Privacy Policy

Last Updated: October 24, 2026

This Privacy Policy explains how Dive Connect, LLC, a Florida limited liability company ("DiveConnect," "we," "our," "us"), collects, uses, and protects information when you use DiveConnect.ai — our business-to-business dashboard, hosted websites and storefronts, AI crew, AI phone and messaging front desk, live translation, and phone, domain, and email services (the "Service"). This policy covers our B2B SaaS product; our consumer marketplace at Diveconnect.io has its own privacy policy.

Two roles. For information about your own account and business, and about how you use the Service, DiveConnect is the controller. For the personal data of your customers — including people who call, message, or book with your business through the Service — you are the controller and DiveConnect acts as your processor under our Data Processing Addendum.

Information We Collect

• Account & business information you provide — such as your name, email, phone, business name and address, and team members' details.
• Content you upload or generate — listings, trips, media, and text, images, audio, or video you create with our AI tools.
• Customer records you manage — information about your own customers, bookings, sales, and invoices (see "Data You Manage About Others" below).
• Calls & messages — when you use the AI phone front desk, phone interpreter, softphone, SMS, WhatsApp, or social inbox, we process the caller's or sender's phone number or handle, call audio, call transcripts, voicemails, call metadata (time, duration, outcome, language, cost), and message content, on your behalf.
• Domain registration data — registrant name, organization, email, phone, and address for domains you register through us, shared with the registrar as ICANN requires.
• Payment & billing information — subscription payments are processed by Stripe, and payments from your customers are processed on your own connected Stripe account; we do not store full card numbers on our servers.
• Compliance records — your acceptance of policies (accepting user, time, policy version, IP address) and the SMS opt-in and opt-out records of your recipients.
• Usage & device data — page views and feature usage (via our own analytics, Vercel Web Analytics, and PostHog, only with your consent), plus device, browser, and diagnostic/error logs.

How We Use Information

• To provide, maintain, secure, and improve the Service
• To answer, route, transcribe, translate, and log calls and messages on your instructions
• To generate the content and media you request with our AI tools
• To measure AI-credit usage, bill your subscription, and send transactional email
• To monitor for errors, review call quality and safety, prevent abuse, and enforce our terms
• To communicate updates and provide support

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

We do not sell personal information, and we do not use your content or your customers' data to train our own AI models.

Text Messages (SMS)

When you give a dive shop that uses DiveConnect.ai your mobile number (on its website booking or contact form, in its chat, or on a call with its phone assistant) and agree to receive texts, the shop may text you about your booking: booking confirmations, reminders, payment and waiver links, and replies to your messages. Message frequency varies. Msg & data rates may apply. Reply STOP to opt out at any time, or HELP for help. Texting is never a condition of booking. We keep a record of each opt-in and opt-out (the number, the shop, the time, where it was given, and the wording shown) to honor your choice. For help, contact support@diveconnect.ai. Our SMS Terms & Opt-In page covers the texts DiveConnect sends from its own numbers.

Legal Bases (EEA/UK)

Where the GDPR or UK GDPR applies, we process personal data to perform our contract with you (providing the Service), on the basis of our legitimate interests (securing and improving the Service and preventing abuse), to comply with legal obligations, and — for non-essential cookies and analytics — with your consent. When we process your customers' data, we do so as your processor on your instructions.

Cookies & Consent

We use strictly necessary cookies to run the Service, and — only with your consent — analytics cookies. Non-essential cookies are disabled until you accept them. You can change or withdraw consent at any time using the "Cookie preferences" link in the footer. For details, see our Cookie Policy. When a dive shop shares a link to its website on social media through our Service, we count each tap on that link — we store only the time; your IP address is used for about a minute to rate-limit repeated taps and is not kept, and no device or browser details are stored. If you then book on the shop's website, the booking is credited to that post in the shop's reports: the link's code travels in the page address, and only if you accept analytics cookies is it also kept in your browser's local storage for 7 days (removed if you withdraw consent).

Service Providers (Subprocessors)

We rely on the following providers to operate the Service. Each processes data on our behalf under contract and its own privacy terms, and only for the purpose listed:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting, the AI gateway that routes some AI requests to OpenAI, Google, and Anthropic, and — only with your consent — Web Analytics.
• Stripe — subscription billing, Stripe Tax, credit-pack and domain payments, and (on your own connected account) payments from your customers via Stripe Connect.
• Resend — sending transactional, account, and campaign email.
• Tucows / OpenSRS — domain registration (registrar of record) and hosted mailboxes on your domain.
• Fixie — a fixed-IP network proxy that carries our requests to the domain registrar, including registrant details.
• Twilio — phone numbers, call connection and routing, the softphone, voicemail, SMS, and recording of staff calls where a shop turns it on (each recording is moved to our storage and deleted from Twilio).
• Retell AI — the AI phone front desk: call audio, speech-to-text, AI voice, call transcripts, and call recordings.
• Soniox — speech recognition: real-time for the phone interpreter and voice translation (incl. caller-language detection), and transcription of recorded staff calls (deleted from Soniox once the transcript is stored).
• DeepL — translation of text and speech for the interpreter, the translated chat, and the inbox.
• Anthropic — Claude models for the AI crew, Lily, message and email drafts, call summaries, and content generation.
• OpenAI — text generation, embeddings for search over your own content, and speech features.
• Google — Gemini image generation (via the Vercel AI gateway).
• ElevenLabs — AI voice generation (text-to-speech) you request.
• Replicate — image processing such as background removal.
• Higgsfield — AI image, avatar, and video generation you request.
• HeyGen — AI talking-avatar video generation you request.
• TypeSafe and OpenRouter — structured AI decision checks, such as call-transcript quality and safety review and message triage (OpenRouter is a fallback route).
• Zernio — the social, WhatsApp, and SMS connector that publishes posts and sends and receives messages on your connected accounts.
• Apify — collecting public web and social pages you point us to (for example, your existing website or profiles).
• Serper — web image search for product and listing images you request.
• Upstash — rate limiting, caching, and a vector index of your own content.
• Fly.io — hosting for our real-time voice and interpreter servers and the AI crew's agent workers.
• Sentry — error and performance monitoring (legitimate interest), and — only with your consent — masked session replays.
• PostHog — product analytics and masked session replay, only with your consent; plus limited server-side service events that carry internal identifiers only.

Platforms you connect. When you connect Meta (WhatsApp, Instagram, Facebook) or other social accounts, messages and posts are exchanged with those platforms under their own terms, at your direction. Meta acts under its own terms, not as our subprocessor.

AI, Calls & Content Processing

When you use our AI features, the content needed to produce the result — your prompts and business details, a caller's speech, or a message you ask us to reply to or translate — is sent to the AI, speech, and translation providers listed above. These providers process it to return the result and under their own terms; we do not use it to train our own models. AI email and message drafts are shown to you for review; the AI phone and messaging front desk responds automatically only where you have switched that on. See our AI & Content Terms.

Call recordings & transcripts. Calls answered by the AI phone front desk are processed by Retell AI and Twilio and transcribed; the transcript and call details are stored in your dashboard, and a quality and safety check is run on the transcript. Our voice providers may also keep a recording of the call under their data-storage settings. Voicemails are recorded by Twilio and appear in your inbox. Live-interpreter calls are translated in real time and only the call's duration and cost are stored. By default every AI-answered call starts with a notice that the caller is speaking with an AI assistant and that the call may be recorded (see our WhatsApp Commerce & Telecom Terms).

Staff calls. Calls a shop's team places from the DiveConnect softphone, and calls they take over from the AI front desk, are logged in the shop's dashboard (who called whom, when, for how long). If the shop turns on Record staff calls (off by default), the other person hears “This call may be recorded for quality and records.” before being connected; the call is then recorded by Twilio, moved to our private storage and deleted from Twilio, transcribed by Soniox (which deletes its copy once the transcript is stored) and summarized by Anthropic. Recordings and transcripts are visible only to the shop's staff who may see customer contact details, every playback is logged, and they are deleted automatically after the retention period the shop chooses (365 days by default) or when the shop deletes them; the short summary stays with the call record unless the shop deletes the recording. Long digit sequences such as card numbers are removed from transcripts; staff can pause the recording while a caller reads out payment details, and shops should take payments by payment link, not over the phone.

Data You Manage About Others

If you are a dive shop, information you upload about your own customers, and the calls and messages the Service handles for you, are processed by us on your behalf: you are the controller of that data and we act as your processor under our Data Processing Addendum. You are responsible for having a lawful basis, any required consents, and your own privacy notice for the people whose data you enter or whose calls and messages the Service handles.

International Data Transfers

DiveConnect is based in the United States and our providers may process data in the U.S. and elsewhere. If you are in the European Economic Area, the UK, or Switzerland, we rely on appropriate safeguards for these transfers, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum where applicable.

Data Retention & Deletion

• Account and business data, customer records, call transcripts and call records, voicemails, and messages are kept while your account is open, so you can see your history, and are deleted when you delete your account (see Data Deletion). You can also ask us to delete specific call recordings or transcripts sooner.
• Booking forms that travelers complete for a shop are kept for 7 years by default. Medical-form answers and uploads, and certification-card photos (counted from the dive date), are deleted automatically after 1 year by default. Each shop can change these periods in its booking form settings.
• Billing and tax records are kept by us and Stripe for as long as tax and accounting law requires, even after account deletion.
• Policy-acceptance and SMS consent records are kept as compliance evidence for as long as needed to demonstrate consent.
• Data held by our providers (for example call recordings at our voice providers, or error logs) is kept under their retention settings and deleted on our request when you ask us to delete it.

Your Rights

Depending on where you live, you may have rights over your personal data:

• EEA/UK (GDPR): to access, rectify, erase, restrict, and port your data, and to object to processing or withdraw consent. You may also complain to your local supervisory authority.
• California (CCPA/CPRA): to know what personal information is collected, to delete it, to correct it, and to opt out of any "sale" or "sharing." Dive Connect, LLC does not sell or share your personal information for cross-context behavioral advertising.

To exercise these rights, contact us at privacy@diveconnect.ai. If you are one of our customers' own customers or callers, please contact that business (the controller of your data) directly; we will help them respond.

Children's Privacy

The Service is a business tool intended for adults 18 and older. It is not directed to children, and we do not knowingly collect personal information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new policy here, revise the "Last Updated" date above, and notify you of material changes by email or in the dashboard.

Contact

Dive Connect, LLC
7901 4th St N Ste 27295, St Petersburg, FL 33702, USA
Privacy requests: privacy@diveconnect.ai
Support: support@diveconnect.ai