Rubelis App Privacy Policy
Privacy information for the Rubelis mobile application.
Last updated: 9 October 2026
1. Who We Are
Rubelis OÜ ("Rubelis", "we", "us", "our") is the data controller responsible for personal data processed through the Rubelis mobile application and related Rubelis app services. This privacy policy applies specifically to the Rubelis mobile application for iOS and Android and is separate from the privacy notices governing other Rubelis website services or educational programmes.
| Company | Rubelis OÜ |
| Legal form | Estonian Private Limited Company (Osaühing / OÜ) |
| Registry code | 17579501 |
| D-U-N-S Number | 988021360 |
| Registered in | Republic of Estonia |
| Registered office | Tartu mnt 67/1-13b, 10115 Tallinn, Estonia |
| VAT status | Person liable to VAT with limited liability |
| VAT Number | EE103024666 |
| VAT effective date | 02 September 2026 |
| Founder / Management Board Member | Taylan Kırali |
2. What the Rubelis App Does
Rubelis is a mobile application designed for divers. The app may include features such as: personal dive logging; Beyond Reflection and situational-awareness notes; diving Insights based on recorded data; AI-assisted diving information and analysis; professional dive-record approval by registered instructors or dive leaders; PDF dive-log export; optional connection to supported dive-computer ecosystems; and account synchronization across devices. The feature set available to any individual user may vary depending on their account type and subscription status.
3. Personal Data We May Process
The following table describes the categories of personal data Rubelis may process, with examples and the purpose for which each category is used.
| Data Category | Examples | Purpose |
|---|---|---|
| Account Data | Name, email address, account ID, language preferences, unit preferences | Creating and managing the Rubelis account, authentication, communication and preferences |
| Dive Log Data | Dive date, dive site, location, depth, duration, gas information, water temperature, visibility, current, dive conditions, buddy/team details where entered, equipment/device source, dive profile information where available | Providing the dive-log service, synchronization, Insights and user-requested analysis |
| Beyond Reflection Data | Environmental changes, team-awareness observations, task-loading notes, unexpected events, decision points, personal post-dive reflections, what the diver wants to notice next time. These are subjective reflections entered by the user. | Personal dive reflection and, where requested by the user, contextual AI analysis |
| AI Conversation Data | Questions sent to Rubelis AI, AI responses, relevant dive information selected as context, conversation history, context trace information | Providing Rubelis AI functionality, maintaining conversation history and contextual responses |
| Professional / Instructor Data | First name, last name, email, professional role, dive school/dive centre, city, country, certification title, certification agency, certification number, Rubelis Professional ID, credential verification status | Operating the professional account and dive-approval system (applies to Instructor and Dive Leader accounts) |
| Dive Approval Data | Diver identity, dive record submitted for approval, professional identity, approval/rejection status, approval date, approval snapshot, certification information recorded at the time of approval | Providing a traceable professional dive-log approval record |
| Device / Integration Data | External account identifier, device brand/model, imported dive activity, dive profile and sensor data made available by that provider | Importing authorized dive records into Rubelis (applies only where the user voluntarily connects an external dive service) |
| Technical and Security Data | IP address, device/app information, authentication and security events, error information, synchronization status | Security, fraud prevention, troubleshooting and reliable operation |
| Subscription / Purchase Data | Subscription status, product/plan, trial status, purchase/renewal status, store transaction references | Managing access to paid features. Rubelis does not receive or store full payment card details from Apple or Google; payment processing is handled entirely by the respective app store. |
| Advertising and Analytics Data | Device identifiers, including the advertising identifier where access has been authorized by the user; app and product interaction events such as app launches, screen or feature interactions, campaign attribution events and advertising-measurement events. | Analytics, campaign attribution, advertising measurement, third-party advertising, and Rubelis's own advertising or marketing. Tracking across apps or websites owned by other companies is performed only where the user has provided the permission required by the applicable operating system. |
4. Legal Bases for Processing
Where the General Data Protection Regulation (GDPR) applies, Rubelis relies on the following legal bases:
| Legal Basis | Scope |
|---|---|
| Performance of a contract | Processing necessary to provide the services you have requested, including account operation, dive logging, synchronization, AI features requested by the user, professional approval functionality, PDF export, and subscription services. |
| Legitimate interests | Processing necessary for Rubelis's legitimate interests, including service security, fraud prevention, error diagnosis, and service reliability, where those interests are not overridden by your rights and interests. |
| Legal obligation | Processing required to comply with applicable legal obligations, including accounting, taxation, or other legally required records where applicable. |
| Consent | Sharing AI messages and relevant selected dive, reflection and Insight context with OpenAI; optional device/service connections; and other optional permissions. Consent may be withdrawn at any time from the app. Withdrawal does not affect processing carried out before withdrawal. Consent also applies to optional advertising tracking and advertising-measurement activities. On iOS, Rubelis requests permission through Apple's App Tracking Transparency framework before enabling tracking across apps or websites owned by other companies. Refusing or withdrawing this permission does not prevent access to the app's core functionality or paid features. |
5. AI Processing
- Rubelis may use OpenAI's API to provide AI-assisted functionality within the app.
- Rubelis does not automatically send the user's entire dive history to the AI provider. Only information reasonably necessary to answer the user's specific request is sent. Relevant context may include selected dive data, relevant recent dives, Beyond Reflections, and calculated Insights.
- Unnecessary account identifiers — such as the user's email address or authentication identifier — are not included in AI requests.
- AI Data Sharing is an optional permission that the user must explicitly enable in the app before any dive or reflection data is shared with the AI provider.
- OpenAI processes information under its applicable API data-processing terms. Rubelis does not use OpenAI's API in a way that permits OpenAI to train its models on user content submitted through the API.
6. External Device and Service Connections
- Rubelis may support optional connections to external dive-computer ecosystems or dive-data services.
- These connections are entirely voluntary. The user must actively choose to connect an external service and authorize the data transfer.
- When a connection is authorized, Rubelis receives only the dive data that the user has authorized through that provider's own authorization flow.
- Rubelis does not access any data from an external service beyond what is necessary to import the authorized dive records.
- The user may disconnect an external service at any time from within the Rubelis app.
7. Sharing of Personal Data
- Rubelis does not sell personal data.
- Rubelis does not share personal data with third parties except as described in this policy: with service providers acting under contractual obligations; where required by law; or where the user has given explicit consent.
- Dive logs, Beyond Reflections, AI conversations, names, email addresses, health data and precise location are not shared with advertising networks or used for third-party advertising targeting.
8. Professional Accounts and Dive Approvals
- Instructor and Dive Leader accounts are separate from standard diver accounts and are subject to a separate registration process.
- Professional registration information is used to operate the dive-approval system within Rubelis.
- A diver may voluntarily send an individual dive record to a selected Rubelis Professional for approval. The professional receives only the information needed for the approval process.
- Approved dive records may retain an immutable historical snapshot containing: the professional's name, role, certification agency, certification title, certification number, Rubelis Professional ID, approval date, and the approved dive details. This is so that an existing approval remains historically traceable even if the professional later changes account details or deletes their Rubelis account.
- Professional identity information in Rubelis is self-declared by the account holder and is not independently verified by Rubelis unless otherwise stated.
9. QR Codes and Camera Access
- The application may request camera permission when a diver chooses to scan a Rubelis Professional QR code.
- Camera access is not required to use the standard dive log or other core features of the app.
- The QR scan function is used solely to identify the intended Rubelis Professional for a dive-approval request.
- Rubelis does not store camera images or video captured during QR scanning.
10. PDF Exports
- Users may select dive records and generate a PDF dive-log export.
- The PDF may contain: diver name, selected dive details, and approval information for approved dives.
- The user controls where the generated PDF is subsequently saved, printed, emailed or shared, through the device's operating-system sharing features.
- Acceptance of a Rubelis-generated PDF or professional approval by a diving federation, training agency, dive centre or other organization is determined solely by that receiving organization.
11. Where Data Is Stored
- Rubelis may store information locally on the user's device, and in Rubelis cloud infrastructure when synchronization is enabled.
- Local dive records may remain available offline, without requiring a network connection.
- When authenticated cloud synchronization is used, records can be synchronized securely between the user's devices.
12. Service Providers
Rubelis uses the following service providers in connection with the app. Each provider processes only the data necessary for its role.
| Provider | Role |
|---|---|
| Clerk | Authentication and account-session management |
| OpenAI | AI-assisted responses and analysis requested by the user. Only the AI message and relevant selected dive, reflection and Insight context are shared after the user grants explicit AI Data Sharing permission in the app. |
| Replit / Rubelis cloud infrastructure | Backend application hosting and managed database infrastructure |
| RevenueCat | Subscription entitlement and purchase-status management |
| Apple | iOS distribution and App Store subscription processing |
| Android distribution and Google Play subscription processing | |
| Meta Platforms, Inc. and/or Meta Platforms Ireland Limited | Meta SDK and App Events services for app analytics, campaign attribution, advertising measurement, third-party advertising, and Rubelis advertising or marketing. Device identifiers and product-interaction events may be processed for tracking only after the user provides the permission required by the applicable operating system. Meta does not receive Rubelis dive logs, Suunto dive data, Beyond Reflections, AI conversations, names, email addresses, health data or precise location through this integration. |
| Suunto Oy | Optional Suunto account connection and import of dive records authorized by the user. Suunto account identifiers, device information and authorized dive data are processed only to provide the requested connection and import functionality. |
Rubelis requires service providers that receive user data to handle that data under contractual, technical and organizational protections that provide the same or an equivalent level of protection required by this policy and applicable law.
Advertising, Analytics and Tracking
Rubelis uses Meta SDK and Meta App Events for analytics, campaign attribution, advertising measurement and marketing. Where these activities constitute tracking under Apple's rules, they are not enabled on iOS unless the user grants permission through Apple's App Tracking Transparency framework.
If permission is granted, Meta may receive a device identifier, including the advertising identifier where available, and limited product-interaction events. Meta may combine this information with data from other companies' apps, websites or offline properties for advertising or advertising-measurement purposes.
If the user selects "Ask App Not to Track," Rubelis does not use Meta SDK data to track that user across apps or websites owned by other companies. Refusing tracking does not restrict the app's core functions, subscription access or Suunto integration.
On iOS, permission can be reviewed or withdrawn at any time through Settings > Privacy & Security > Tracking > Rubelis. On other platforms, users may manage applicable advertising and privacy choices through the operating-system settings and any consent controls presented by Rubelis.
Meta processes information under its applicable privacy terms and data-protection safeguards. Rubelis does not maintain a separate copy of Meta's device-level advertising identifier. Aggregated campaign or analytics reports may be retained only for as long as reasonably necessary for analytics, security, marketing and legal compliance.
13. International Data Transfers
- Some service providers may process data outside Estonia or the European Economic Area (EEA).
- Where such transfers occur and are required to comply with GDPR, Rubelis relies on appropriate transfer mechanisms, which may include: adequacy decisions, the EU–US Data Privacy Framework where applicable, Standard Contractual Clauses, or other legally permitted safeguards.
14. Data Retention
Rubelis retains personal data only for as long as necessary for the purposes described in this policy or as required by applicable law.
| Data Category | Retention Period |
|---|---|
| Active Rubelis account data | For as long as necessary to provide the active account and services. |
| Dive-log data | Until the user deletes the relevant data or account, subject to technical synchronization and recovery periods. |
| AI conversations | Until deleted by the user or account, or according to applicable service-retention settings. |
| Security and diagnostic logs | Only for the period reasonably necessary for security, fraud prevention, reliability and legal obligations. |
| Subscription / accounting records | As required by applicable accounting, tax and store-platform obligations. |
| Completed account-deletion audit metadata | Rubelis may retain only minimal non-content technical deletion metadata for up to 30 days where required to ensure deletion completes reliably. Dive content, Beyond Reflections, AI conversation content and email address are not retained in this record. |
| Professional approval snapshots | May be retained with a previously approved dive record where necessary to preserve the integrity and traceability of that historical approval. This means that if a professional later changes their account details or deletes their Rubelis account, the approval record attached to a diver's previously approved dive remains historically traceable. |
| Advertising and analytics data | Device-level information processed by Meta is retained according to Meta's applicable terms, configured settings and legal obligations. Rubelis may retain aggregated campaign and analytics reports only for as long as reasonably necessary for analytics, marketing, security and legal compliance. |
15. Account Deletion
- Rubelis users can request permanent account deletion from inside the application.
- Account deletion permanently removes the Rubelis account, ordinary associated cloud data, and synchronized user-owned data as applicable.
- Local-only dives belonging to the deleted Rubelis account may also be deleted from that device after confirmation.
- Where required by app-store rules, Rubelis also provides an account-deletion route accessible from within the application settings.
16. Subscriptions
Rubelis offers auto-renewing subscription options through Apple App Store and/or Google Play. Eligible users may receive a seven-day free trial where displayed by the applicable store. Available plans, localized prices, trial eligibility, renewal terms and billing conditions are shown before purchase. Purchases, renewals, cancellations and refunds are managed under the rules of the applicable app store. Rubelis does not receive or store full payment-card details.
- Subscription options include a monthly plan (automatically renewing monthly unless cancelled) and an annual plan (automatically renewing annually unless cancelled).
- Eligible users may receive a free trial period where displayed by the applicable store, after which the subscription renews automatically unless cancelled before the end of the trial.
- Instructor and Dive Leader professional accounts are free of charge.
- Purchase, renewal, cancellation and payment processing are handled through Apple App Store and/or Google Play according to the user's platform.
- Rubelis does not store full payment-card details.
17. Data Security
- Rubelis uses appropriate technical and organizational safeguards to protect personal data. These may include: encrypted HTTPS connections, secure authentication, access controls, user-level data isolation, server-side authorization, protected secrets management, offline and local data controls, and synchronization safeguards.
- No system can guarantee absolute security. Rubelis takes reasonable steps to protect personal data but cannot warrant that unauthorized access, disclosure, alteration or destruction will never occur.
18. Your Rights
Where the GDPR applies, you may have the following rights in relation to your personal data:
| Right | Description |
|---|---|
| Access | The right to request a copy of the personal data Rubelis holds about you. |
| Correction | The right to request correction of inaccurate or incomplete personal data. |
| Deletion | The right to request deletion of your personal data, subject to applicable legal obligations and legitimate retention grounds. |
| Restriction | The right to request that processing of your personal data be restricted in certain circumstances. |
| Objection | The right to object to processing based on legitimate interests, where applicable. |
| Data portability | The right to receive personal data you have provided in a structured, commonly used and machine-readable format, where processing is based on consent or contract and carried out by automated means. |
| Withdrawal of consent | Where processing relies on your consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. |
| Complaint | The right to lodge a complaint with a supervisory authority. |
To exercise any of these rights, please contact us using the details in Section 22. Identity verification may be required before a privacy request can be fulfilled.
19. Supervisory Authority
The supervisory authority responsible for data protection in Estonia is:
| Name | Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) |
| Address | Tatari 39, 10134 Tallinn, Estonia |
| Website | www.aki.ee |
EU and EEA residents may also contact the data-protection authority in their own country of residence where applicable.
20. Children
- Rubelis mobile accounts are intended for users who meet the minimum age required to create and manage an account under applicable law and applicable app-store rules.
- Rubelis does not knowingly use the mobile application to solicit personal data from children in violation of applicable law.
- If age eligibility requirements or a dedicated child or guardian account system are introduced in the future, this policy will be updated before that functionality is released.
21. Changes to This Policy
- This policy may be updated when app functionality changes, new device integrations are added, AI providers change, subscription processing changes, or legal requirements change.
- Material changes may be communicated through the application or other appropriate channels.
- The last-updated date at the top of this page reflects the current version.
22. Contact
Rubelis OÜ
Tartu mnt 67/1-13b
10115 Tallinn
Estonia
Registry Code: 17579501