WingsuitWho is the controller?
Wingsuit is operated by A2x Development Ltd, a company registered in England and Wales (company number 17455293), whose registered office is 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. For the information described in this policy, A2x Development Ltd is the controller under the UK GDPR and the Data Protection Act 2018. Wingsuit is registered with the Information Commissioner’s Office, registration number ZC246766.
Wingsuit is the controller of your account: your name, email address, sign-in sessions, plan and payments, support tickets and its security logs. Wingsuit decides what to collect and how long to keep it, and this policy tells you.
What you put on a board is different. Wingsuit does not choose it, does not look at it and never uses it for anything of its own. If you use Wingsuit for your teaching job, and you put information about a named student onto a board, then in data protection terms your school or college is normally the controller of that information and Wingsuit is processing it on their behalf, because in law an employee acting in the course of their employment acts as part of their employer, not as a separate controller. In that case your school should have a contract with Wingsuit under Article 28 of the UK GDPR. One is published, ready to sign, at data processing agreement, and it is free to any school or college that asks.
Please don’t put information about named students onto a board unless your institution’s policies allow it (ideally, unless your institution has approved Wingsuit). Wingsuit does not need it, and a board is a teaching surface, not a record system.
No data protection officer has been appointed, and none is required: Wingsuit is not a public authority, its core activities do not involve regular and systematic monitoring of people on a large scale, and it does not process special category data on a large scale (the three tests in Article 37(1) of the UK GDPR). Data protection matters are handled by Alex Colville, director. Write to him at support@usewingsuit.co.uk, or by post at A2x Development Ltd, 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.
A written record of processing activities is kept under Article 30 of the UK GDPR, both as controller of teacher account information and as processor for schools that adopt Wingsuit. A school assessing Wingsuit can ask for it at the address above.
What Wingsuit collects and why
The guiding principle is to collect only what is needed. In practice:
Identity and access
When you sign up, Wingsuit asks for identifying information: your name and email address, and a password if you sign in with one. You may add a profile image. Each account carries a role. Sessions store a token, an expiry, your IP address and your browser or device details, so that you stay signed in and so that suspicious access can be investigated.
Billing information
If you take a paid plan, your card details are typed into the payment provider’s own page and never reach Wingsuit’s servers. What Wingsuit keeps is the record of the arrangement itself: your subscription (which provider it came from, which plan, its status and when the paid period ends); any plan or raised limit granted to you by an administrator, by a code you redeemed, or by a rule covering your school’s email domain; a ledger of any credit you hold, in pence; your orders: what was bought, the exact wording you were shown before paying, the version of the terms, the time, and the confirmation document you can download again from Settings; and a content-free log of the messages the payment providers send, kept for 90 days. See Subscriptions and payments below.
Teaching content
Wingsuit stores the content you create or upload: cloud whiteboards and the strokes, text and images on them, folders, the name pickers kept in your library, uploaded images and PDFs, broadcast rooms and sharing settings. Imported Word and PowerPoint files are converted to PDF by a document-conversion service; the resulting PDF is stored as an ordinary upload and a PowerPoint deck’s speaker notes are stored alongside it, apart from the board, so that viewers never receive them.
Quick whiteboards are temporary boards that a signed-in teacher starts and opens on another device by typing a code. They are not kept with your boards, and expire eight hours after their last change.
Portable .wingsuit files stay on your device unless you choose to save them to Wingsuit. Cloud content is stored on the service so that it can be opened and synchronised across your devices.
Trying the whiteboard without an account creates nothing on Wingsuit’s servers: no account, no board and no uploaded file. That board, and any images you put on it, are held only in the browser you drew them in, in its own database, along with your drawing preferences; nothing is ever uploaded, which is why importing a Word or PowerPoint file, widgets, saving to a file and exporting a PDF are only available once you have an account. There is no expiry: the board stays in that browser until you sign up and it is saved to Wingsuit, or until you clear this site’s data.
Student information you choose to add
Wingsuit does not ask for information about students and does not need any. Student personal data only reaches Wingsuit if a teacher writes or uploads it onto a board, types names into a widget such as the name picker or group maker, or keeps a class list in a name picker in their library. Only include student information you are authorised to use, and follow your institution’s policies.
Support and diagnostic information
When you raise a support ticket, Wingsuit keeps that correspondence: your messages, any screenshot you attach, the app version, your timezone and a request identifier, so that there is a history to refer to. Sensitive actions, including any occasion on which an administrator signs in as you to investigate a problem, are written to an audit log. It records who did what and when, and for sharing and renaming, the email addresses or names involved; it never holds what is on a board. Wingsuit also counts tool usage each day in aggregate and records service metrics.
Surveys
Now and then Wingsuit may ask you a few questions about how you use it, in a short survey that appears when you open the app. Surveys are only ever used to hear how you use Wingsuit, so that it can be made better, and never for anything else. Answering is up to you: you can say no, or leave it for later. Your answers are stored apart from your account, with no name or time on them, and the results Wingsuit’s administrators read show no names. What is kept against your account is only that you answered or said no, so that you are not asked the same survey again.
Emails
Wingsuit sends three kinds of email, each to your account’s own address. If you sign in with an email and password, it sends a link to confirm that address, when you sign up or when you ask for another, and a link to reset your password, only when you ask; each contains a link that expires after an hour and nothing else. And if you cancel a subscription on the website, it sends a confirmation that the cancellation was received, saying what was cancelled, when, until when it keeps working and anything refunded. They come from noreply@usewingsuit.co.uk, replies go to support@usewingsuit.co.uk, and they are sent through Resend, with open and click tracking turned off. The only other emails an account receives are Stripe’s renewal reminders and payment receipts for a subscription, sent to your account’s email address on Wingsuit’s behalf. When you report something shared with you, Wingsuit also emails the report to its own support address, through Resend: the reason, the name of the board or folder, the names and email addresses of its owner and of whoever shared it, your account identifier and anything you wrote.
What Wingsuit does not do
There is no advertising, no analytics or tracking of any kind, no profiling, no AI features, and no marketing email. There are no third-party fonts, scripts or content delivery networks on the site.
Why Wingsuit uses it, and on what lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, storing and synchronising your boards and files, sharing and broadcasting when you ask for it, and providing the plan you have chosen | Performance of a contract with you (UK GDPR Article 6(1)(b)): the terms you accept when you sign up |
| Keeping your account and boards secure: session records holding a token, its expiry, the IP address and the browser or app the session started from, so that you stay signed in and suspicious access can be investigated | Legitimate interests (Article 6(1)(f)) in securing the service and preventing unauthorised access to teachers’ accounts and teaching material. Article 6(11)(c) gives “ensuring the security of network and information systems” as an example of exactly this |
| Keeping an audit log of sensitive actions on an account | Legitimate interests (Article 6(1)(f)) in accountability, and in being able to reconstruct what happened after an incident or a disputed change |
| Answering support requests (your messages, any screenshot you attach, the app version, your timezone and a request identifier) and recording faults in the server’s own logs | Legitimate interests (Article 6(1)(f)) in supporting the people who use Wingsuit and fixing faults so that lessons do not break |
| Asking how you use Wingsuit in an occasional survey, which you may answer or turn down | Legitimate interests (Article 6(1)(f)) in improving Wingsuit for the people who use it. Answering is optional, and answers are kept without your name |
| Counting tool usage each day in aggregate, and recording service metrics | Legitimate interests (Article 6(1)(f)) in knowing which parts of the service are used and whether it is healthy. These counts are totals, not linked to individuals |
| Taking payment and running your subscription: your subscription record, any grant or code applied to your account, your credit ledger, and the log of what the payment providers report | Performance of a contract with you (Article 6(1)(b)) for the plan you bought; legitimate interests (Article 6(1)(f)) in giving a plan or a raised limit to an account without charging it |
| Keeping your order record: what was bought, the wording you were shown, the version of the terms, the time, and the confirmation document | Legal obligation (Article 6(1)(c)): the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 require the acknowledgement and the confirmation, and Wingsuit has to be able to show it gave them |
| Keeping records required for tax and accounting, and responding to lawful requests | Legal obligation (Article 6(1)(c)) |
Where Wingsuit relies on legitimate interests, it has carried out a legitimate interests assessment (the ICO’s three-part purpose, necessity and balancing test) for each purpose, and concluded that those interests are not overridden by your interests, rights and freedoms. Ask for a copy of any of them and it will be sent to you.
Your right to object. Because these purposes rely on legitimate interests, you have the right under Article 21 of the UK GDPR to object at any time, on grounds relating to your particular situation. Say so and the processing stops, unless there are compelling legitimate grounds that override your interests, or the data is needed to establish, exercise or defend legal claims. The reasoning will be explained either way. Where an objection cannot be honoured while your account stays open (a signed-in account cannot exist without a session record), that will be said plainly, and closing the account is the alternative.
Where a school has adopted Wingsuit, the school decides the purposes for anything its teachers put on boards about its students and staff, and Wingsuit processes that information only on the school’s instructions.
Wingsuit does not rely on consent for any of the processing described above, and does not use special category data. If Wingsuit ever asks for your consent for something, you will be able to withdraw it by emailing the address above.
Google and Apple sign-in
If you sign in with Google, or with Apple in the iPhone and iPad app, Wingsuit receives the account information that service shares, such as your name, email and account identifier. Wingsuit stores linked-account credentials to maintain the connection. Google and Apple handle their side of sign-in as controllers in their own right, under their own privacy policies, and each is only involved if you choose to sign in with it.
Subscriptions and payments
Wingsuit runs its own billing, and which plan you are on is worked out from its own records rather than asked of anyone else.
Paying by card on the web. Wingsuit creates a Stripe customer the first time you go to pay (not when your plan is read) and gives Stripe two things: your email address and your Wingsuit account identifier. It does not send your name. Your card and billing details are collected by Stripe’s own checkout page and stay with Stripe. If you hold credit, it is mirrored to your Stripe balance so that it comes off your next invoices.
Wingsuit does not collect your full payment-card details. You can read more about Stripe’s data practices here: Stripe.
Who else sees your information
People you share with. Anyone you give a view-only link, a folder link or a broadcast room link can see the content you make available through it. Anyone who obtains such a link may be able to use it. Turning off sharing stops access through that link and closes any viewer connections; it cannot remove copies someone has already made. A broadcast to a room lapses at the next midnight, UK time.
Sub-processors. Wingsuit uses a small number of companies to host the service, store files, convert documents, take payments and send the emails described above. Every one of them, what it receives and where it is, is listed at sub-processors.
Error reports. Wingsuit sends error reports to no one. When something fails, the server writes a line to its own logs (what failed, the path, a request identifier and the technical detail of the fault), which is held with the rest of the server’s logs at the hosting provider named on the sub-processors page, for up to 90 days. Your browser reports nothing.
Administrator access. No one at Wingsuit looks at your content except for limited purposes: to help with a support request you have made, on the rare occasions when an error stops an automated process part-way through, or to protect the security of the service. Admin access is limited to the company’s sole director, Alex Colville, and signing in as another account is recorded in the audit log.
When required by law. Information may be disclosed where the law requires it, such as a valid court order or a tax audit, in which case only the minimum needed is disclosed.
If Wingsuit changes hands. If Wingsuit is ever sold or transferred, account holders will be told before any personal information is transferred or becomes subject to a different privacy policy.
Schools and colleges
Where a school or college adopts Wingsuit, the school is the controller of anything about its students and staff that its teachers put onto boards, and Wingsuit is the school’s processor for that information: Wingsuit processes it on the school’s documented instructions and for no other purpose. The terms of that arrangement are in the data processing agreement, which a school can sign. There is no charge for it, and no institutional plan has to be bought first. A2x Development Ltd remains the controller of the teacher’s own account information (name, email, sessions, plan) in every case.
If you are a student, a parent or a member of staff asking about information a teacher has put into Wingsuit, contact the school or college; it holds the records and decides what happens to them. Tell Wingsuit anyway and it will help the school answer.
Children and students
Wingsuit accounts are for teachers, who are adults. Wingsuit is not directed at children and does not knowingly create accounts for them.
Students do not have accounts. A student opens a share or room link and watches a board, view-only. There is no chat, no comments, no student-generated content, no messaging of any kind, no student profiles, and no point at which a student is asked for a name. A viewer is an anonymous connection held in memory and counted; nothing about a viewer is written to the database. As with any website, the hosting infrastructure necessarily sees a viewer’s IP address in transit while the connection is open. More detail is in the safeguarding statement.
The Children’s code. The ICO’s Age Appropriate Design Code (the “Children’s code”) applies to online services likely to be accessed by under-18s. The ICO puts education technology supplied purely on a school’s instructions outside the Code, but one of its conditions is that the service is not available direct to consumers, and Wingsuit is: a teacher can sign up here or in the App Store without a school. So Wingsuit treats itself as in scope and designs to the Code’s fifteen standards. In practice it meets them by collecting no personal data from students at all: no student accounts, nothing collected from a viewer, no profiling, no advertising, no location data, no nudges towards sharing more, and sharing that is off until a teacher turns it on. High privacy is the only setting there is, because there is nothing to collect. That assessment is written down and reviewed when the product changes. Since 5 February 2026, Article 25 of the UK GDPR, as amended by section 81 of the Data (Use and Access) Act 2025, also requires children’s higher protection needs to be taken into account in how a service is built; that record is how Wingsuit does it.
Cookies and device storage
Wingsuit stores a small amount of information on your device. None of it is used for advertising, analytics or tracking, and there are no third-party scripts, fonts or content delivery networks, so there is no consent banner. Storing information on your device is governed by regulation 6 of the Privacy and Electronic Communications Regulations, as substituted on 5 February 2026, and every item below falls within an exception in the new Schedule A1 to those regulations.
| What is stored | Why | Where, and for how long | Which exception |
|---|---|---|---|
Session cookie (better-auth.session_token, sent as __Secure-better-auth.session_token over HTTPS) | Keeps you signed in on the web | Browser cookie; until you sign out, or seven days after you last used Wingsuit | Strictly necessary: authenticating you (Schedule A1, paragraph 4) |
Session copy (better-auth.session_data, sent as __Secure-better-auth.session_data over HTTPS) | Lets Wingsuit see who you are without looking your session up on every request. It holds the details kept with your session, such as your name, email address and role, signed so they cannot be altered | Browser cookie; five minutes at a time, and gone when you sign out | Strictly necessary: authenticating you (paragraph 4) |
Sign-in check (better-auth.state) | Makes sure the person coming back from Google is the one who left to sign in | Browser cookie; five minutes | Strictly necessary, authenticating you (paragraph 4) |
Sign-in token (session-token) | Keeps you signed in in the iOS and Android app | App preferences storage on the device; until you sign out | Strictly necessary: authenticating you (paragraph 4) |
A one-time key (native-return-key) | Lets the app recognise you coming back from signing in with Google in the system browser | App preferences storage on the device; until the next sign-in | Strictly necessary, authenticating you (paragraph 4) |
| Choices you make: the colour, size and style each tool was last left on, the position and zoom of each board you open, which of your library’s name pickers each board picks from, pen mode and what squeezing an Apple Pencil does on an iPad, and the folders you last copied a template into | So that a board opens where you left it and your tools stay as you set them | Browser local storage; until you clear it | Strictly necessary: recording selections you make (paragraph 4) |
| The names you last typed into the name picker or group maker | So that the next name widget you add on this device starts with the same class | Browser local storage; until you type a different list or clear this site’s data. Signing out does not remove it, so on a shared computer clear this site’s data when you finish | Strictly necessary, storage you instigated (paragraph 4) |
| Copies of the boards you have open, their pictures, work not yet sent, the class lists in the name pickers in your library, and your name, email address and role | So that a lesson carries on if the network drops | Browser database; until you sign out, or another account signs in on this device | Strictly necessary, providing what you asked for (paragraph 4) |
| Wingsuit’s own pages and code, with nothing about you in them | So that Wingsuit opens without a network | Browser cache; replaced by each new version of Wingsuit | Strictly necessary, providing what you asked for (paragraph 4) |
| An invitation link you arrived with | So that the month of Wingsuit Pro it offers can be claimed when you sign up | Browser local storage; until you sign up, or 30 days | Strictly necessary, storage you instigated (paragraph 4) |
| Whether your network needed the slower kind of live connection | So that a school network that blocks the faster kind is not tested again at the start of every lesson | Browser local storage; 24 hours | Strictly necessary, providing what you asked for (paragraph 4) |
| A board you drew without an account, and its images | Keeps the board you are trying, through a reload and through signing up | Browser database; until you save it to Wingsuit or clear this site’s data | Strictly necessary: storage you instigated (paragraph 4) |
| A .wingsuit file you opened from your device | Holds the file while you sign in, so that opening it does not lose it | Browser database; until the file is opened | Strictly necessary: storage you asked for (paragraph 4) |
| Appearance preferences: light or dark, which theme, board appearance, whether the sidebar is collapsed | Remembers how you like Wingsuit to look | Browser local storage; until you clear or reset it | Appearance or functionality (paragraph 6). Not strictly necessary, so you can object; see below |
| Local .wingsuit files | Boards you chose to save to this device | Your device; until you delete them | Strictly necessary: storage you instigated (paragraph 4) |
Everything in the table except appearance preferences is strictly necessary to provide Wingsuit, so no consent is needed for it and there is nothing to switch off without breaking the service. Your colour theme and pen colours are also kept with your account, rather than on the device, so that they follow you to every device you sign in on.
Appearance preferences, and how to object to them. These are not strictly necessary (Wingsuit works without remembering them) so the law allows them only if you are told what they are for, which is what this section is, and given a simple, free way to object. Today that works like this: nothing is stored until you change a setting away from its default, and choosing the default again removes what was stored: “System” for light or dark, “Lagoon” for the theme, “Match app” for board appearance, leaving the sidebar open. Clearing this site’s data in your browser removes all of it. If you would rather Wingsuit did not store appearance preferences at all, email support@usewingsuit.co.uk and it will be dealt with: there is no single switch for it yet, and this page will say so when there is.
Clearing device storage can sign you out or remove preferences and locally stored work. Export any local files you want to keep first.
Where your information is kept
Wingsuit’s database, uploaded files and backups are stored in the Netherlands, in the EU West region of its hosting provider. The United Kingdom’s adequacy regulations cover EEA states, so keeping data there needs no further safeguard (Data Protection Act 2018, Schedule 21, paragraphs 4 and 5). The document-conversion service that turns an imported Word or PowerPoint file into a PDF runs on Railway in the same region. It receives a Word or PowerPoint file only when a teacher imports one, returns a PDF, and keeps nothing.
Some of the companies Wingsuit relies on are established in the United States, even where the data itself stays in Europe. And because their staff can reach the systems, that counts as a transfer. The emails Wingsuit sends are the exception that does leave Europe: they are stored in the United States. Each one is covered:
- Railway Corporation (hosting) and Stripe, LLC (payments) are certified under the UK Extension to the EU-US Data Privacy Framework, with active status for both HR and non-HR data, checked on the official list at dataprivacyframework.gov on 19 September 2026. Transfers to them are covered by the UK’s adequacy regulations for the United States (SI 2023/1028). Railway’s own platform logs and service metadata are not confined to the EU West region and may be processed in the United States, under that same certification.
- Plus Five Five, Inc. (Resend, which sends Wingsuit’s emails) sends them from Ireland but stores them in the United States. It is listed on the Data Privacy Framework List as active under the EU-US Data Privacy Framework and its UK Extension for non-HR data, checked on 13 October 2026. Its agreement also carries the EU Standard Contractual Clauses with the UK Addendum, which would cover the transfer if its certification lapsed.
Each company, with its transfer mechanism, is named at sub-processors, and data residency and retention explains the arrangements in full. These certifications are re-checked at least once a year, and whenever a supplier is added. Data is encrypted in transit over HTTPS and WSS, and encrypted at rest by the hosting provider at the storage layer.
How long it is kept, and deletion
Information is kept for as long as it is needed for the purpose it was collected for, and no longer. Boards and folders are kept until you delete them. A deleted board sits in the recycle bin for 7 days on Wingsuit Starter and 90 days on Wingsuit Pro, and is then removed; deleting a board turns its sharing off at once. Uploaded files are removed once nothing has referred to them for a day. Support screenshots are kept for 30 days and resolved tickets and their messages for 180 days; survey answers, which carry no name, until the survey is deleted; audit events for 365 days; daily usage counts for 90 days; service metrics for about 30 days; quick whiteboards for eight hours after their last change. Every one of these is enforced by an hourly sweep, not by hand. The emails Wingsuit sends are kept by Resend, with their delivery logs, for 30 days. The full schedule is at data residency and retention.
Subscriptions, grants, credit, orders and the provider event log are kept while your account is open; the event log is deleted after 90 days in any case.
You can delete your account yourself in Settings. Asking freezes it at once: every other session is signed out, and share links and broadcast rooms stop letting anyone new in. 14 days later the account is deleted, with everything in your own library, your rooms, your preferences and every billing record above, and its uploaded files follow in the next sweep. Three things stay. Boards, folders and name pickers you made in an organisation’s or a team’s space belong to that space, so they pass to another of its members, and are deleted only if nobody is left. Support tickets you raised stay, with your name taken off them and any screenshot removed, until 180 days after they were resolved. And audit events about your account stay until their 365 days are up. Signing in during those 14 days and choosing Restore puts the account back as it was, except that a subscription stays set to end until you turn renewal back on in Settings. Asking to delete also sets a Stripe subscription to stop at the end of the period you have already paid for, and it is cancelled outright when the account goes, so you are never charged again.
You can also ask in Settings for a copy of everything Wingsuit holds about you. It is built in the background and downloaded from the same page, as JSON plus the original picture files, and Wingsuit removes it 7 days after it is ready.
Three things outlast deletion from the live service. Backups are point-in-time recovery snapshots held in the same region, which age out of the recovery window: the hosting provider keeps the last four full backups, roughly four weeks. Payment and invoice records are kept by Stripe under its own legal obligations. And A2x Development Ltd’s accounting records (the invoices behind a paid subscription, which carry a name, an email address and a country) must be kept for at least six years from the end of the financial year they relate to, under the Companies Act 2006 and HMRC’s record-keeping rules. Those live in the company’s books, not in Wingsuit’s database, and nothing from a board, a folder or a file is ever part of them. The right to erasure in Article 17 of the UK GDPR does not apply to information the law requires to be kept; it applies to everything else, which goes as described above.
How your information is kept secure
Traffic between your browser or app and Wingsuit is encrypted with TLS. Passwords are hashed, never stored in a readable form. Shared links use unguessable identifiers and uploaded files are addressed by a 256-bit hash of their contents. Administrative access is limited to the company’s sole director, and every administrative action on an account, including signing in as it, is logged.
Wingsuit has not had a penetration test and holds no security certification such as ISO 27001 or Cyber Essentials. That is stated plainly rather than implied away. If you think you have found a security problem, email support@usewingsuit.co.uk.
If something goes wrong. Every personal data breach is written down, whether or not it has to be reported. Where Wingsuit is the controller and a breach is likely to result in a risk to people’s rights and freedoms, it is reported to the regulator without undue delay and, where feasible, within 72 hours of Wingsuit becoming aware of it; where the risk to you is high, you will be told directly and in plain English what happened, what it means for you, what has been done and what you should do. Where a school is the controller (that is, for what its teachers have put on boards), the school is told without undue delay and it decides what to report and to whom.
Your rights
Under the UK GDPR you have the right to:
- Be informed about what is collected and why, which is what this policy is for.
- Access the personal information held about you, and get a copy of it. You can ask for that copy yourself in Settings.
- Rectification: have inaccurate information corrected and incomplete information completed.
- Erasure: have your personal information deleted. Much of this you can do yourself: deleting your account in Settings freezes it at once and deletes it 14 days later, as described above.
- Restrict processing in certain circumstances, for example while a disagreement about accuracy is resolved.
- Object to processing carried out on the basis of legitimate interests.
- Data portability: receive the information you provided in a structured, commonly used, machine-readable form, and have it sent elsewhere where that is technically feasible.
Email support@usewingsuit.co.uk to exercise any of these. There is no charge, and a response will follow within one month. Your identity may need to be verified first, usually by confirming the email address on the account. Some information may have to be kept to meet a legal obligation or to resolve a dispute, and any limit on a request will be explained.
Wingsuit does not make any decision about you by automated means alone, and does not carry out profiling.
Complaints
If you think Wingsuit has handled your personal information wrongly, you can complain directly. You do not need to use legal language or point to any part of the law: just say what happened and what you would like done about it. This is the route section 164A of the Data Protection Act 2018 requires Wingsuit to offer you.
Email support@usewingsuit.co.uk with “Complaint” in the subject line, or write to A2x Development Ltd, 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. If it is easier, raise it through the ordinary support channel and it will be treated as a complaint.
Your complaint will be acknowledged within 30 days of arriving. It will then be looked into without undue delay, you will be kept up to date on progress, and you will be told the outcome and what has been done about it.
If your complaint is about information held for your school or college (boards or class materials made for its students), the school is normally the controller and you should complain to it. Tell Wingsuit anyway and it will be passed on, with help answering it.
If you are unhappy with the response, or there is no reply, you can complain to the UK’s data protection regulator: the Information Commission, which took over the Information Commissioner’s functions on 30 September 2026 and is still known as the ICO. Complaints go to it at ico.org.uk/make-a-complaint. The regulator will normally ask you to raise it with Wingsuit first.
Whether you have to provide information
Providing a name and email address is a requirement of having an account: without them there is no way to sign you in, keep your work separate from everyone else’s, or contact you about your account, so an account cannot be created. Everything else (a profile image, an uploaded file, a support screenshot) is optional, and leaving it out only means the feature that uses it is unavailable. There is no statutory requirement to give Wingsuit anything.
Changes and questions
This policy will be updated as the service changes and to keep it accurate. When a significant change is made, the date at the top of this page is refreshed and account holders are told through the service. The terms and conditions cover the rest of the agreement for using Wingsuit.
Any question, comment or concern about this policy, your data or your rights: email support@usewingsuit.co.uk.