WingsuitLocation of Wingsuit’s data
Wingsuit’s database, uploaded files and backups are all held in Railway’s EU West region, in Amsterdam, Netherlands. The UK treats the European Economic Area as adequate for data protection purposes, so a transfer from the UK to Amsterdam needs no further safeguard. Railway’s own platform logs and service metadata are not confined to that region and may be processed in the United States, under Railway Corporation’s certification named on the sub-processors page.
The service that turns an imported Word or PowerPoint file into a PDF runs on Railway too, in the same Amsterdam region. It receives a Word document or slide deck only when a teacher imports one, returns a PDF and keeps nothing.
The emails Wingsuit sends go through Resend: a link to confirm an account’s email address, a link to reset its password, and a confirmation when a subscription is cancelled on the website. They are sent from Resend’s Ireland region, but Resend stores them, with their delivery logs, in the United States for 30 days. A link email holds the recipient’s address and a link that expires after an hour, and nothing else; a cancellation confirmation holds what was cancelled, when, and anything refunded.
Where data rests is not the whole question, though. Several of Wingsuit’s sub-processors are companies established in the United States, and because their staff can reach the systems, that counts as a transfer even where the data itself stays in Europe. Each one is covered, by either the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum. The sub-processors page names the safeguard for each company, with the date it was checked.
Portable .wingsuit files stay on your own device unless you choose to save them to Wingsuit; they are never uploaded or seen by Wingsuit unless you do.
A whiteboard tried without an account is the same: nothing is created or stored on Wingsuit’s servers: no account, no board, no uploaded file. The board and the images on it are held in that browser alone, in its own database, with the drawing preferences beside them. They stay there, with no expiry, until you sign up and the board is saved to Wingsuit, or until you clear the site’s data.
Data is encrypted in transit, over HTTPS and WSS, and encrypted at rest by the hosting provider at the storage layer. Nothing stronger is claimed: Wingsuit does not separately encrypt individual volumes or fields of its own.
Data retention
We keep information for the time necessary for the purposes for which it is processed, after which it is deleted or aggregated. Almost every period below is enforced automatically (by an hourly sweep in Wingsuit’s own code, or by deleting the account the record belongs to) rather than by manual action. The exception is the last row: the company’s accounting records are not held in Wingsuit at all, and the law fixes how long they are kept.
| Record | Kept for | What happens then | How it is enforced |
|---|---|---|---|
| Boards and folders | Until deleted | Deleting turns off sharing at once and moves the board to a recycle bin | User action |
| Deleted boards in the recycle bin | 7 days on Wingsuit Starter, 90 days on Wingsuit Pro, from deletion | Permanently removed | Hourly sweep |
| Uploaded files (images and PDFs) | Until nothing references them for a day | Removed | Hourly sweep |
| Support screenshots | 30 days | Removed | Hourly sweep |
| Resolved support tickets and messages | 180 days | Removed | Hourly sweep |
| Survey answers (stored without a name) | Until the survey is deleted | Removed | Admin action |
| Which surveys a teacher answered or said no to | While the account is open | Removed with the account or the survey | Account deletion |
| Audit events (who did what and when; never what is on a board) | 365 days | Removed | Hourly sweep |
| Daily tool-usage counts | 90 days | Removed | Hourly sweep |
| Storage snapshots | 90 days | Removed | Hourly sweep |
| Expired incident notices | 90 days | Removed | Hourly sweep |
| Service metrics | About 30 days | Removed | Hourly sweep |
| Quick whiteboards (temporary boards opened by code) | 8 hours after their last change | Removed | Hourly sweep |
| Subscription records (which provider, which plan, its status and when the paid period ends) | Until the account is deleted | Deleted with the account | Account deletion |
| Grants of a plan or a raised limit (by an administrator, by a redeemable code, or by a school’s email-domain rule) | Until the account is deleted | Deleted with the account | Account deletion |
| Credit ledger (amounts in pence, and what each was for) | Until the account is deleted | Deleted with the account | Account deletion |
| Orders: what was bought, the exact wording shown at checkout, the version of the terms, the time, and the confirmation document | Until the account is deleted | Deleted with the account | Account deletion |
| Log of events from Stripe (content-free: which event, which account, when) | 90 days | Removed | Hourly sweep |
| A copy of your data, asked for in Settings | 7 days after the archive is ready | Removed, and the download stops working | Hourly sweep |
| An account whose owner has asked for it to be deleted | 14 days, frozen, from the request | Deleted, unless its owner signs in first and chooses Restore; see below for what stays | Hourly sweep |
| Accounting records for a paid subscription (invoice, name, email, country) | 6 years from the end of the financial year | Destroyed | Company bookkeeping, not Wingsuit |
Account deletion
You can delete your own account from Settings, either with your password or with a sign-in less than a day old. Asking freezes the account at once: every other session is ended, and its share links and broadcast rooms stop letting anyone new in. 14 days later the hourly sweep deletes the account, with everything in its own library, its rooms, its preferences and every billing record above; its uploaded files follow in the next sweep, once nothing else references them. Three things stay. Boards, folders and name pickers made in an organisation’s or a team’s space belong to that space, so they pass to another of its members (an owner first, then an admin, then whoever joined first) and are deleted only if nobody is left. Support tickets stay, with the teacher’s name taken off them and any screenshot removed, until 180 days after they were resolved. Audit events about the account stay until their 365 days are up. Signing in within those 14 days and choosing Restore puts the account back. If the account has a Stripe subscription, asking to delete sets it to stop at the end of the period already paid for, and it is cancelled outright when the account is deleted, so a deleted account is never charged again.
A copy of your data
You can also ask in Settings for a copy of everything Wingsuit holds about you. It is built in the background rather than on the spot (one archive at a time) and downloaded from the same page: JSON files and the original pictures, with a README listing what each one holds. Wingsuit removes the archive 7 days after it is ready; ask again whenever you want another.
When a teacher leaves a school
A Wingsuit account belongs to the teacher who made it, whether they use it on their own or as a member of their school’s organisation, and only they can delete it. What happens to their boards depends on where they are.
Boards in the teacher’s own library are theirs and go with them. If the school needs any of them, it should ask the teacher to share them, move them into the organisation’s space, or export them before they leave.
Boards in an organisation’s or a team’s space belong to that space. When the teacher is removed from the organisation, or leaves it, those boards stay where they are for everyone else in it, and the teacher can no longer open them. If the teacher later deletes their account, the boards pass to another member, as described above.
A school that needs help with either, or has a signed data processing agreement and wants information it is the controller of deleted, can contact support@usewingsuit.co.uk.
Backups
Wingsuit’s database is backed up by Railway’s point-in-time recovery, to a bucket in the same region. The last four full backups are kept, which is a recovery window of roughly four weeks. A backup restore can therefore briefly reintroduce information that had already been deleted from the live service. Individual records cannot be picked out of a backup and erased on request; they age out of the window instead, and the hourly sweep removes anything a restore brought back.
What outlives deletion
Three kinds of record can outlive a Wingsuit account, and none is held in Wingsuit itself.
An email Wingsuit has sent is kept by Resend, with its delivery logs, for 30 days, whether or not the account still exists.
Payment and invoice records are kept by Stripe under its own legal obligations, independently of Wingsuit account deletion. See the sub-processors page for how it handles data.
A2x Development Ltd, the company that operates Wingsuit, must also keep its own accounting records (the invoices and payout statements behind each subscription, which carry a name, an email address and a country). Under the Companies Act 2006 and HMRC’s record-keeping rules these are kept for at least six years from the end of the financial year they relate to. They live in the company’s bookkeeping, not in Wingsuit’s database, and deleting an account does not and cannot remove them: the right to erasure does not apply to information the law requires to be kept. Nothing from a board, a folder or a file is ever part of that record.
If something goes wrong
Wingsuit keeps a written procedure for personal data breaches, and a register in which every one is recorded, whether or not it has to be reported. In outline: contain it first (revoke the credential, turn off the share link, take the feature offline) and start a timestamped note of what happened, what data was involved and roughly how many people.
Where a school or college has signed the data processing agreement and its data is affected, Wingsuit emails that school’s named contact with whatever is known at the time, within 72 hours of becoming aware of it and without waiting until the picture is complete. Where Wingsuit is itself the controller (accounts, billing, sessions, security logs, support tickets), a breach likely to pose a risk to people is reported to the UK’s data protection regulator without undue delay and, where feasible, within 72 hours of Wingsuit becoming aware of it. The regulator is the Information Commission, which took over the Information Commissioner’s functions on 30 September 2026 and is still known as the ICO. Where the risk to people is high, every affected account is emailed in plain English: what happened, what it means for them, what has been done and what they should do.
To report something that looks like a security or data problem, email support@usewingsuit.co.uk. Wingsuit is run by one director alongside teaching, so “without undue delay” here means hours rather than minutes, but it means the same hours in a school holiday as in term time.