Privacy Policy of Wingman AI

This policy describes which personal data we process when you use Wingman AI: the desktop app, the cloud service and the website wingman-ai.com.

1. Controller

ShipBit GmbH
Graf-Haeseler-Str. 3
44135 Dortmund
Germany

Email: [email protected]

For all questions about data protection and for your rights (section 6), you can reach us at this address.

2. The key points in brief

• We do not store conversation content on our servers. What you say to your Wingmen is sent to AI providers to be answered and is not retained by us afterwards. The exception is error reports, if you allow them (section 3.7).
• The memory of your Wingmen is stored on your device.
• We do not use your input to train AI models.
• The desktop app does not set any advertising or tracking cookies. Neither does the website.
• Your account is stored in the EU (Frankfurt am Main). AI requests are also processed in the USA and in other countries (section 4).

3. Which data we process and for what purpose

3.1 Account and sign-in

For your account, we store your email address, your display name, your profile picture (if any), your plan, when you agreed to which Terms, the devices you have connected to Wingman AI, and technical identifiers of your account.

You sign in via a link that we send you by email, or via Google, Discord, GitHub or Apple. When you sign in via one of these providers, we receive from them your account ID there, your name, your profile picture and your email address. There is no password with us.

• Purpose: maintaining your account, signing you in, providing the service.
• Legal basis: contract (Art. 6(1)(b) GDPR).
• Recipients: Supabase Inc. (database and sign-in, processing in the EU, Frankfurt am Main); depending on the sign-in method chosen, Google Ireland Ltd. or Google LLC, Discord Inc., GitHub Inc., Apple Inc. or Apple Distribution International Ltd.; for the emails containing the sign-in link, Resend Inc. (USA).
• Retention period: until you delete your account. After that, we delete the data unless we are required to retain it for legal reasons.

3.2 AI features of your plan

When you use the AI features of your plan, the app sends your request to our cloud service: the text, the audio recording in the case of voice input, the image in the case of image features, and the necessary conversation history. Our server forwards the request and returns the answer to the app.

• Speech recognition (speech to text): OpenAI or Inworld AI.
• Language models (the answers): via the AI Gateway of Vercel Inc. to a provider of the model that your plan designates for the respective task, for example OpenAI, Anthropic, Google, Alibaba, DeepSeek or Zhipu (Z.ai), or to a data centre that operates this model. Which provider answers is chosen by the gateway based on speed.
• Speech output (text to speech): Microsoft (Azure Speech), Inworld AI or OpenAI.
• Memory: So that your Wingmen can remember, excerpts of conversations are summarised by a language model via the same route and converted into numerical form (embeddings). The result is stored only on your device.

The AI providers do not receive your account ID. They process the request in order to answer it and, depending on the provider, may store it for a limited time (often up to 30 days) to detect abuse. We do not store the content. We store only which model you used, when and to what extent, in order to account for quotas and costs.

Wingman AI does not recognise people by their voice and does not create voice profiles.

• Purpose: providing the AI features, enforcing quotas.
• Legal basis: contract (Art. 6(1)(b) GDPR).
• Location: USA and other countries, depending on the provider, possibly including China (section 4).
• Retention period: no content stored by us; usage data (model, time, extent) until the account is deleted.

3.3 Your own API keys

If you store your own keys for AI providers, for example OpenAI or ElevenLabs, requests go directly from your device to that provider, without our server. We do not receive any data in the process. The provider is responsible for this processing; its privacy policy applies. The keys are stored only on your device.

3.4 Subscription and payment

Paid plans are sold by PayPro Global Inc. (Canada) as the reseller. For the purchase, PayPro Global collects your name, your email address, your billing address and your payment details, and is itself responsible for this. From PayPro Global we receive only which plan you have, the status and term of the subscription, and an identifier of the order, no payment details.

• Purpose: activating and managing your subscription.
• Legal basis: contract (Art. 6(1)(b) GDPR).
• Location: Canada. There is an adequacy decision of the EU Commission for Canada.
• Retention period: for as long as the subscription exists and thereafter to the extent required by tax and commercial law (up to 10 years).

3.5 Emails

We send you emails that are part of the service, for example sign-in links, notices about your subscription and replies to your feature requests. We do not send advertising by email; there is no newsletter.

• Recipients: Resend Inc. (delivery, USA).
• Legal basis: contract (Art. 6(1)(b) GDPR).
• Retention period: delivery logs at Resend for a limited time, after which they are deleted.

3.6 Feature requests

When you write, comment on or vote on a feature request in the app, we store the text, your votes and the fact that it comes from your account. Other users see the text, but not who it is from.

• Purpose: collecting, answering and implementing requests.
• Legal basis: contract (Art. 6(1)(b) GDPR).
• Retention period: until you delete the post or your account.

3.7 Error reports (only with your consent)

Only if you allow error reports, when agreeing to the Terms or in the settings, Wingman AI sends a report to Sentry when an error occurs. It contains the error message, details about the device, operating system and version, your account ID and the last clicks in the user interface. Reports from Core additionally contain the log of the current session. It may contain what you said to your Wingmen and what they answered.

• Purpose: finding and fixing errors.
• Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the settings.
• Recipients: Functional Software Inc. (Sentry), processing in the EU (Frankfurt am Main).
• Retention period: usually 90 days.

3.8 Usage statistics of the app

The app sends anonymous usage statistics to Aptabase, for example how often it is launched and which features are used. Aptabase does not set cookies or device identifiers. An identifier is formed from the IP address and browser identifier using a random value that changes daily, and is discarded after 24 hours. You can turn off the statistics in the settings under "General".

• Purpose: understanding which features are used, and improving Wingman AI.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Recipients: Technov Solutions SRL (Aptabase), processing in the EU (Germany).

3.9 Website

When you visit wingman-ai.com, our hosting provider Vercel Inc. processes technically necessary data such as IP address, browser, page accessed and time, in order to deliver the page and protect it against attacks. The site uses Vercel Web Analytics: an audience measurement without cookies that does not recognise visitors across multiple days. We load fonts from our own server.

If you come to the site via a referral link, we store the referral code in a cookie for 30 days so that it is pre-filled when you take out a plan. On the account page, we store your sign-in in cookies. More on this in the Cookie Policy.

• Legal basis: legitimate interest in a secure, functioning website and in audience measurement (Art. 6(1)(f) GDPR); for the sign-in, the contract (Art. 6(1)(b) GDPR).
• Recipients: Vercel Inc. (USA); Cloudflare Inc. (name resolution and forwarding, USA).
• Retention period: server logs usually no longer than 30 days.

3.10 Hosting of the cloud service

Our cloud service runs at Vercel Inc. (USA), the database at Supabase Inc. in the EU (Frankfurt am Main). Both process data on our behalf.

3.11 Contact and support

If you write to us by email or on our Discord server, we process your message and your contact details in order to reply to you (Art. 6(1)(b) or (f) GDPR). For Discord, the privacy policy of Discord Inc. applies additionally.

4. Transfer to countries outside the EU

Some recipients are based outside the EU or process data there, primarily in the USA. For the USA, we transfer data to companies certified under the EU-US Data Privacy Framework on the basis of the adequacy decision of the EU Commission, and otherwise on the basis of the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR).

With AI models from Chinese providers (for example Alibaba, DeepSeek, Zhipu), it cannot be ruled out that your request is processed in China. There is no adequacy decision for China, and the level of data protection is not comparable to that of the EU. In particular, authorities there could access data without effective legal remedies being available to you.

5. Do you have to give us data?

Without an account, you cannot use the cloud service; for this we need at least your email address or a sign-in via one of the providers mentioned. Error reports and usage statistics are voluntary.

We do not make any automated decisions about you that produce legal effects concerning you (Art. 22 GDPR).

6. Your rights

You have the right to

• access to your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR); you can also delete your account yourself in the app or on wingman-ai.com,
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR).

Right to object: If we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can also turn off the app's usage statistics yourself at any time in the settings.

To do so, write to us at [email protected]. We will reply within one month.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf.

7. Children

Wingman AI is only permitted from the age of 16. If we learn that an account belongs to a child under 16 years of age, we will delete it.

8. Security

We transfer data in encrypted form and protect our systems with technical and organisational measures against loss, misuse and unauthorised access.

9. Changes

We adapt this Privacy Policy when Wingman AI or the legal situation changes. The current version is always available in the app and at wingman-ai.com/privacy, with the version and date at the end.

Version 1 of 10/21/2026