This policy explains which personal data Wingo UI processes, why, for how long and what rights you have. We collect as little as we can: analytics and advertising cookies only load if you allow them in the cookie banner.
1. Controller
The controller under the EU General Data Protection Regulation (GDPR) is:
- Company
- FREEVOX S.R.L.
- Address
- Str. Crăițelor nr. 2B, camera 2, 075100 Otopeni, jud. Ilfov, Romania
- support@wingo-ui.com
For any privacy question or request, write to support@wingo-ui.com.
2. What we process and why
Browsing the website. Our servers process your IP address, browser type, the page requested and the time, to deliver the site and protect it against abuse (legitimate interest, Art. 6(1)(f) GDPR). Server logs are deleted after 30 days.
Your account. Email address, optional name, language, email preferences and the date you signed up. We need them to provide your account (contract, Art. 6(1)(b) GDPR).
Signing in and security. One-time sign-in codes and links (valid for minutes), passkey public keys (we never receive your private key or biometrics), the two-factor secret and hashed backup codes if you turn on two-factor authentication, and active sessions with IP address and device type so you can review and end them. We keep a security log of important account events, such as a new passkey or API key (contract and legitimate interest in security).
API keys and usage. API keys are stored only as a hash. When the CLI or MCP server fetches a component, we record which component, version and channel were used, linked to your account, to enforce the license and rate limits and to understand which components matter (legitimate interest). We do not receive the contents of your projects.
Purchases. Plan, prices, payments, invoices, billing name, email, address and tax ID. Card and payment details are handled by Stripe and never reach us. We use the billing details to issue your invoice ourselves and email it to you. We need this data for the contract and must keep invoices for the period required by tax law (Art. 6(1)(b) and (c) GDPR).
Payment notifications. When a checkout starts, a payment succeeds, fails, needs confirmation or is refunded, or a subscription is canceled, we send ourselves a push notification with plan, amount, a shortened email address, approximate location and traffic source (legitimate interest in running the shop).
Emails. We send sign-in codes, receipts and important account messages (contract). Release notes are sent only if you keep product updates switched on, and you can turn them off in one click. Tips to get started, product news and offers are explained in section 3. We log which emails were sent and whether they were delivered.
Support and the contact form. When you write to us through the contact form, your account or by email, we process your name, email address, the topic, your message, files you attach (images and PDFs), the conversation that follows and, if you rate our answer, your rating. If you are signed in, the ticket is linked to your account. Our support team sees the account, plan and payments of the account that uses the address you wrote from, even when you were not signed in, so it can answer questions about them. We use this data to answer you, keep the conversation and improve our support (contract or steps before a contract, Art. 6(1)(b) GDPR; otherwise our legitimate interest in answering requests, Art. 6(1)(f) GDPR). To keep the form free of spam and abuse we process your IP address and browser type (kept for 30 days) and check with our email provider that your address can receive mail (our legitimate interest in protecting the form, Art. 6(1)(f) GDPR). When a message arrives we send ourselves a push notification, and an email when the push does not arrive, with the subject and the beginning of the message (legitimate interest in replying quickly). If our own statistics recorded the visit from which you wrote, our support team sees that visit next to your ticket (pages viewed, how you found us, approximate location and device) to understand your question; this does not happen after you object to our statistics. Private links to a ticket work for 180 days and can be revoked. If you wrote without an account, write to us from the address you used to get a copy of your tickets or to have them deleted.
Our own statistics (no cookies). On every page our servers and a small script of our own record which pages are viewed, how long and how far they are read, clicks and other interactions on the page (which button or link, where on the page, sampled mouse positions on computers, copied commands and code, searches on the site, form steps without what you type, errors and loading speed), the referring website and campaign, the browser and device type, the size of the browser window and the light or dark theme. Your language comes from the language setting your browser sends, the time zone and the approximate location (country, region, city, network provider) from the IP address, using our own geolocation service Wingo IP. We do not set a cookie or store anything on your device for this; visits on the same day are grouped with a key computed from IP address, browser and language with a secret that changes every day and is deleted after one day. If you are signed in, your browser sends our sign-in cookie with every request anyway, and we use it to link the visit to your account; this does not happen after you object (see below). Visits from IP networks from which the people who run this website signed in as administrators, and from devices with a cookie (wui.internal) set for them, are left out of these statistics. Purpose: understanding and improving the website, measuring which channels bring customers, detecting bots and abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Data is never sold or shared for advertising. You can object at any time: "Reject all" (or turning off "Analytics") in Cookie settings, or a Global Privacy Control signal from your browser, limits our statistics to counting page views, how long they stay open and page errors, without linking them to your account.
With your consent ("Analytics" in cookie settings) we additionally set the first-party cookie wui.vid (13 months, not renewed on later visits) to recognize your browser across days, read further device details (screen size and pixel density, time zone and languages set in the browser, touch support, reduced-motion and color-scheme settings, processor cores, memory and connection type) and may record a replay of your visit (page structure, mouse movements, clicks and scrolling; everything you type and names and email addresses shown on the page are masked; account, sign-in and checkout pages are never recorded). Legal basis: consent (Art. 6(1)(a) GDPR, § 25 TDDDG); withdrawing removes the cookie and stops recording. A Global Privacy Control signal from your browser is treated as no consent and as an objection.
Google Analytics and the Meta pixel (only with your consent). If you allow analytics, Google Analytics records which pages you visit, how you found us, your approximate location and device, and events such as signing up or buying. If you allow marketing, the Meta pixel records page visits and the same events, so we can see which of our ads work. When you buy with marketing allowed, our server also reports that purchase to Meta (plan, amount, and a hashed email address and account ID, which Meta can only match, not read). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25 TDDDG), which you can withdraw at any time under "Cookie settings" at the bottom of every page.
3. Email marketing, tips and offers
Besides the account and purchase emails above, we send tips to get started, product news and offers, and we show short messages in your account. This is how we choose them:
- What we use. Your activity in your account: installs and their channel (CLI, MCP server, shadcn, website), your API keys and your MCP and CLI usage, the pages you view while signed in and the Pro components you tried to install; checkout starts, abandoned checkouts and the reasons you give when you cancel; your support tickets and ratings; your country, time zone and device; the domain of your email address; and clicks in our emails. We measure clicks through our own redirect on wingo-ui.com. We do not track whether you open our emails.
- Profiling. From these inputs we compute a lead score, a lifecycle stage and, for customers, a health score, and use them to choose which emails and offers you get and when (our legitimate interest in direct marketing, Art. 6(1)(f) GDPR). You have the right to object to this profiling at any time (Art. 21 GDPR), and unsubscribing from offers ends it: from then on we no longer use your activity for offers.
- Owner notifications. When your score or a checkout suggests you are interested in Pro, the owner of Wingo UI, Serban, gets a notification and may write to you personally.
- Personal discount codes. Some offers are personal Stripe discount codes based on this processing and valid only for your account. The email and the pricing page mark them as offered to you personally.
- Messages on the site. In your account and on the pricing, component and template pages we may show one short message at a time, such as "Install your first component" or "Your Pro checkout is waiting". They need no email consent and you can dismiss them.
- Legal bases. News and offers: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Tips to get started for new accounts: your consent, or outside the EEA, Switzerland and the UK our legitimate interest in helping you use your account (Art. 6(1)(f) GDPR). Customers: occasional emails about similar Wingo UI products under the existing-customer rule (§ 7(3) UWG, art. 12(2) Law 506/2004), with the right to object at any time, free of charge. Reminders about a failed payment of your subscription are part of the contract (Art. 6(1)(b) GDPR).
- Proof and retention. We keep a record of each consent (the text you saw, when and how you gave it) for 3 years after you withdraw it or after the last email based on it. Sent emails and their delivery events are kept for 24 months, click logs for 13 months. After you unsubscribe or delete your account we keep only a keyed hash of your address, so that you are never emailed again; PowerMail, which delivers our emails, keeps its own record of the unsubscribe for the same purpose.
- AI drafting. Anthropic (USA) helps us draft emails as our processor, under a data processing agreement and standard contractual clauses or the EU-U.S. Data Privacy Framework. For a personal note it receives the reasons for one contact with the name, the address and the email domain removed. These texts are kept for 90 days.
- Owner notes. Notes the owner writes about you are given to you on request, except where Art. 15(4) GDPR applies.
- How to object or unsubscribe. Use the link in every email, the Unsubscribe button your email app shows (it stops that kind of email only), the email preferences page or your account settings. It is free and takes one click; emails about your account and purchases continue.
5. Service providers
We use a few carefully chosen providers that process data on our behalf under data processing agreements:
- Stripe
- Payment processing (Stripe does not issue our invoices). Stripe Payments Europe, Ltd., Dublin, Ireland. Stripe may transfer data to the United States under the EU-U.S. Data Privacy Framework and standard contractual clauses. See stripe.com/privacy.
- SmartBill
- Invoicing. We write your invoice in the SmartBill invoicing service (Romania, EU) from your billing name, address, tax ID and email.
- PowerMail
- Delivery of our emails (sign-in codes, receipts, account messages, support emails) and checking whether an address can receive mail; it also delivers our tips, news and offers (section 3) and keeps the record of who unsubscribed from which kind of email. Operated by FREEVOX S.R.L. itself; emails are delivered through Amazon Web Services EMEA SARL (Amazon SES), 38 Avenue John F. Kennedy, L-1855 Luxembourg
- Google Analytics, only with your consent. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to the United States under the EU-U.S. Data Privacy Framework. See policies.google.com/privacy.
- Meta
- Meta pixel and Conversions API, only with your consent. Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, jointly responsible with us for collecting and transmitting the data (Art. 26 GDPR). Data may be transferred to the United States under the EU-U.S. Data Privacy Framework. See facebook.com/privacy/policy.
- Anthropic
- Drafting our emails with the Claude AI models (section 3). Anthropic, PBC, San Francisco, USA, under a data processing agreement and standard contractual clauses or the EU-U.S. Data Privacy Framework. It receives our briefs and aggregate numbers and, for a personal note, the reasons for one contact without the name, the address or the email domain. See anthropic.com/legal/privacy.
- Wingo IP
- IP geolocation, operated by FREEVOX S.R.L. on our servers. For addresses it has not seen in the last 30 days it asks apiip.net, ipgeolocation.io or ip-api.com, sending only the IP address.
- Wingo Notifications
- Push notifications about payments and support messages, and about interested contacts (section 3), to our own devices, operated by FREEVOX S.R.L., delivered through Google Firebase Cloud Messaging.
- AI analysis
- AI analysis services chosen by us. We may give them pseudonymous statistics, without IP addresses, emails or account IDs, to find improvements to the website.
- Hosting
- Servers for the website, the API and the database. Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany (servers in Finland)
We do not sell personal data and do not share it with anyone else unless the law requires us to.
6. How long we keep data
- Account data: while your account exists. When you delete your account, we delete or anonymize it within 30 days.
- Invoices and payment records: for the period required by tax and accounting law, typically up to 10 years.
- Sessions: until they expire or you sign out. Security log: 24 months. Email delivery log: 12 months. Server logs: 30 days.
- Our own statistics: 13 months. Full IP addresses: 30 days (plus up to 14 days in our database backups), after which only a shortened prefix and a monthly key that can no longer be reversed remain. For visits from those networks we keep which network they came from for as long as the statistics (13 months), so that we can count them again if we remove a network. Mouse samples and replays: 30 days. Links between payments and visits: 3 years. The daily key: one day.
- How you first found us (the source, campaign and landing page of your sign-up visit, with country and device): as long as your account exists.
- Analytics and marketing: Google Analytics keeps event data for at most 14 months; Meta keeps it according to its own policy.
- Component usage records: 24 months, then only in aggregated form.
- Email marketing: consent records 3 years after you withdraw the consent or after the last email based on it; sent emails and their events 24 months; click logs 13 months; a keyed hash of an unsubscribed or deleted address for as long as we send email; AI drafts for a personal note 90 days.
- Support tickets: deleted 24 months after the ticket was closed or last changed; messages we flag as spam after 30 days; the IP address and browser type of the form after 30 days; files you started to upload but never sent after 2 hours; each plus up to 14 days in our database backups. Deleting your account deletes your tickets. Our internal notes about a ticket are not in the self-service export; ask us and we send them.
7. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability and to withdraw consent at any time with effect for the future. In your account settings you can export your data and delete your account yourself.
You can object to direct marketing and to the profiling for it at any time, free of charge, as described in section 3. You can object to our own statistics at any time as described under "What we process and why". We cannot match anonymous statistics to a person, so we cannot answer access or deletion requests for them; statistics linked to your account are part of the export and are anonymized when you delete your account.
You can also lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or where we have our registered office.
8. Security
All connections are encrypted with TLS. Sign-in is passwordless, API keys and backup codes are stored as hashes, and access to production systems is limited and protected with multi-factor authentication.
9. Children
Wingo UI is a tool for developers and is not directed at children under 16. We do not knowingly process their data.
10. Changes
We update this policy when our processing changes. The date at the top shows the latest version. We tell you about material changes by email.
Questions about this page? Write to support@wingo-ui.com.