OceanLog — Privacy Policy

Version 1.0 · 13 August 2026

Who we are

DSM Mallorca SL, trading as OceanLog, is the data controller for the personal data described here. Registered office: Pons i Gallarza 3A, 7B, 07004 Palma de Mallorca, Spain.

Contact for anything in this policy, including privacy requests: xisco@oceanlogapp.com. Security disclosures: security@oceanlogapp.com (see security.txt).

We have not appointed a Data Protection Officer; we are not required to.

What we collect, why, and on what legal basis

Data	Why	Legal basis
Account — email, and anything you choose to add: name, preferred name, pronouns, sports, home base, language, units.	To create your account, sign you in and run the service.	Performance of a contract (Art. 6(1)(b)).
Sessions you log — date, duration, spot, conditions, gear, wave counts, your written notes and reflections.	This is the logbook. It is the service.	Performance of a contract (Art. 6(1)(b)).
Health data — heart rate, heart-rate variability, effort, calories, and any body or wellbeing figures you enter or import from a watch. Precise location — spot coordinates and GPS tracks.	To show your session on a map, to compute distance, speed and effort, and to write your reports. These are special-category data (Art. 9).	Your explicit consent (Art. 9(2)(a)), given at sign-up. You can withdraw it at any time — see Your rights.
Photos you attach to a session or a board.	To show them back to you. We strip EXIF/GPS metadata on upload, so a photo cannot leak where you surf.	Performance of a contract (Art. 6(1)(b)).
Accessibility and adaptive-sport information, if you choose to provide it.	To adapt the app and the coaching voice to you.	Your explicit consent (Art. 9(2)(a)).
Technical — sign-in tokens, device/browser basics, error reports.	To keep the service working and secure.	Legitimate interests (Art. 6(1)(f)): running a service that functions.

Providing account data is necessary to have an account. Everything else is optional — the app works without health data, without location and without photos, and says so where it asks.

Artificial intelligence

OceanLog uses AI, and we tell you where. Your session reports and the in-app assistant (I.A.N.) are generated by an AI system. Every generated report carries a notice saying it was written by AI. The assistant identifies itself as artificial.

Who processes it: the text of your sessions — including the health figures a report discusses — is sent to Anthropic (Claude models) to generate the report, as our processor. Your photos are never sent to the AI.
No automated decisions about you. Reports are written commentary. Nothing in OceanLog makes an automated decision that produces legal or similarly significant effects (Art. 22). No score here ranks you against anyone else.
Under Article 50 of the EU AI Act, you are being informed that you are interacting with an AI system and that its output is artificially generated.

Who else processes your data

Processor	What for	Where
Supabase	Database, authentication, file storage	EU
Vercel	Hosting and delivery of the app	EU/US
Anthropic	Generating your AI reports and assistant replies	US
Resend	Transactional email (sign-in, reminders, invites)	EU/US
Open-Meteo · Stormglass	Weather, marine and tide data for a spot	EU
Google Drive	Only if you choose to export or upload to your own Drive	EU/US

Where a processor is outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses together with the safeguards in that provider's own data-processing terms.

We do not sell your data, and we do not use it for advertising. There is no advertising in OceanLog.

Coaches, friends and sharing

Nothing is shared unless you share it. If you link a coach, they see the sessions and reports you have shared with them — including special-category data where you have specifically allowed that. Each sharing switch is separate, you control it, and you can stop it at any time. Health, body and mobility data stay yours alone unless you explicitly approve sharing.

Secret spots

Any session or spot you mark secret is location-hidden: never shown to a coach or a friend, never surfaced by the AI, never named in any public total, and its photos never carry the location.

While we are in beta

During the beta, the operator may review logged sessions and generated reports in order to test and improve the service. You consent to this at sign-up, it is limited to improving OceanLog, and it will end when the beta does. It has never included, and will never include, selling or advertising.

How long we keep it

Your account and your log: for as long as you have an account.
If you delete your account: your data is deleted. We keep only a minimal, hashed record that an erasure happened, with no personal data in it, to prove the request was honoured.
Backups: deleted data disappears from backups as they age out. Our backup retention is 7 days.
Email and error logs: up to 12 months.

Your rights

You can access, correct, export, delete or restrict your data, object to processing, and withdraw consent at any time — in the app, or by emailing us. Withdrawing consent does not affect processing that already happened. Export is built in: your log is yours and you can take it with you.

If you think we have got this wrong, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos — aepd.es — or to the authority where you live.

Security

Data is stored in the EU with per-user row-level security, so one rider's data is not reachable by another. Sign-in supports two-factor authentication. We publish a security contact and respond to disclosures.

Children

OceanLog is used in adaptive and youth sport. Where a rider is under the age at which they can consent for themselves, the account must be set up and consented to by a parent, guardian or the supervising organisation.

Changes

If we change this policy we will update the version and date above, and tell you in the app when the change is material.