Batonwell for Webflow: Privacy Policy
Effective date: October 1, 2026 Publisher: Great Work LLC, 651 N Broad St Suite 206, Middletown, DE 19709, USA Contact: hello@greatwork.company
This policy covers the Batonwell app for Webflow (the "App"): the panel that runs in the Webflow Designer and the Great Work server it talks to. It doesn't cover Webflow's own products, which have their own policy.
1. Summary
- When someone submits a form on your site, Webflow sends the submission to Batonwell, which sends it on to the destinations you chose (Slack, Google Chat, Google Sheets, your webhook).
- Batonwell keeps each submission encrypted, only for your retention window (7 days by default; you can choose 1 to 14 days, or up to 30 on Pro) so failed deliveries can be retried and you can send one again. Then the contents are deleted for good.
- Webflow remains where your submissions live. Batonwell never edits or deletes them in Webflow.
- We don't sell or share personal information, show ads, use analytics trackers, or use any data to train AI.
- As the site owner you decide what your forms collect and where Batonwell sends it; for the people who submit your forms, you are the controller and we process their data for you.
2. What we process, and why
| Data | Why | Where it lives and for how long |
|---|---|---|
| Webflow OAuth access token for the site(s) you approve, its scopes, site and workspace ids, timestamps | To list your forms, manage our one form-submission webhook, and confirm your identity in the Designer | Our server, encrypted with AES-256-GCM. Deleted when you remove Batonwell from the site, when Webflow tells us it's revoked (for example after you uninstall), or by our daily check, so within 24 hours of an uninstall |
| Webflow user id and email, and the site id, from Webflow's identity check when you open the App | To confirm who you are and which site you're on; the email is the billing contact for receipts | Held in memory for the 15-minute session. Site id, workspace id and email are passed to our billing service (below) |
| Form names and field names of your site | To build routes | Read from Webflow when you open the App, kept in memory for 5 minutes |
| Destinations: names, Slack and Google Chat webhook links, webhook URLs and their signing secrets | To deliver submissions | Our server, links and secrets encrypted. Until you delete the destination or remove Batonwell |
| Routes and settings (conditions, spam rules, retention days) | To route and filter submissions | Our server, until you change them or remove Batonwell |
| Form submissions: everything the visitor entered in the form, the form name, the time | To route, deliver, retry, and let you send again or review spam | Our server, encrypted per submission with AES-256-GCM. Deleted at the end of your retention window (default 7 days), when you press Delete now, or when you remove Batonwell |
| Delivery log: submission time, form name, status, destination name, attempt count, the destination's error message (with links and keys removed) | So you can see what happened | Our server, 30 days. Contains no field values |
| Spam check data: a fingerprint (hash) of each submission's content | To spot repeats | Kept with the log row, 30 days |
| Google refresh token, if you connect Google Sheets | To create your spreadsheet and append rows | Our server, encrypted. Deleted and revoked with Google when you press Disconnect Google, remove Batonwell, or uninstall |
| License record: site id, workspace id, billing email, plan, trial dates, submission counts, Stripe customer and subscription ids | To run the trial, plans and monthly limits | Our billing service at addons.greatwork.company, for as long as you have a trial or plan, then as long as tax and accounting law requires |
| Server request logs: time, method, path (without query strings), status and duration. IP addresses are used in memory for rate limiting and not logged | Security and reliability | Our server, 30 days. Never includes tokens, codes or submission contents |
3. Where submissions go
Batonwell sends a submission only to the destinations your routes pick, and only the fields you chose for each:
- hooks.slack.com (Slack Technologies) for Slack destinations.
- chat.googleapis.com (Google) for Google Chat destinations.
- sheets.googleapis.com (Google) for Google Sheets: Batonwell signs in with the Google account you connect
through accounts.google.com and oauth2.googleapis.com, asking only for the
drive.filepermission, so it can open only the spreadsheets it creates. It can't see other files in your Drive. - Webhook URLs you enter (for example your automation tool or your own server). Each request is signed so the receiver can check it came from Batonwell.
Those services handle the data under their own terms and policies, as chosen by you.
4. Third parties and domains
The App talks only to these:
- webflow.com / api.webflow.com (Webflow, Inc.): the Designer API, Data API, webhooks and the OAuth screens.
- addons.greatwork.company (Great Work LLC): our backend and billing service, hosted on a DigitalOcean server in the United States (DigitalOcean, LLC is our infrastructure provider).
- hooks.slack.com, chat.googleapis.com, accounts.google.com, oauth2.googleapis.com, sheets.googleapis.com and your own webhook hosts: only as destinations you set up (section 3).
- checkout.stripe.com and billing.stripe.com (Stripe, Inc.): only if you click to buy or manage a plan. Stripe processes payment details under its own privacy policy; we never see card numbers.
- greatwork.company: our docs, privacy and terms pages, opened only when you click them.
- docs.google.com: opens your spreadsheet, only when you click the link.
- Resend (Resend, Inc.): sends receipts and billing emails from Great Work. This version of the App sends no email to you or your visitors about submissions.
5. Sharing
We don't sell, rent or share personal information. We disclose it only to the providers above, to the destinations you configure, to do what this policy describes, or if the law requires it.
6. AI and model training
The App uses no AI services. Nothing it processes is used to train any model.
7. Security
Tokens, destination secrets and stored submissions are encrypted at rest and never sent to a browser except to you in the App. The backend runs as its own unprivileged user behind HTTPS (TLS), accepts Webflow webhooks only with a valid signature, uses strict CORS and short-lived sessions bound to the site Webflow confirms, and refuses to send to private network addresses. Report a security issue to hello@greatwork.company; we treat it as urgent.
8. Your choices and rights
- Change the retention window or delete any stored submission at any time in the App.
- Remove Batonwell from a site in the App (Settings > Remove Batonwell from this site): this deletes the Webflow webhook we created, revokes Google access and deletes everything listed in section 2 except the license record. Or uninstall the App in Webflow: our server deletes the token and data within 24 hours of the uninstall.
- Cancel your plan any time from Manage billing.
- If you're in the EEA, UK or California, you can ask us to access, correct, export or delete personal information we hold about you. Write to hello@greatwork.company; we reply within 30 days. If you are a visitor who submitted a form, please contact the site's owner first; we will help them with your request.
9. Children
The App is for businesses and website builders and isn't directed at children under 16.
10. Changes
We'll post changes here with a new effective date and, for material changes, email paying customers at least 14 days before they apply.