WINGSPAN
PRIVACY POLICY — DRAFT FOR LEGAL REVIEW
Privacy Policy
WINGSPAN UNLIMITED, INC. • Effective Date: [To be confirmed upon legal review and publication]
DRAFT FOR LEGAL REVIEW — This policy is prepared for counsel review and finalization. It is not legally effective until reviewed by legal counsel, finalized, and published at a permanent URL on the WINGSPAN website and made accessible within the app. Counsel review notes and technical build notes have been compiled in a separate reference document.
1. Introduction
WINGSPAN does not sell your personal information to third parties. WINGSPAN does not use your personal information for advertising purposes. The Platform is ad-free. Your data exists solely to make your delivery experience work.
1.1 Who This Policy Applies To
| User type | Coverage |
|---|---|
| Customers | Anyone who creates a WINGSPAN account and places orders through the Platform. |
| Couriers | Anyone who operates as a WINGSPAN courier through the WINGSPAN Courier App. |
| Vendor partners | Businesses and their staff who access the WINGSPAN Vendor Dashboard. |
| Website visitors | Anyone who visits the WINGSPAN website without creating an account. |
1.2 Applicable Laws
WINGSPAN’s privacy practices are designed to comply with the following laws and standards. If you are a resident of a jurisdiction with additional privacy protections, those protections apply to you.
| Law / Standard | Who it protects |
|---|---|
| CalOPPA | Users of websites and apps accessible to California residents. |
| CCPA / CPRA | California residents. Rights to access, delete, and opt out of sale of personal data. |
| GDPR | EU residents. Applies because WINGSPAN serves international travelers at US airports. |
| COPPA | Children under 13. WINGSPAN does not knowingly collect data from children under 13. |
| PCI DSS v4.0.1 | All users who make payments. Card data handled by Stripe. |
| Apple App Store & Google Play | Apple App Store & Google Play users. Both require compliant privacy policies. |
2. Information We Collect
WINGSPAN collects only the information necessary to operate the Platform and provide the delivery service. We do not collect data speculatively. Every piece of data we collect has a specific operational purpose.
2.1 Information You Provide to Us
| Data type | What it includes | Why we collect it |
|---|---|---|
| Account information | Full name, email, phone number, password (hashed) | Account creation, login, notifications, support |
| Payment information | Card details tokenized by Stripe; WINGSPAN never stores raw card data | Payment processing for orders |
| Order information | Items, vendor, delivery destination, notes, timestamps | Order fulfillment, support, refunds, disputes |
| Delivery destination | Gate, lounge, break room, or in-terminal location | Routing courier to correct location |
| Flight information | Flight number and departure time | Smart order feasibility, disruption handling, timing |
| Delivery notes | Accessibility needs or special instructions | Enabling couriers to serve you correctly |
| Support communications | Messages via Intercom support chat | Resolving support requests, quality assurance |
2.2 Information We Collect Automatically
| Data type | What it includes | Why we collect it |
|---|---|---|
| Device information | Device type, OS version, app version, identifiers | App functionality, crash reporting, fraud detection |
| Usage data | Screens visited, features used, time spent, interactions | Platform improvement |
| Log data | IP address, browser type, access timestamps | Security monitoring, fraud detection, debugging |
| Courier location data | GPS of active couriers, during delivery shifts only | Routing, live tracking, Transfer Protocol, Floor View |
| Courier location data is the most sensitive data WINGSPAN collects automatically. It is broadcast in real time during active delivery shifts only, is not retained after the delivery session ends, and is not used for any purpose outside active order routing and delivery confirmation. | ||
2.3 Information We Do Not Collect
- Raw payment card numbers — Stripe handles all card data.
- Social Security numbers or government identification numbers.
- Health or medical information.
- Precise location data from customers — only from active couriers during delivery shifts.
- Any personal information from children under the age of 13 knowingly.
- Travel history, itinerary, or airline loyalty status beyond the flight number and departure time you provide.
3. How We Use Your Information
WINGSPAN uses your personal information for the following purposes only. We do not use your information for any purpose not listed here without first updating this Privacy Policy and notifying you.
| Purpose | Data used |
|---|---|
| Processing and fulfilling your order | Order info, payment info, delivery destination, flight info |
| Routing your courier | Delivery destination, courier GPS, flight info |
| Sending order updates and notifications | Account info (email, phone), order info |
| Processing payments and refunds | Payment info via Stripe |
| Providing customer support | Account info, order info, support communications |
| Detecting and preventing fraud | Device info, log data, payment info |
| Improving the Platform | Usage data, device info — aggregated and anonymized |
| Complying with legal obligations | All data as required by applicable law |
| WINGSPAN does not use your personal information for marketing to third parties, advertising targeting, profiling, or any automated decision-making that produces legal or similarly significant effects on you without your knowledge and consent. | |
4. How We Share Your Information
WINGSPAN does not sell your personal information. We share your information only with the third-party service providers necessary to operate the Platform, and only to the extent necessary for them to perform their function.
| Service provider | What they receive | Why |
|---|---|---|
| Stripe | Tokenized payment card data | Payment processing and refunds |
| AWS | Encrypted platform data | Cloud hosting, database, storage |
| PubNub | Courier GPS (active sessions only) | Real-time status updates and tracking |
| Twilio Proxy | Masked phone routing; real numbers never shared | Courier-customer calling without exposing numbers |
| Twilio SMS / SendGrid | Phone number (SMS), email (SendGrid) | OTP delivery, transactional email |
| Intercom | Name, email, order reference | Customer support conversations |
| FlightAware | Flight number and departure airport | Flight lookup for Smart Order Feasibility |
| Google Maps SDK | Non-identifiable routing data | In-terminal courier navigation |
We may also share your information for legal compliance (if required by law, court order, or government request); safety (to protect any person); or business transfer (if WINGSPAN is acquired or merged, with notice to you before your information becomes subject to a different Privacy Policy).
5. Phone Number Privacy — Courier Interactions
WINGSPAN uses Twilio Proxy to route all calls between couriers and customers. Your real phone number is never shared with a WINGSPAN courier, and a courier’s real phone number is never shared with you. All calls are routed through a temporary masked number, active only for the duration of the active delivery session.
6. Location Data
6.1 Customer Location
WINGSPAN does not collect precise real-time location data from customers. Your delivery destination is provided by you at checkout — it is a location you specify, not a location we detect. WINGSPAN does not access your device’s GPS at any point.
6.2 Courier Location
7. Data Retention
WINGSPAN retains your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements.
| Data type | Retention period | Reason |
|---|---|---|
| Account information | Active account + 2 years after closure | Dispute resolution, legal compliance |
| Order history | 3 years from order date | Dispute resolution, refunds, audit |
| Courier GPS location | Not retained — purged each session | Minimum necessary data principle |
| Payment transaction records | 7 years from transaction date | Financial audit and tax compliance |
| Support conversations | 24 months from conversation date | Quality assurance, dispute resolution |
| Device and log data | 90 days from collection | Security monitoring, fraud detection |
| Incident reports | 5 years from report date | Legal and operational record keeping |
8. Data Security
WINGSPAN implements industry-standard security measures to protect your personal information:
- Encryption in transit — all data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
- Encryption at rest — all personal data stored on AWS infrastructure is encrypted using AES-256 encryption.
- Payment security — all payment card data is handled exclusively by Stripe, a Level 1 PCl DSS certified processor.
- Access controls — platform data is accessible only to WINGSPAN staff with a legitimate operational need; multi-factor authentication is required for all Admin Panel access.
- Fraud monitoring — device and transaction data are monitored continuously for suspicious activity.
- Incident response — affected users are notified within 24 hours of a confirmed breach in accordance with applicable law.
No security system is impenetrable. While we take reasonable steps to protect your information, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at partnerships@wingspanappinc.com.
9. Your Privacy Rights
Depending on where you live, you may have certain rights regarding your personal information. WINGSPAN honors these rights for all users regardless of location.
| Right | What it means |
|---|---|
| Right to access | Request a copy of the personal information WINGSPAN holds about you. |
| Right to correction | Request that we correct inaccurate personal information. |
| Right to deletion | Request deletion of your personal information, within 30 days of a verified request, subject to legal retention obligations. |
| Right to data portability | Request a copy of your data in a machine-readable format. |
| Right to opt out of data sale | WINGSPAN does not sell your personal information. Disclosure included as required by CCPA. |
| Right to non-discrimination | Exercising your privacy rights will not result in denial of service or different pricing. |
| Right to lodge a complaint | EU residents may lodge a complaint with their local data protection authority. |
9.1 How to Exercise Your Rights
To exercise any of the rights above, contact us at partnerships@wingspanappinc.com with the subject line “Privacy Request — [your request type].” Include your full name, the email address associated with your WINGSPAN account, and a description of your request. We will verify your identity before processing any request and respond within 30 days.
10. Children's Privacy
11. Do Not Track
CalOPPA requires us to disclose how we handle Do Not Track (DNT) signals. WINGSPAN does not currently respond to Do Not Track signals because there is no industry-standard interpretation of what DNT requires. WINGSPAN does not track your activity across third- party websites or apps regardless of DNT signal status — our data collection is limited to your use of the WINGSPAN Platform only.
12. International Users & GDPR
13. Third-Party Links & Services
The WINGSPAN Platform may contain links to third-party websites or services — such as vendor restaurant websites or airport authority pages. WINGSPAN is not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party site you visit.
14. Changes to This Privacy Policy
WINGSPAN may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy at the same permanent URL with a new effective date, sending an in-app notification, and sending an email notification for material changes. Your continued use of the Platform after the effective date constitutes acceptance of the updated policy.
15. SMS / Text Messaging Program
This section governs WINGSPAN’s business text messaging (SMS) program and satisfies mobile carrier requirements for messaging consent and privacy.
Data Sharing
- Customer data is not shared with third parties for promotional or marketing purposes.
- Mobile opt-in and consent are never shared with anyone for any purpose. Any information sharing that may be mentioned
elsewhere in this policy excludes mobile opt-in data.
WINGSPAN UNLIMITED, INC. Messaging Terms and Conditions
1. The messaging program consists of general conversational messaging to answer questions and provide support.
2. You can cancel the SMS service at any time. Just text ‘STOP’ to the phone number from which you received messages. After you send ‘STOP,’ we will send an SMS to confirm you have been unsubscribed. After this, you will no longer receive SMS messages from us. To rejoin, sign up as you did the first time and we will resume sending messages.
3. If you are experiencing issues with the messaging program, reply with the keyword HELP for more assistance, or reach us at
partnerships@wingspanappinc.com.
4. Carriers are not liable for delayed or undelivered messages.
5. Message and data rates may apply for any messages sent to you from us and to us from you. Message frequency may vary based on
communication needs. If you have questions about your text or data plan, contact your wireless provider.
6. If you have questions regarding privacy, please read this privacy policy in full.
How We Obtain Consent
WINGSPAN’s text messaging is conversational and directed to business contacts — partners, vendors, and advisors — with whom WINGSPAN has an existing relationship, who provide their phone number directly and consent to messaging during business communication. WINGSPAN does not send promotional or marketing text messages, and does not share mobile opt-in or consent data with any third party. Recipients may opt out at any time by replying STOP.
16. Contact Us
If you have any questions about this Privacy Policy or our privacy practices, or to exercise any of your privacy rights, contact us at:
| partnerships@wingspanappinc.com | |
| Phone | 202.929.3343 |
