f) GDPR).

B. Web analytics and cookies

  • Data: Visit statistics from Google Analytics: pages viewed, approximate country, device and browser.
  • Purpose: Measuring our audience with aggregated data to understand what people look for and improve the site. Google Analytics runs without any advertising features.
  • Legal basis: Your consent (Art. 6(1)(a) GDPR), which you give or withdraw in the cookie banner.
  • Cookies: In the European Economic Area, the United Kingdom and Switzerland, Google Analytics is not loaded until you accept it, so nothing is sent to Google before then. Elsewhere it runs from your first visit and you can turn it off at any time. When it runs, it sets its own cookies to recognise returning visits. We also store one small cookie with your answer to the cookie banner, so we do not ask again on every visit. You can change your answer at any time with the "Cookie settings" button just below.

C. Your account

  • Data: Your email address, your profile details (name, photo, user name, bio and country), your language and unit preferences, and what you add to your account: dives, photos, recorded species and saved places. While you are signed in, we also keep the IP address and browser your session was opened from, to protect your account. If you join through someone's invite link, we also keep who invited you. They only see how many people have joined and logged a dive, never who.
  • Purpose: Creating and managing your account, keeping your dive logbook and connecting with other members. You sign in with a code we email you or with your Google or Apple account. If you use Google, it shares your name, email address and profile photo with us, and that photo is loaded from Google until you upload your own. If you use Apple, it shares your name and email address with us. If you choose to hide your email, we receive a private address from Apple that forwards our messages to you.
  • Legal basis: Performance of the contract you accept when you create your account, that is, our Terms and Conditions (Art. 6(1)(b) GDPR). Session records rely on our legitimate interest in protecting accounts (Art. 6(1)(f) GDPR).
  • Profile visibility: Your profile is public by default: anyone can see your name, photo, user name, bio, country and when you joined, your dives (with their photos, notes, depth profiles, cylinders, gas and weight, the species seen and the dive buddies you add) and the places you have dived or saved. Your email address is never shown. If you make your profile private, your dives, species and dive passport are visible only to you and the followers you accept. Your name, user name and photo remain visible. Whether your profile is public or private, signed-in members can find you by typing the start of your user name or of any word in your name, to tag you as a dive buddy or ask to follow you, and we list the people they are connected to first. If you sign up with an emailed code, the name we suggest is the part of your email address before the @, and it stays your name until you change it, so check it when you set up your profile.

D. AI identification

  • Data: The photo or description you send to Ask AI and, for each request, when you made it and whether it was a photo or a description.
  • Purpose: Identifying the species with an external AI service and applying the monthly usage limits.
  • What we keep: We do not store your photos or descriptions, and we do not use them to train models or to identify people. Usage records from past months are deleted the next time you use the feature. If you ask us to add a species, we keep that request linked to your account.
  • Legal basis: Providing the service you request (Art. 6(1)(b) GDPR).

E. Dive sites suggested by members

  • Data: The site's name and the point you mark on the map when you log a dive at a site that is not on our list yet.
  • Purpose: Reviewing those sites and adding them to the list of dive sites every member can choose from. A site added this way does not show who suggested it, and your dives there stay as public or private as the rest of your logbook.
  • Legal basis: Our legitimate interest in improving the shared catalogue of dive sites (Art. 6(1)(f) GDPR).

F. PRO subscriptions and passes

  • Data: If you go PRO, your customer ID with our payment provider, the status of your subscription and the passes you buy. Your card details are handled directly by that provider and never reach us.
  • Purpose: Charging the subscription or passes and giving you access to PRO features.
  • Legal basis: Performance of the purchase contract (Art. 6(1)(b) GDPR) and compliance with our tax obligations (Art. 6(1)(c) GDPR).

3. How Long We Keep Data

  • Your account: for as long as you keep it. You can delete it under Settings, or ask us by email to do it. When you delete it, we erase your profile, dives, photos and the rest of your account data, and cancel your subscription straight away if you have one. Automatic database backups are gone within 30 days. If other members had tagged you as a dive buddy, their dives keep the name they wrote, without a link to your profile.
  • Sessions: each session record (IP address and browser) expires after 90 days without use and is deleted when you sign out or delete your account.
  • Technical logs: our hosting provider keeps them for a limited time, under its own policy.
  • Analytics: Google Analytics keeps the data for the retention period we have set, which is 14 months at most.
  • Payments: our payment provider keeps payment records for as long as the law requires, even if you delete your account.

4. Recipients and International Transfers

We do not sell your personal data or share it with third parties for commercial purposes. To run the site, we share it with providers in these categories:

  • Hosting and infrastructure: servers, database, photo storage, email delivery and protection against attacks.
  • Analytics: Google Analytics, as explained in section B.
  • Sign-in: Google or Apple, if you choose to sign in with your account with them.
  • App notifications: Google (Firebase Cloud Messaging) and Apple, if you allow notifications in the app. They receive an identifier for your device and the text of each notification, which can include another member's username and the start of their comment.
  • Artificial intelligence: the service that analyses the photos and descriptions you send to Ask AI.
  • Payments: the platform that processes payments for PRO subscriptions and passes.

In addition, when a page shows a map or a photo of an animal that is not in the guide, your browser connects directly to the map service or to the platform the photo comes from, which receive your IP address. Those photos belong to the authors credited on them. When you ask for an emailed code on the website, your browser also connects to our bot protection service, which receives your IP address and technical details of your browser to check that a person is asking.

International transfers: Some of these providers, like the platform the animal photos come from, are based in the United States or may process data there. The transfers we make are covered by the EU-US Data Privacy Framework, recognised by the European Commission through an adequacy decision, or by standard contractual clauses.

If you want to know exactly which providers we use, write to support@theoceanguide.com and we will tell you.

5. Children

The site is not aimed at children under 14. If you are under 14, you need permission from a parent or guardian to create an account or accept Google Analytics. If we find that we have collected data from a child under 14 without that permission, we will delete their account and data.

6. Your Rights

The GDPR and the LOPDGDD give you these rights:

  • Access: to know what data we process about you.
  • Rectification: to correct inaccurate or incomplete data.
  • Erasure ("right to be forgotten"): to ask us to delete your data.
  • Objection and restriction: to object to certain processing or ask us to restrict it.
  • Portability: to receive your data in a structured, commonly used and machine-readable format.
  • Withdrawal of consent: at any time, for processing based on it, such as Google Analytics. Withdrawing it does not affect processing carried out before.

To exercise them, write to support@theoceanguide.com, from your account's email address if you can. We will only ask for proof of identity if we have reasonable doubts about who is making the request. We will reply within one month of receiving it.

If you think we have not handled your rights properly, you can file a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es.

7. Changes to This Policy

We may change this policy to reflect changes in the law or in how the site works. The date at the top always shows the current version. If a significant change affects your rights or something you consented to, we will let you know or ask for your consent again.