Privacy Policy

Wingspan Networks, Inc. ("Wingspan", "Our", "We", "Us") takes the privacy and security of personal information very seriously. As such, we have prepared the following Privacy Policy to provide you with information about how your data is collected, used, stored, shared, transferred, and protected as a result of your interaction with and use of (1) the www.wingspan.app, my.wingspan.app, and similar subdomain websites as applicable (the "Site"), which is owned and operated by Wingspan; (2) our mobile applications to which this Privacy Policy applies (the "Application") and/or (3) any of the online services offered by Wingspan made available through the Site or the Application ("Services"). By using the Site, Application, and/or Services, you agree to the following Privacy Policy and our Terms of Use. The provisions contained in this Privacy Policy supersede all previous notices and statements regarding our privacy practices with respect to our Services. If you disagree with any of the provisions described below, your remedy is to stop using the Site, Application, and/or Services immediately.

Application of this Privacy Policy

This Privacy Policy applies to your use of (regardless of means of access) our Site, Application, and/or Services. You may access or use our Services through a desktop, laptop, mobile phone, tablet, or other consumer electronic device (each, a "Device").

Information Collection

Information you provide us

When you interact with the Site, Application, and/or Services, including through submitting an inquiry through the "Contact Us" link or "Keep in Touch" box on the Site, we may ask you to provide personal information, such as basic contact information to assist us with helping you. Other interactions sites or Services, such as registering for a Wingspan account, may require you to provide additional information about yourself for the purposes of our providing the Services to you. In these cases you may need to provide additional information like your date of birth, company name, banking information, e-mail address, phone number, tax identification numbers, government-issued identification, insurance enrollment information, and other information that identifies you, including information identifying your identify as a benefits enrollee (collectively, "Personal Information"). Certain categories of Personal Information, such as tax identification numbers, government-issued identification, and financial account information, are considered Sensitive Personal Information under applicable law. It is your decision to use the Site, Application, and/or Services, and, as such, any provision of this personal information is completely voluntary. By providing your Personal Information to us, you expressly agree to our collection, use, storage, and disclosure of such information as described in this Privacy Policy.

Information about your transactions

We may collect Personal Information about your transactions with us and others.

Information from third parties

We may also collect Personal Information about you from other companies for the purposes of providing the Services. For instance, we may receive Personal Information about you from a consumer reporting agency.

Information automatically collected

We (or our service providers acting on our behalf) may collect information about your use of our Services. This information may include Personal Information as well as statistical, non-personal information that does not identify you ("Analytics"). Some Analytics may be correlated with Personal Information. When Analytics are, directly or indirectly, associated or combined with Personal Information, such Analytics will be considered Personal Information for purposes of this Privacy Policy.

Information that we automatically collect in connection with your access or use of our Site, Application, and/or Services may include:

• Device Information. We may collect Device-specific information (such as hardware model, operating system version, unique Device identifiers, and mobile network Information, including your mobile phone number). We may associate your Device identifiers or your mobile phone number with your Wingspan account.
• Log Information. We may record or log information from your Devices, their software, and your activity accessing or using our Services. This information may include the Device's Internet Protocol ("IP") address, the Device's operating system, identification numbers associated with your Devices, device event information such as crashes, system activity, and hardware settings, location preferences, date and time stamps of transactions, system configuration information, and other interactions with our Services.
• Other Information. We may collect information such as your browsing history on the Site, the length of time spent on certain pages, the website URL from the website you were visiting before coming to this Site, which URL you next visit, what browser you are using, Internet service provider, and date/time of visit information.

We may also collect Personal Information about you for other purposes from time-to-time, or as permitted or required by law. We will always identify any additional purpose prior to or at the time of collection.

Categories of Personal Information Collected

Under applicable privacy laws, we are required to disclose the categories of personal information we collect, the purposes for which they are used, and the categories of third parties with whom they are shared. The following table summarizes our data practices:

Information Use

We may use the Personal Information collected as described elsewhere in this Privacy Policy, including to:

• provide you with the Site, Application, and/or Services;
• respond to your inquiries or requests;
• communicate with you;
• process payments and payouts;
• facilitate tax compliance and reporting;
• administer insurance and benefits enrollment, including sharing SSNs and other enrollment data with insurance carriers;
• verify your identity and prevent fraud;
• comply with legal and regulatory obligations; and
• provide you with offers and promotions that we feel may be of interest.

We may use the Analytics information collected as described elsewhere in this Privacy Policy, including to:

• conduct statistical analysis of the Site, Application, and/or Services;
• troubleshoot service issues or interruptions;
• conduct research and for commercial purposes, such as to update and improve the Site, Application, and/or Services;
• understand the demographics of our users and their browsing habits; and
• serve you with promotional messages and advertisements, both while you are on the Site and after you leave our Site and continue to browse online.

We may use your email address to respond to your inquiries and to provide you information about our Site, Application, and/or Services. You may elect not to receive promotional emails from us either by "unsubscribing" to an email you receive from us or by contacting us as indicated below. If you unsubscribe from receiving emails from us, we may still send you non-promotional emails, such as emails about your Wingspan account or our ongoing business relations, unless you withdraw your consent to receive electronic communications.

Use of Sensitive Personal Information

We collect and use Sensitive Personal Information (as defined under applicable law) only as necessary to provide our Services. Specifically, we use tax identification numbers for tax compliance and reporting, benefits enrollment with carriers, and identity verification. We use financial account information (bank account and routing numbers) to process payments and payouts. We do not use Sensitive Personal Information for purposes beyond what is necessary to provide our Services and as permitted under applicable law. Individuals may have the right to limit the use and disclosure of their Sensitive Personal Information. To exercise this right, please contact us at privacy@wingspan.app.

Biometric Data

In connection with our identity verification processes, we may use third-party service providers that collect biometric data, such as facial geometry extracted from a selfie photograph for the purpose of matching it against a government-issued identification document. This biometric data is collected solely for the purpose of verifying your identity and preventing fraud. We do not sell, lease, trade, or otherwise profit from your biometric data. Biometric data collected during identity verification is retained only for as long as necessary to complete the verification process or as required by applicable law, and in no event longer than three years from the date of collection, after which it is permanently destroyed. By submitting a selfie or other facial image for identity verification, you consent to the collection, use, and storage of your biometric data as described in this section. If you do not consent, you may contact us at privacy@wingspan.app to discuss alternative verification methods. To the extent required by applicable law, we will provide you with a written release and obtain your informed written consent prior to collecting biometric data. For questions about our biometric data practices, please contact us at privacy@wingspan.app.

Cookies

Cookies are small files that are sent to and stored in your computer by the websites you visit. Cookies are stored in your browser's file directory. Cookies may be stored only for the time you are in a given site or they may remain stored in your browser for a defined period of time beyond your current session. Cookies work in combination with content within the website itself, to capture and remember information. To learn more about these technologies and how they work, please see www.allaboutcookies.org.

We use cookies and other similar technologies (such as web beacons and pixels) to collect and process non-personal information, personalize our Services for you, and to collect aggregate information about the usage of our Services.

We categorize the cookies used on our Site as follows:

• Essential Cookies. These cookies are strictly necessary for the Site and Services to function. They include session cookies for authentication and security. These cookies cannot be disabled.
• Analytics Cookies. These cookies help us understand how visitors interact with our Site by collecting information such as pages visited, time spent, and navigation patterns. We use Google Analytics and similar tools for this purpose.
• Marketing/Advertising Cookies. These cookies may constitute "sharing" of personal information under applicable privacy laws for purposes of cross-context behavioral advertising.

Cookie Consent Manager. We use a cookie consent management tool on our Site that allows you to manage your cookie preferences. When you first visit our Site, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. You may update your preferences at any time by clicking the "Cookie Settings" link in our Site footer. In certain jurisdictions, non-essential cookies are blocked by default until you provide affirmative consent. You may opt out of marketing/advertising cookies through the consent manager or through the "Do Not Sell or Share My Personal Information" link in our Site footer.

You can also choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies through your browser settings. If you turn cookies off, you may not be able to browse the Site or use the Services.

Information Sharing

We may share Personal Information to the following entities and/or for the following reasons:

Affiliates/Partners

We may share your Personal Information with our affiliates, partners, and service providers for the purpose of providing you with the Services, including payment processing, tax compliance, identity verification, benefits enrollment (including sharing enrollment data and tax identification numbers with insurance carriers), compliance screening, and customer support. We require that such partners use the Personal Information for the limited purpose for which we provide it, maintain reasonable security measures for the protection of such information, and comply with the provisions as outlined in this Privacy Policy.

Unaffiliated Third Parties

We may share your Personal Information with unaffiliated third parties: (1) if you request or authorize it; (2) if the information is provided to help complete a transaction for you; (3) if the information is provided to: (a) enforce our Terms of Use or other agreements; or protect our rights, property, or safety or the rights, property, or safety of our users or others; (4) if the information is provided to our third-party service providers to perform functions on our behalf (e.g., analyzing data, providing marketing assistance, providing customer service, processing orders, etc.); (5) for our everyday business purposes; or (6) as permitted by applicable law or otherwise described in this Privacy Policy. When you are no longer a member, we continue to share your information as described in this Privacy Policy.

Advertising and Marketing Partners

We use third-party advertising and marketing partners to facilitate advertising campaigns, measure campaign effectiveness, and deliver relevant advertisements. In connection with these activities, we may share certain Personal Information (such as hashed contact identifiers and cookie-based behavioral data) with our advertising partners. This sharing may constitute a "sale" or "sharing" of Personal Information under applicable privacy laws.

You may opt out of this sharing by: adjusting your cookie preferences through our cookie consent manager to disable marketing and advertising cookies; submitting a request via email to privacy@wingspan.app to be suppressed from advertising audience uploads; or enabling Global Privacy Control (GPC) in your browser, which we will honor as a valid opt-out signal. When we receive a valid opt-out request, we will disable advertising and marketing cookies for that visitor and suppress that individual's information from future advertising audience uploads. We will process your request within a reasonable amount of time.

Law Enforcement

Occasionally we may be required by law enforcement or judicial authorities to provide personal information. We will disclose personal information upon receipt of a court order, subpoena, warrant, or other legal process to the extent necessary to meet legal, national security, public interest, or law enforcement obligations. We fully cooperate with law enforcement agencies in identifying those who use our Site for illegal activities. We reserve the right to report to law enforcement agencies any activities that we in good faith believe to be unlawful.

Merger

In the event that Wingspan enters into an agreement to be purchased by another company or to merge with another company, we may share personal information with that company. We will require that such purchasers continue to comply with the provisions as outlined in this Privacy Policy.

Analytics

We utilize Google Analytics to capture and analyze visits and traffic to the Site. Google Analytics generates a cookie to capture information about your use of our Services, which Google uses to compile reports on website activity for us and to provide other related services. Google may use a portion of your IP address to identify its cookie, but this will not be associated with any other data held by Google. We use aggregated and anonymized analytics data for internal business purposes, including improving our Site and Services. We do not sell analytics data to third parties.

We may disclose Analytics with third parties as described elsewhere in this Privacy Policy and for our commercial purposes.

Your Choices

You may have choices when it comes to the collection, use, and sharing of your personal information. You may choose to "unsubscribe" from e-mail marketing communications, or you can contact us using the contact information below to be removed from our email marketing lists. Please be aware that you are not able to opt out of receiving communications about your Wingspan account or related transactions with us.

Accessing Your Information

You must notify us of any change in your Personal Information by updating your Wingspan account profile through our Site, Application, and/or Services. Any changes will affect only future uses of your Personal Information.

Subject to applicable law, which might, from time to time, oblige us to store your Personal Information for a certain period of time, we will respect your wishes to correct inaccurate information. Otherwise, we will hold your Personal Information for as long as we believe it will help us achieve our objectives as detailed in this Privacy Policy.

You can ask us whether we are storing your Personal Information and you can ask to receive a copy of that Personal Information. Before sending you any Personal Information, we will ask you to provide proof of your identity. If you are not able to provide proof of your identity, we reserve the right to refuse to send you any Personal Information. We will respond as quickly as we can to your requests for details of Personal Information we hold about you.

Data Retention

We retain Personal Information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting requirements. Specific retention periods include:

• Personal Information: Retained as long as necessary to fulfill the purpose for which it was collected and to comply with legal obligations.
• Transaction records: Retained for up to 10 years per financial regulatory requirements.
• Tax documents: Retained for a minimum of 4 years per applicable tax authority requirements.
• Insurance enrollment data: Retained for the duration of coverage and as required by applicable regulations.
• Marketing and analytics data: Cookie data is retained according to the cookie expiration periods disclosed in our cookie consent manager. Email marketing preferences are retained until you unsubscribe.
• Audit logs: Retained per compliance framework requirements, typically 1–3 years.

When Personal Information is no longer required for its original purpose and no legal retention obligation or legal hold applies, we securely delete or anonymize it.

Log-In Through Social Networks

You may have the option of signing up for the Service through Facebook, Google, or other social networks. Logging in through these social networks may allow Wingspan to access certain public information related to your profile. When you sign in through one of these social networks, you may be asked what information you would like to share. It is up to you what to share with Wingspan, or whether any personal information from your social network profile is shared with us.

Links to Third Party Sites

Wingspan may provide you with links to third party websites through the Site or Application. We may also allow third-party websites or applications to link to our Site, Application, and/or Services. Wingspan is not responsible for the collection, use, or sharing of your personal information once you leave our Site or Application and follow a link to a third party website. Please consult each linked website's privacy policy for a description of how the website collects, uses, and shares your information.

Do Not Track and Global Privacy Control

We honor GPC signals as a valid opt-out of the sale or sharing of Personal Information under applicable privacy laws.

Age Restriction

Our Site, Application, and Services are intended solely for individuals who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have collected personal information from a person under 18, we will take steps to delete such information promptly. If you believe that we have inadvertently collected personal information from a person under 18, please contact us at privacy@wingspan.app.

Cross-Border Transfer of Data

We are located in the United States. If you are not a resident of the United States, your country's laws governing data collection and use may differ from those in the United States; in particular, the United States may not provide the same level of protections as those in your own country. For transfers of personal data from outside the United States, we rely on appropriate lawful transfer mechanisms as applicable, including standard contractual clauses or other safeguards required by local law. By using the Site or providing your personal information to Wingspan, you acknowledge the transfer, retention, and processing of such data in the United States. If you do not agree with such transfer, retention, and processing in the United States, please do not use the Site.

California Residents' Privacy Rights

If you are a California resident, applicable state privacy law provides you with the following rights regarding your Personal Information:

1. Right to Know. You have the right to request that we disclose the categories and specific pieces of Personal Information we have collected about you, the categories of sources from which we collected it, the business or commercial purpose for collecting or selling it, and the categories of third parties with whom we share it.
2. Right to Delete. You have the right to request that we delete your Personal Information, subject to certain exceptions.
3. Right to Correct. You have the right to request that we correct inaccurate Personal Information that we maintain about you.
4. Right to Opt Out of Sale or Sharing. You have the right to opt out of the sale or sharing of your Personal Information for cross-context behavioral advertising. See the "Advertising and Marketing Partners" section above for opt-out mechanisms.
5. Right to Limit Use of Sensitive Personal Information. You have the right to limit our use and disclosure of your Sensitive Personal Information to what is necessary to provide the Services.
6. Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To submit a request, please email privacy@wingspan.app or contact us at the address listed below. We will verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf. If you use an authorized agent, we may require proof of authorization and still verify your identity directly. We will respond to verifiable consumer requests within 45 days. For deletion requests, we will complete the deletion within 30 days of verifying your identity. Please note that some data may be retained where required by regulatory recordkeeping obligations (e.g., tax records, transaction history). You may also have the right to data portability. We maintain a clear audit trail for all deletion requests.

Other US State Privacy Rights

Residents of other U.S. states with comprehensive privacy laws may have similar rights to California residents.

European Economic Area, United Kingdom, and Swiss Residents

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under applicable data protection laws:

1. Right of Access. You have the right to request a copy of the personal data we hold about you.
2. Right to Rectification. You have the right to request correction of inaccurate personal data.
3. Right to Erasure. You have the right to request deletion of your personal data, subject to legal retention obligations.
4. Right to Restriction of Processing. You have the right to request restriction of processing in certain circumstances.
5. Right to Data Portability. You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
6. Right to Object. You have the right to object to the processing of your personal data, including for direct marketing purposes.
7. Right to Withdraw Consent. Where processing is based on consent, you have the right to withdraw that consent at any time.
8. Right to Lodge a Complaint. You have the right to lodge a complaint with your local data protection supervisory authority.

The legal bases for our processing of personal data include: performance of a contract (to provide our Services), compliance with legal obligations (tax and regulatory requirements), legitimate interests (fraud prevention, security, and service improvement), and consent (for marketing communications and non-essential cookies). To exercise your rights, please contact us at privacy@wingspan.app.

Our Data Protection Officer can be reached at privacy@wingspan.app. If you are located in the European Economic Area or the United Kingdom and believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with your local supervisory authority.

Brazilian Residents

If you are located in Brazil, applicable data protection law provides you with rights including the right to confirmation of processing, access to your data, correction of incomplete or inaccurate data, anonymization, blocking or deletion of unnecessary or excessive data, data portability, deletion of data processed with your consent, information about public and private entities with which your data has been shared, information about the possibility of denying consent and the consequences thereof, and revocation of consent. To exercise your rights, please contact us at privacy@wingspan.app.

Canadian Residents

If you are located in Canada, applicable federal and provincial privacy laws provide you with the right to access and correct your personal information, to withdraw consent for the collection, use, or disclosure of your personal information, and to file a complaint with the relevant privacy commissioner. We collect and use your personal information only with your knowledge and consent, except where permitted or required by law. To exercise your rights, please contact us at privacy@wingspan.app.

Argentine Residents

If you are located in Argentina, applicable data protection law provides you with the right to access your personal data held by us, to request correction of inaccurate data, to request deletion of data that is no longer necessary for the purpose for which it was collected, and to object to data processing. We process your personal data only with your informed consent except where otherwise permitted by law. To exercise your rights, please contact us at privacy@wingspan.app.

Indian Residents

If you are located in India, applicable data protection law provides you with rights as a data principal, including the right to access a summary of your personal data being processed, the right to correction and erasure of your personal data, the right to nominate another individual to exercise your rights, and the right to grievance redressal. We process your digital personal data only with your consent or for lawful purposes as prescribed by applicable law. For processing the personal data of children, we obtain verifiable consent from a parent or lawful guardian. To exercise your rights, please contact us at privacy@wingspan.app.

Australian Residents

If you are located in Australia, applicable privacy law provides you with rights including the right to access your personal information, the right to request correction of inaccurate information, and the right to make a complaint about our handling of your personal information. We are committed to handling your personal information in accordance with applicable privacy principles. To exercise your rights, please contact us at privacy@wingspan.app.

Mexican Residents

If you are located in Mexico, applicable data protection law provides you with ARCO rights: the right to access your personal data, the right to rectification of inaccurate data, the right to cancellation (deletion) of your data, and the right to object to the processing of your data. We are required to disclose our data practices and to obtain your consent for the processing of your personal data. To exercise your rights, please contact us at privacy@wingspan.app.

Singapore Residents

If you are located in Singapore, applicable data protection law provides you with rights including the right to access your personal data, the right to request correction of inaccurate data, the right to withdraw consent for the collection, use, or disclosure of your personal data, and the right to request information about how your data has been used or disclosed in the past year. We collect, use, and disclose your personal data only with your consent or as otherwise permitted by law. To exercise your rights, please contact us at privacy@wingspan.app.

South Korean Residents

If you are located in South Korea, applicable data protection law provides you with rights including the right to access your personal information, the right to request correction or deletion of inaccurate information, the right to request suspension of processing, and the right to withdraw consent. We process your personal information only with your consent or as otherwise permitted by law, and we implement appropriate technical and organizational safeguards. To exercise your rights, please contact us at privacy@wingspan.app.

Colombian Residents

If you are located in Colombia, applicable data protection law provides you with rights including the right to access your personal data, the right to update and rectify your data, the right to request deletion of your data when it is no longer necessary, and the right to revoke your consent. We collect and process your personal data only with your prior, express, and informed authorization except where otherwise permitted by law. To exercise your rights, please contact us at privacy@wingspan.app.

Japanese Residents

If you are located in Japan, applicable data protection law provides you with rights including the right to request disclosure of your personal information, the right to request correction, addition, or deletion of inaccurate information, the right to request cessation of use or provision to third parties, and the right to request disclosure of records of third-party provision. We handle your personal information in accordance with applicable law and obtain your consent where required. To exercise your rights, please contact us at privacy@wingspan.app.

Residents of Other Jurisdictions

If you are located in a jurisdiction not specifically addressed above that has applicable data protection or privacy legislation, you may have similar rights regarding your personal data, including rights of access, correction, deletion, and objection to processing. We are committed to respecting your privacy rights under the laws that apply to you. To exercise any rights you may have under your local data protection laws, or if you have questions about how we handle your personal information, please contact us at privacy@wingspan.app. We will process your request in accordance with the requirements of your jurisdiction's applicable law.

Security

When your bank account information and tax identification numbers are transmitted via our Services, they will be protected by encryption technology, such as Secure Sockets Layer (SSL).

You are responsible for the security of your log-on information. Please do not share your username or password with anyone. If you believe your log-on password has been compromised, please contact us immediately.

If we receive instructions using your Wingspan account login information, we will consider that you have authorized the instructions. We reserve the right, in our sole discretion, to refuse to provide our Services, terminate Wingspan accounts, and to remove or edit content.

Changes to this Privacy Policy

We reserve the right to make changes to this Privacy Policy at any time and in our sole discretion. We will post changes directly to this Privacy Policy and update the date at the top of this Privacy Policy, so it is your responsibility to check back here from time to time to review. If we make a material change in the type of information we collect or its use, we will provide advance notice of such change, and obtain your consent for the new collection or use, if and as required by applicable law. The revised Privacy Policy will be effective upon posting, unless otherwise set forth therein or as otherwise required by applicable law. You are free to decide whether or not to accept a revised version of this Privacy Policy, but accepting this Privacy Policy, as revised, is required for you to continue accessing or using our Site, Application, and/or Services. If you do not agree to the terms of this Privacy Policy or any revised version of this Privacy Policy, your sole recourse is to terminate your access and use of our Services. Except as otherwise expressly stated by us, your access and use of our Services is subject to the version of this Privacy Policy in effect at the time of access or use.

Accessibility

We are committed to ensuring that this Privacy Policy is accessible to all individuals, including those with disabilities. If you use assistive technology and the format of this Privacy Policy interferes with your ability to access the information contained herein, please contact us at privacy@wingspan.app and we will provide the information in an alternative format.

Contact Information

If you have any questions or concerns about this Privacy Policy, please contact us using the information below:

Wingspan Networks, Inc.

6-8 W 18th St, 3rd Floor

New York, NY 10011, USA

privacy@wingspan.app