Privacy policy

Who is responsible

MCP for PADI at padi.mcp.visin.ch is run by Marco Visin, Lugano, Switzerland. Marco Visin is responsible for your personal data: the controller under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

For any question about your data, or to use your rights, write to marco@visin.ch.

What we store and why

We store only what the service needs to work:

• Your account. Your email address and the password you chose for MCP for PADI. The password is stored only as a scrypt hash, so we cannot see it. We also store when you created the account and last signed in, and whether it is disabled or an administrator account. We need this to give you an account and keep it secure.
• Your access request. If you request access, the message you write to the administrator, so the administrator can decide. It is deleted when your request is approved. If this service has a mail server set up and the administrator did not turn off e-mail notifications, your email address and this message are also sent to them by e-mail (see "Who receives your data").
• Invite codes. If you sign up with an invite code, the invite records your email address and when you used it.
• Your PADI connection. Your PADI e-mail address, the sign-in token (a refresh token) that PADI gives when you sign in here, your PADI account id (the affiliate id), your name as PADI has it, and your settings: units, read-only mode and time zone, with the time you signed in. They are stored encrypted with AES-256-GCM. Your PADI password is used once to sign in and is never stored. We need this to reach your PADI logbook for you.
• Your profile photo. If your PADI account has an approved certification photo (the photo on your PADI eCards, which the PADI website shows as your picture), we keep a copy to show as your picture on these pages. Only this photo is kept. It is checked again about once a day, when you open your account page.
• Connected AI apps. When you connect an AI app, we store the app's registration (the name and web addresses it gives itself) and the tokens that let it act for your account. Tokens are stored only as hashes. We also store when each connection was made and last used, so you can see it and revoke it.
• Activity log. For each action an AI app takes (a tool call, for example logbook_list_dives), we record the time, the app, the tool, how long it took and whether it worked. We do not record what was read or written: no dives, dive sites, buddies, notes or certifications. You see the latest entries on the Connected apps page, and we use the log to find errors and abuse.
• Browser sessions. When you sign in, your browser gets a random session code in a cookie. We store only a hash of it, with the time it was created and when it expires.
• IP address. Like every website, the server sees the IP address of each request. MCP for PADI keeps it only in memory, for at most one day, to limit repeated attempts such as too many sign-ins. It does not save it in its database or in its log.
• Server log. The server writes a short technical log of events such as a failed sign-in, a new account or an error. It contains no passwords, sign-in tokens, IP addresses or contents of your logbook. But when an action fails, the error message can include a short detail, such as a value that PADI refused.

Your logbook is not stored

When an AI app asks for your dives, MCP for PADI gets them from PADI and passes them on to the app. They are held in memory only while the request runs and are not saved in the database or on disk. This includes dive photos and certification cards. The only exception is your profile photo, described above. The server log holds only the short error details described above. The units setting of your PADI logbook is kept in memory for a few minutes, so that repeated requests are faster.

Dives that your AI app adds, changes or deletes are changed in your logbook at PADI, as if you did it on the PADI website. When you send a dive for verification, PADI passes the request to the PADI Pro you name.

Legal bases

We process your data in line with the Swiss FADP. Where the GDPR applies, we rely on these legal bases:

• Contract (Art. 6(1)(b) GDPR): to provide the service you signed up for, that is your account, your PADI connection and profile photo, your connected apps and your activity log.
• Legitimate interest (Art. 6(1)(f) GDPR): to keep the service secure and running, with limits on repeated attempts, the server log, backups and protection against abuse.
• Legal obligation (Art. 6(1)(c) GDPR): when the law requires us to keep or hand over data.

How long we keep data

• Account: until you delete it, or the administrator does.
• PADI connection and profile photo: until you remove the connection on the PADI account page, connect another PADI account, or delete your account. The sign-in token and the photo are then deleted from this server, and the token expires at PADI by itself. If your PADI account no longer has an approved photo, the copy is deleted at the next check.
• Access requests: deleted at once if rejected, and after 30 days if nobody answers. The message to the administrator is deleted when the request is approved. A notification e-mail about a request stays in the administrator's mailbox until they delete it.
• Browser sessions: until you sign out, at most 14 days.
• App connections: an access token is valid for 60 minutes. A connection ends when you revoke it, or after 60 days without use. Each token is deleted one day after it expires.
• App registrations (not linked to your account): deleted after one day if nobody approved the app, otherwise once no connection uses it, at the earliest 90 days after it was first approved.
• Activity log: 90 days.
• Invites: until the administrator deletes the invite. Deleting your account does not remove your email address from an invite you used, so write to us and we will delete it.
• Server log: kept in files of limited size (50 MB in total). The oldest entries are overwritten.
• Backups: a copy of the database is made before each software update or rollback, or by hand, and only the 10 newest copies are kept. They are kept on the same server. Data you delete can remain in these copies until they are replaced. Your PADI connection stays encrypted in them.

Who receives your data

We do not sell your data, do not share it with advertisers and do not use it to train AI models. Your data goes only to:

• PADI. To reach your logbook, MCP for PADI signs in to PADI's servers once with the e-mail address and password you enter, and then sends PADI the requests that you or your AI apps make: reading, adding, changing and deleting dives, reading your certification cards, your profile photo and your dive photos, looking up a PADI Pro, and sending a dive to a PADI Pro for verification. PADI signs you in through Amazon Web Services (AWS Cognito). PADI gives the profile photo as a temporary link to a storage service, which a cloud provider may run for PADI; MCP for PADI sends no sign-in data there. PADI handles this data under its own privacy policy.
• The AI apps you connect. Each app you approve, for example Claude by Anthropic or ChatGPT by OpenAI, receives the logbook and certification data it asks for and the results of its actions. What the app does with this data is governed by its own terms and privacy policy and by your settings in that app. We have no control over it.
• Our hosting provider. MCP for PADI runs on a server rented from a cloud hosting provider. The provider stores the data for us and is not allowed to use it for its own purposes.
• The administrator. The administrator of MCP for PADI sees a list of accounts with the email address, status, whether PADI is connected, the last sign-in, the number of tool calls in the last 7 days, and the messages in access requests. The admin pages never show your PADI connection or your sign-in token. If this service has a mail server set up and the administrator did not turn off e-mail notifications about access requests (they are on by default), they also get the email address and the message of each new request by e-mail, sent through the mail server of this service.
• Authorities, only when the law requires it.

We use no analytics, advertising or tracking services, and these pages load nothing from other websites.

Data in other countries

The data that MCP for PADI stores is kept on its server and in its backups, at the hosting provider. PADI and the AI apps you connect may process your data in other countries, including the United States, where the PADI sign-in service runs. This happens because you choose to use their services. If you request access, your email address and message may be e-mailed to the administrator, so the provider of the mail server may process them too. Their privacy policies explain where they process data and how they protect it.

How we protect your data

• Your PADI connection, with its sign-in token, is encrypted with AES-256-GCM. Passwords for MCP for PADI are hashed with scrypt, and session codes, tokens and invite codes are stored only as hashes.
• Connections to MCP for PADI use HTTPS, and connections to PADI use HTTPS too.
• Forms are protected against forged requests, the pages run under a strict content security policy, and repeated attempts are limited.
• The service runs in a locked-down container with no extra rights, and its file system is read-only except for its data folder.

Because MCP for PADI talks to PADI for you, the server holds the encryption key and can decrypt your sign-in token. That is why it never stores your PADI password, only the token, which you can remove at any time on the PADI account page.

No system is perfectly secure. If you find a security problem, please report it to marco@visin.ch. We will reply as soon as we can and fix confirmed problems.

Your rights

You have the right to know what data we hold about you, to get a copy, to have it corrected or deleted, to restrict or object to its use, and to take it elsewhere. You can do much of this yourself:

• Change your PADI connection, or remove it, on the PADI account page.
• See your connected apps and the activity log, and revoke any app, on the Connected apps page.
• Delete your account on the Security page. This deletes your account, your PADI connection, your profile photo, your sessions, your app connections and your activity log at once. Copies in the backups disappear as the backups are replaced. Your logbook at PADI is not touched.

For anything else, write to marco@visin.ch. We answer within 30 days.

You can also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of the country where you live or work.

Cookies

MCP for PADI uses only the cookies it needs to work. There are no tracking or advertising cookies. The cookies are sent only to this site, cannot be read by scripts on the page and are not shared with anyone.

• __Host-pdm_session keeps you signed in. It is deleted when you sign out and lasts at most 14 days.
• __Host-pdm_pre protects the sign-in and sign-up forms against forged requests. It lasts 12 hours.
• __Host-pdm_lang remembers the language you chose in the language menu. It lasts 365 days.

Children

MCP for PADI is not meant for children. You must be at least 16 years old to use it. If you think a child has created an account, write to us and we will delete it.

Changes to this policy

We update this policy when the service or the law changes. The date at the top shows the last change. If a change affects how your data is used, we will point it out on this site.