Sub-processors

Sub-processors

The following companies process personal data on Wingsuit’s behalf:

Payments, in full

Wingsuit runs its own billing. Which plan an account is on, what was bought, what an administrator or a code has granted it and what credit it holds are all records in Wingsuit’s own database, not in a third party’s.

For a card payment on the web, Wingsuit creates a Stripe customer the first time a teacher goes to pay (never when a plan is merely read) and gives Stripe two things: the account’s email address and its Wingsuit account identifier. It sends no name. The card number, the cardholder’s name and any billing address are typed into Stripe’s own checkout page and are held by Stripe, not by Wingsuit.

Stripe never receives board content, uploaded files, class names or anything else a teacher has made.

Transfers out of the UK

Wingsuit’s database, uploaded files and backups are stored in the Netherlands, and so is the document-conversion service. The United Kingdom’s regulations under Article 45A of the UK GDPR cover EEA states, so keeping data there needs no further safeguard (Data Protection Act 2018, Schedule 21, paragraphs 4 and 5).

Storage location is not the whole answer, though. Several of the companies above are established in the United States, and because their staff can reach the systems, that counts as a transfer even where the data itself stays in Europe. Each entry in the table names the safeguard that covers it. The Data Privacy Framework certifications were checked against the official list at dataprivacyframework.gov on 19 September 2026: Railway Corporation and Stripe, LLC are active under the UK Extension for HR and non-HR data. Resend, added on 13 October 2026, was checked the same day and is active under the UK Extension for non-HR data. These are re-checked every year, and whenever a supplier is added.

Not sub-processors

• The software that turns an imported Word or PowerPoint file into a PDF is run by Wingsuit itself, not bought as a service from anyone. It runs on Railway, alongside the rest of Wingsuit, so the conversion service is not a separate entry.
• Apple and Google are independent controllers, not Wingsuit sub-processors, for the account information they share when you sign in with them. Google’s own terms describe this relationship as “Controller-Controller” rather than processor and controller. Apple does not use that wording in the pages Wingsuit has checked, but it manages the sign-in relationship with you itself, and Wingsuit only receives the account information Apple or Google shares.
• Wingsuit sends no email other than the kinds Resend sends for it, and no marketing email at all. Stripe sends the renewal reminders and payment receipts for a web subscription on Wingsuit’s behalf, from its own systems, to the account’s email address. Wingsuit uses no analytics, no advertising, no CDN or third-party fonts or scripts, and no AI provider.

Changes to this list

Before a new sub-processor begins processing a school’s data, Wingsuit will publish it here, with its identity, location, what it will do and its safeguards, and email the contact named in that school’s data processing agreement, at least 10 business days beforehand, or longer if the agreement the school signed says so. Publishing alone is not treated as telling you; the email is the notice and this page is the record.

A school with a signed agreement may object in writing, with reasons, within that period, and the agreement it signed sets out what happens then. Under the current version, an objection does not hold up the change: the two sides try to resolve it, and if they have not within 30 days the school may end its agreement without penalty and have back any fees paid in advance for the unused period. Send an objection, or ask to be added to the notification list, at support@usewingsuit.co.uk. See the data residency and retention page for where data lives and how long it is kept.

Changelog