Privacy Policy

Last updated: November 5, 2026

1. Who we are

Ascent is a SaaS platform for managing scuba diving courses, certifications and student records for professional dive centers. This policy applies to the Ascent website (ascent-diving.com) and the Ascent application (app.ascent-diving.com).

Ascent is operated by RED, a sole proprietorship registered in Quebec (NEQ 2273106965).

For student and staff records, the dive center collects the information and is responsible for it: Ascent acts as its service provider and processes the information only to provide the service. Ascent is responsible for the information collected by this website and for what divers record in their personal space outside a dive center's activities.

2. Data we collect

Website visitors

We do not use any tracking cookies or analytics on ascent-diving.com. We collect only the information you voluntarily submit through our contact form (name, email, dive center name, message).

Application users

When you use the Ascent application, we collect the information you enter: student profiles (name, email, phone, date of birth, address, ID photo), enrolments, certification progress and agency numbers, dives, activity photos when the dive center uses the album, digital signatures, and uploaded documents. This data belongs to your dive center and is used solely to operate the service.

Emails and messages

When an instructor writes to a student through Ascent, we keep the message, its attachments, the copy of the email as sent, and delivery events (delivered, bounced, reported as spam). When the student replies by email, the reply is received by Ascent and added to the conversation. These records let the dive center show what was communicated, and when. We never use them for advertising. Emails contain no tracking pixel and their links are not modified: we do not know whether an email was opened or a link clicked.

Health information

Medical questionnaires and medical statements are sensitive information. Ascent keeps them only as files (PDF or photo), uploaded or scanned by the dive center or the student: the answers are not stored as data, only the fact that an expected document was received and its date. The file is placed in the student's document library, where it can be used for another course at the same dive center for 12 months. Each opening is recorded in the access log. Free-text fields (notes, messages) may also contain such information if someone writes it there.

Certification cards

In “My cards”, you can add photos of your certification cards (front and back). They may show your face, your date of birth and your diver number. Photos are resized and stripped of their metadata (including GPS location) before being stored in Canada. They can be seen by you, by the dive center that recorded the card, and by the dive centers you choose to share your cards with, a sharing you can stop at any time. You can replace them, or delete the card and its photos, at any time.

Access log and technical data

When a dive center user, or a service access key, views another person's information (profile, record, document, cards, dives, export), Ascent records who, with which role, what, about whom and when, along with the IP address and device, without a copy of the content viewed. Within the service, only the dive center's administrators can view this log. Ascent views it only to investigate an incident or at the dive center's request. The service also produces technical logs (identifiers, IP addresses) for its operation and security.

3. Cookies

The Ascent application uses only strictly necessary cookies. No tracking, advertising, or analytics cookies are used.

•
Session cookie — keeps you logged in for 7 days. Deleted upon sign-out.
•
Anti-CSRF cookie — protects the login process. Expires after 5 minutes.

Because these cookies are strictly necessary for the service to function, they do not require your consent under applicable privacy laws (Quebec's Law 25, GDPR, PIPEDA).

4. Digital signatures

Ascent stores digital signatures as part of certification records. Each signature is linked to an authenticated user account and timestamped. For signatures obtained on an instructor's device on behalf of a student, the supervising instructor's identity is also recorded.

Digital signatures are legally valid under Quebec's LCCJTI (Art. 39), the US ESIGN Act, and the EU eIDAS regulation.

5. Data storage & security

•
The application, its database and uploaded files are hosted in Canada (Toronto and Montreal regions, Beauharnois QC).
•
Some providers listed in section 6 process data outside Canada, or can access it remotely: sending emails (European Union), support and operation of the database (United States, Singapore), the host's technical logs, metrics and control plane (United States), analytics and support for the sign-in service (United States, Romania), routing replies received by email (global network), and the website contact form.
•
All data in transit is protected with TLS encryption.
•
Data at rest is encrypted on disk by our hosting providers.
•
Access is limited to authorized users of your dive center, according to their role.
•
Signatures, sent messages and received replies are recorded with who and when, and emails are kept with a fingerprint (SHA-256) so that any later alteration can be detected.
•
Each viewing of another person's information is recorded in an access log that no feature of the service can change or erase.
•
A copy of the database is made every night, encrypted before it is sent and stored in Quebec in a separate space.

6. Data sharing

We do not sell or rent your data, and we do not share it for advertising. We use the following service providers, only to operate Ascent; they are bound by confidentiality and data protection obligations:

•
Fly.io — application hosting (Toronto region; technical logs, metrics and control plane in the United States, with no health information).
•
Supabase — database (Canada Central region, Montreal; support and operations possible remotely from the United States and Singapore).
•
OVHcloud — storage of documents, signatures and emails (Beauharnois, QC; remote maintenance possible by group companies, except those in the United States).
•
Auth0 (Okta) — sign-in and accounts (Canada region; Okta analytics and support in the United States and Romania). Google is also involved if you choose to sign in with Google.
•
Brevo — sending emails and tracking their delivery (European Union: France, Germany, Belgium).
•
Cloudflare — receiving replies sent by email, and hosting of this website.
•
Formspree — website contact form.

The map of dive locations in the app is displayed with OpenStreetMap (OpenStreetMap Foundation, United Kingdom): your browser requests the map images directly from it, and a location's address when the dive center looks it up. It then sends the usual technical information (IP address, browser type), but nothing from your records. The “Directions” button opens Google Maps: nothing is sent to Google until you tap it.

7. Data retention

Your data is retained for as long as your dive center uses Ascent. The access log is kept for 2 years, then deleted automatically, even if the profile or document viewed has been deleted.

Training records — certification files, signed documents and communications with students — serve as evidence of the training given. They are therefore not deleted when a course is abandoned or a conversation is archived: they are kept, out of sight, for as long as the dive center needs them for its legal and training agency obligations.

When a dive center stops using Ascent, it can request an export of its data; the data is then deleted within 30 days, except where the law requires us to keep it longer. Backup copies are destroyed at the end of their normal cycle, within 13 months at most. To request access to or correction of your data, or its deletion when it is not subject to such obligations, contact your dive center or write to us.

8. Your rights

Under applicable privacy laws, you have the right to:

•
Access the personal data we hold about you
•
Request correction of inaccurate data
•
Request deletion of your data
•
Withdraw consent at any time

To exercise these rights, contact your dive center administrator, or contact us directly at the address below.

9. Person in charge, requests and complaints

Ascent's person in charge of the protection of personal information can be reached at privacy@ascent-diving.com. This person oversees the application of this policy and handles requests and complaints.

For a request or a complaint, write to this address and describe your situation. We reply within 30 days. If it concerns a record held by a dive center, we forward it to the dive center without delay, since the dive center is the one to respond, and we help it do so.

If a confidentiality incident affects its records, Ascent notifies the dive center without delay and works with it. Each incident is recorded in a register.

If you are not satisfied with the response, you can contact the Commission d'accès à l'information du Québec.

10. Contact

For any questions about this policy or your personal data:

Ascent
Operated by RED, a sole proprietorship registered in Quebec (NEQ 2273106965)
Email: privacy@ascent-diving.com