Atticwell for Webflow: Privacy Policy
Last updated: October 1, 2026
Atticwell is a Webflow app made by Great Work LLC, 651 N Broad St Suite 206, Middletown, DE 19709, USA (hello@greatwork.company). This policy covers what Atticwell collects, why, where it goes, how long we keep it and how to delete it.
What Atticwell stores
| What | Why | Kept for |
|---|---|---|
| Your site's Webflow access token, encrypted (AES-256-GCM) | To read assets, pages, components and CMS items, and to make the changes you approve | Until you remove Atticwell, uninstall it or revoke access; then deleted |
| Site id, workspace id, site name and published domains | To apply your plan and read your published pages | As long as Atticwell is connected |
| Settings: image limits and format, alt text template, weekly report on/off and the email it goes to | So the app works the way you set it | Until you remove Atticwell |
| Scans: per asset its id, file name, folder, type, size in bytes, pixel size, link, alt text, where it's used (up to 25 places: page, component, CMS item name, class name or published path) and the findings | The tabs, the manifest and the weekly report | The last 3 scans per site |
| Class names whose background images use an asset, read in the Designer | Where-used for styles | Until the next reading, or you remove Atticwell |
| Delete runs (dry and real): when, who, which assets, how many bytes, what was refused and why | The Cleanup tab and the change log | 1 year |
| Change log: who did what and when (rename, alt text, delete, restore, folder, move, resize), with the value before and after | Undo and your record | 1 year |
| Deleted files: a copy of each asset Atticwell deletes, as it was on Webflow's CDN, stored on our server's disk (only our app's account can read it) | So you can restore it | 14 days, or until restored, then deleted. At most 1 GB per site |
| Weekly reports: totals, the change since the last report, asset ids and file names | The Reports tab and the report email | The last 26 per site |
| Server request logs: time, method, path, status, duration | Security and troubleshooting | 30 days. Not logged: query strings, tokens, request bodies |
What we don't store. Atticwell keeps no copy of your files other than the ones it deletes for you (above), and no page, component or CMS content: it reads that content during a scan to find which assets it names and keeps only the result. Atticwell adds no code, banner or cookies to your published site, and calls no AI service.
Personal data, in short. Your Webflow user email (from Webflow's sign-in, for receipts and the change log), the report email you choose, and anything personal that happens to be in your file names, alt text, CMS item names or class names (stored as part of the scan as described). We don't sell personal data, don't use it for advertising, don't use it to train AI models and don't send it to any AI service. For personal data inside your site's content, you are the controller and Great Work is your processor (Terms, section 6).
Third parties and every domain Atticwell talks to
| Domain | Who | What |
|---|---|---|
| api.webflow.com, webflow.com | Webflow, Inc. | Your assets, pages, components and CMS items through the Data API, the changes you approve, and the sign-in (OAuth) screen |
| cdn.prod.website-files.com (and Webflow's older asset hosts) | Webflow, Inc. | Your assets' files: the first 64 KB of an image to read its pixel size, whole files to compare duplicates and to keep a copy before a delete, and thumbnails in the app |
| webflow-prod-assets.s3.amazonaws.com | Webflow, Inc. (Amazon S3) | Only when you restore a deleted file: the upload Webflow asks for |
| Your site's own published domains | You | Your published pages and style sheets, read during a scan (AtticwellBot) |
| addons.greatwork.company | Great Work LLC (our server, hosted at DigitalOcean, New York) | Atticwell's backend and our licensing service (your site id, workspace id and verified email, to run your trial and plan) |
| checkout.stripe.com, billing.stripe.com | Stripe, Inc. | Payment and billing, only when you click a plan or Manage billing. Stripe holds your card details; we never see them |
| api.resend.com | Resend, Inc. | Only once email is switched on for Atticwell: the weekly report to the address you set (counts, sizes and file names) |
| greatwork.company | Great Work LLC | Product page, documentation and this policy |
Our server runs on DigitalOcean (United States). Data is encrypted in transit (TLS) everywhere and the token is encrypted at rest.
Retention and deletion
- Remove Atticwell (Settings) revokes the Webflow token and deletes everything Atticwell stored for your site at once: settings, scans, runs, the change log, reports and the deleted files kept for restore (those can't be restored after this).
- Uninstall or revoke access in Webflow: we delete the token and your site's data the next time Webflow tells us the access is gone (on our next request or job, and at the latest by the next daily check).
- Retention runs daily: kept files after 14 days, runs and the change log after 1 year; scans beyond the last 3 and reports beyond the last 26 are dropped as new ones arrive.
- If your trial or plan ends, changes pause and nothing is deleted for 30 days. After 30 days without a plan, everything for the site is deleted.
Your rights
Depending on where you live (for example the EU, UK or California), you can ask to access, correct, delete or export your personal data, and object to or restrict its use. Email hello@greatwork.company; we answer within 30 days. For data we process for a site owner, we pass your request to them. Our legal basis for your account data is the contract with you and our legitimate interest in keeping the service secure.
Children
Atticwell is a business tool and isn't meant for children under 16.
Changes
We'll post changes here and update the date above. If a change matters, we'll say so in the app.
Contact
Great Work LLC, 651 N Broad St Suite 206, Middletown, DE 19709, USA. hello@greatwork.company