Privacy Policy

1. Introduction

WingZen Inc. (“WingZen,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our private aviation charter technology platform.

By using WingZen, you consent to the data practices described in this policy. If you do not agree with our policies and practices, please do not use our Service.

WingZen Inc. is incorporated in Calgary, Alberta, Canada and is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Alberta's Personal Information Protection Act (PIPA). If you are located in the European Union, additional rights under the General Data Protection Regulation (GDPR) apply to you — see Section 9 for details. If you are a California resident, see Section 10 for your rights under the California Consumer Privacy Act (CCPA).

2. Information We Collect

2.1 Personal Information

We collect personal information that you voluntarily provide when registering, booking flights, or communicating with us:

• Name and contact information (email, phone number)
• Account credentials
• Billing and payment information
• Travel document information (passport numbers for international flights)
• Government-issued identity document type and verification status (see Section 2.4 below)
• Emergency contact information
• Date of birth (for passenger manifests)
• Communication preferences

2.2 Operator Business Information

For operators, we additionally collect:

• Business name and registration details
• Tax identification numbers
• Aircraft registration and certification documents
• Banking and payment account details

2.3 Automatically Collected Information

When you use our platform, we automatically collect:

• Device information (type, operating system, browser)
• IP address and approximate location data
• Usage data (pages visited, features used, time spent)
• Cookies and similar tracking technologies (see Section 8)

2.4 Biometric Data

WingZen does not collect, store, or process biometric data. Identity verification is performed by our sub-processor Stripe, Inc. through its Stripe Identity service. When you submit an identity document for verification, the document is transmitted directly to Stripe for processing. WingZen receives and stores only the verification status result (e.g., “verified” or “unverified”) — we do not receive, store, or have access to the document images, facial recognition data, or any biometric identifiers extracted by Stripe during the verification process. For details on how Stripe handles identity verification data, please refer to Stripe's Privacy Policy.

2.5 AI Booking Assistant

WingZen offers an AI-powered booking assistant to help you search for flights and answer questions about our service. When you use this feature:

• Messages you send to the booking assistant are transmitted to and processed by Anthropic, PBC, our AI provider, to generate responses. Anthropic's AI processes your messages in accordance with Anthropic's Privacy Policy.
• Conversation history is stored to maintain context during your chat session.
• The booking assistant is designed to assist with flight search queries and general platform questions only. Do not share sensitive personal information — such as passport numbers, payment card details, government ID numbers, or passwords — through the chat assistant.

3. How We Use Your Information

We use collected information for the following purposes:

• Service Delivery: To facilitate flight bookings, process payments, and enable communication between customers and operators
• Account Management: To create and manage your account, verify identity, and provide customer support
• Safety and Compliance: To verify operator credentials, ensure regulatory compliance, and maintain platform safety
• Transactional Communication: To send booking confirmations, payment receipts, booking status updates, security alerts, and important service announcements
• Marketing: To send promotional materials (only with your explicit consent) and personalize your experience
• Analytics: To analyze usage patterns and improve our platform
• Legal Obligations: To comply with legal requirements, respond to lawful requests, and protect our rights

4. Information Sharing

We may share your information with:

4.1 Operators and Customers

When you book a flight, we share necessary information between customers and operators to facilitate the charter service (names, contact information, passenger details). Customer identity documents and detailed contact information are shared with operators only after a booking is mutually confirmed.

4.2 Sub-Processors

We share information with the following third-party sub-processors who assist in operating our platform:

We require all sub-processors to maintain appropriate security measures and to process personal information only as necessary to provide services to WingZen. Sub-processors are contractually bound to data protection obligations consistent with this Privacy Policy.

4.3 Legal Requirements and Government Requests

We may disclose personal information in response to valid legal process, including court orders, subpoenas, or lawful requests from government or regulatory authorities (including Transport Canada, the Federal Aviation Administration, or law enforcement agencies). Where permitted by law, we will notify affected users of such requests before disclosure.

WingZen publishes a transparency report annually summarizing the number and type of government data requests received. This report is available upon request by contacting privacy@wingzen.com.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption of data in transit (TLS 1.2+) and at rest
• Secure authentication mechanisms (including multi-factor authentication)
• Regular security assessments
• Access controls and employee training
• Incident response procedures

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

5.1 Data Breach Notification

In the event of a data breach involving your personal information, WingZen will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA's Breach of Security Safeguards Regulations. Notification will occur as soon as feasible, and no later than required by applicable law. Where a breach creates a real risk of significant harm, we will also notify affected individuals directly, describing the nature of the breach, the information involved, and the steps we are taking in response.

6. Data Retention

We retain your personal information for the following periods:

• Booking records and transaction data: 7 years from the date of the booking, as required for tax and legal compliance.
• Account information: For the duration of your account, plus 90 days after account deletion. We may retain certain records longer if required by law or for dispute resolution.
• Government-issued identity documents (passport scans, ID images): Deleted within 90 days of the last flight associated with the upload. These documents are classified as sensitive personal information under PIPEDA.
• Aircraft documents (operator accounts): Retained for the duration of the aircraft listing, plus 12 months after deactivation.
• Payment data: We do not store full card data. Payment method tokens are retained until you delete them. Transaction records: 7 years.
• Communication records (messages, emails): 3 years from the date of the booking or communication.
• Website usage data and analytics: 24 months.
• Marketing consent records: Retained for 3 years after consent withdrawal, as required for CASL compliance.

After the applicable retention period, personal information is either securely deleted or anonymized so it can no longer be associated with an individual. Booking records may be retained in anonymized form for platform analytics. You may request early deletion of your data by contacting privacy@wingzen.com, subject to our legal retention obligations above.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Request transfer of your data in a structured, machine-readable format
• Opt-out: Unsubscribe from marketing communications at any time
• Restriction: Request limitation of processing in certain circumstances
• Objection: Object to processing based on legitimate interests

To exercise these rights, contact us at privacy@wingzen.com. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

8. Cookies and Tracking

We use cookies and similar technologies to:

• Keep you logged in (session cookies)
• Remember your preferences (functional cookies)
• Analyze platform usage — using Google Analytics 4 (page views, funnel analysis, conversion events) and Microsoft Clarity (session recordings, heatmaps, interaction analysis)
• Measure advertising effectiveness — using the Meta Pixel for conversion attribution on Facebook and Instagram campaigns
• Store your cookie consent preference

Analytics and advertising cookies are only activated after you give explicit consent via the cookie consent banner displayed on your first visit. You can update your preferences at any time via the “Cookie Settings” link in the site footer. Essential session cookies cannot be disabled without losing the ability to sign in. For the full list of cookies used, their retention periods, and the third parties that set them, see our Cookie Policy.

9. International Data Transfers and GDPR

Your information may be transferred to and processed in countries other than your country of residence, including Canada and the United States (where our sub-processors are located). We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

9.1 European Union Residents

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional provisions apply:

Legal Bases for Processing

We process your personal data under the following legal bases as defined by Article 6 of the GDPR:

• Contractual Necessity (Art. 6(1)(b)): Processing necessary for the performance of a contract — including account creation, flight bookings, payment processing, and communications related to your bookings.
• Consent (Art. 6(1)(a)): Where you have given explicit consent — including marketing emails, promotional communications, and optional analytics cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legitimate Interests (Art. 6(1)(f)): Processing necessary for our legitimate business interests — including platform security, fraud prevention, service improvements, and enforcement of our terms. We balance these interests against your rights and freedoms.
• Legal Obligation (Art. 6(1)(c)): Processing necessary to comply with applicable laws — including tax record retention, regulatory compliance, and response to lawful government requests.

Your Additional GDPR Rights

In addition to the rights listed in Section 7, EU data subjects have the right to:

• Lodge a complaint with your local supervisory authority (data protection authority) if you believe your data has been processed unlawfully.
• Withdraw consent at any time for processing activities based on consent, without affecting the lawfulness of processing carried out before withdrawal.
• Object to automated decision-making including profiling, where applicable.

Data Transfers

Data transfers from the EEA to Canada are supported by the European Commission's adequacy decision recognizing Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) as providing adequate protection for personal data (partial adequacy decision). For transfers to the United States (where our sub-processors are located), we rely on Standard Contractual Clauses and the sub-processors’ own data protection frameworks.

EU Data Protection Contact

For inquiries related to your rights under the GDPR, please contact our Data Protection Officer at dpo@wingzen.com.

10. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose what personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collection, and the categories of third parties with whom it is shared.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions (e.g., legal retention obligations).
• Right to Opt-Out of Sale: WingZen does not sell your personal information to third parties. We have never sold personal information and have no plans to do so.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. You will not receive different pricing or service quality for exercising your privacy rights.

WingZen does not share personal information for cross-context behavioral advertising purposes.

To exercise your California privacy rights, contact us at privacy@wingzen.com. We will verify your identity before processing your request and respond within 45 days as required by the CCPA.

11. Canadian Anti-Spam Legislation (CASL)

WingZen complies with Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23). We distinguish between transactional and marketing communications as follows:

11.1 Transactional Communications (Implied Consent)

The following communications are sent under the implied consent and existing business relationship exceptions under CASL and do not require opt-in:

• Booking confirmations and status updates
• Payment receipts and authorization notices
• Security alerts (password resets, suspicious activity)
• Account notifications (identity verification, document expiry reminders)
• Pre-flight reminders and logistics information
• Dispute and cancellation communications
• Platform service announcements materially affecting your use

11.2 Marketing Communications (Express Consent Required)

The following communications require your explicit opt-in consent at the point of collection:

• Empty leg flight promotions and deals
• New feature announcements and platform updates
• Re-engagement campaigns
• Promotional offers and discounts

11.3 Consent Withdrawal

You may withdraw your marketing consent at any time by:

• Clicking the unsubscribe link included in any marketing email
• Updating your communication preferences in your account settings
• Emailing privacy@wingzen.com

Consent withdrawal is processed within 10 business days per CASL requirements. Withdrawing marketing consent does not affect transactional communications necessary for your use of the platform. WingZen maintains records of consent type, date of consent, and method of consent for each user.

12. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected information from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@wingzen.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last Updated” date. For material changes that significantly affect how we process your personal information, we will provide additional notice via email to the address associated with your account. We encourage you to review this policy periodically.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Privacy Inquiries: privacy@wingzen.com
Data Protection Officer: dpo@wingzen.com
Address: WingZen Inc., Calgary, Alberta, Canada

If you are not satisfied with our response to a privacy concern, you may file a complaint with the Office of the Privacy Commissioner of Canada or, if you are in Alberta, the Office of the Information and Privacy Commissioner of Alberta.