What this page is
A subprocessor is a third-party service that processes personal information on Wingmint's behalf as part of delivering the product. If Wingmint moves your data to a vendor, that vendor is listed below.
We treat this as a living disclosure, not a compliance artifact. When the list changes, we update this page and post a note in the admin dashboard of every club. See How we announce changes.
This page supplements the Privacy Policy. Terms defined there (member, club, personal information, sensitive personal information) carry the same meaning here.
Wingmint is operated by Fifth Nine, LLC, an Illinois limited liability company with a mailing address at 2093 Philadelphia Pike #7272, Claymont, DE 19703.
Core subprocessors
These vendors run on every Wingmint installation. Your club cannot opt out of them without leaving the product — they are part of the infrastructure.
- Purpose
- Application hosting, edge network, file storage for member-uploaded documents, and privacy-friendly Vercel Analytics (cookieless page-view counts)
- Data
- All web traffic, server logs, IP addresses, uploaded documents (pilot certificates, medical certificates, driver's license, passport scans, insurance), aggregate page-view counts
- DPA
- vercel.com/legal/dpa
- Purpose
- Primary Postgres database — stores all structured application data
- Data
- Member profiles, reservations, flight logs, Hobbs/tach entries, squawks, statements, FTSP records (citizenship status, passport numbers for non-citizens), club settings
- DPA
- neon.tech/dpa
- Purpose
- Payment processing (ACH and card), recurring billing for club dues, ACH account verification
- Data
- Member name, email, billing address, payment method (last 4 of bank account or card), transaction history, ACH routing/account details (held by Stripe, not Wingmint)
- DPA
- stripe.com/legal/dpa
- Purpose
- Transactional email delivery — invoices, statements, booking confirmations, onboarding notices
- Data
- Recipient email address, sender (always hello@wingmint.com or a club alias), email subject and body contents, delivery timestamps
- DPA
- resend.com/legal/dpa
- Purpose
- Address autocomplete during member onboarding and club setup. Runs client-side in the browser; Wingmint never forwards the query.
- Data
- Partial address text typed into the address field, requester IP address (from the member's browser directly to Google)
- DPA
- privacy.google.com/businesses/processorterms/
Optional integrations
These vendors only receive data if your club explicitly enables the integration. If your club doesn't use the feature, no data leaves Wingmint for that vendor.
- Purpose
- SmartBox key exchange — only activated for clubs that install Keycafe hardware at their hangar. Clubs without SmartBoxes never send data here.
- Data
- Member name, member email or phone, key pickup/return timestamps, Keycafe access codes (one-time, expiring)
- DPA
- www.keycafe.com/en/privacy-policy
Infrastructure notes
Authentication
Authentication runs on Better Auth, an open-source library Wingmint operates itself. Session tokens, password hashes (Argon2id), and MFA secrets are stored in our own Neon database — Better Auth is not a hosted third party.
Domain and DNS
Domain registration and DNS resolution for wingmint.com run through Cloudflare Registrar and Cloudflare DNS. DNS providers see domain lookup traffic only; no personal data passes through them.
What is not on this list
Wingmint does not use third-party product analytics (no PostHog, no Mixpanel, no Amplitude), ad networks, session recorders (no Hotjar, no FullStory, no LogRocket), marketing pixels (no Google Analytics, no Meta Pixel), AI training services, or customer-support chat widgets that ingest your data (no Intercom, no Drift). We do use Vercel Analytics, which is cookieless and aggregate-only — it's listed with Vercel above because it runs on the same subprocessor. If any of this changes, this page changes first.
How we announce changes
When we add a new subprocessor or materially change an existing one, we:
- Update this page and bump the Last updated date.
- Post a notice in the admin dashboard of every Wingmint club at least 30 days before the new vendor starts processing data.
- Email the primary admin on file for every club, so nobody has to check this page to catch a change.
The 30-day notice does not apply to emergency substitutions — for example, if a vendor goes offline and we need to fail over to a backup to keep the product running. In that case we notify after the fact, as soon as reasonably possible.
How to object
If your club has a contractual or legal objection to a new subprocessor, email privacy@wingmint.com before the 30-day notice period ends. We'll either answer your concerns, adjust the rollout, or let you terminate without penalty and export your data.
Individual members who object to a subprocessor should raise it with their club admin first — your club is the customer, and they control the contract. If you think Wingmint itself is mishandling data, contact us directly and we'll route your concern regardless of whether your club has signed off on it.