Combwell for Webflow: Privacy Policy
Last updated: October 1, 2026
Combwell is a Webflow app made by Great Work LLC, 651 N Broad St Suite 206, Middletown, DE 19709, USA (hello@greatwork.company). This policy covers what Combwell collects, why, where it goes, how long we keep it and how to delete it.
What Combwell stores
| What | Why | Kept for |
|---|---|---|
| Your site's Webflow access token, encrypted (AES-256-GCM) | To read your site, page list and CMS for audits and to write the CMS fixes you confirm | Until you remove Combwell, uninstall it or revoke access; then deleted |
| Site id, workspace id, site name, its published domains and webflow.io address, and which one you audit | To apply your plan and to know which addresses to check | As long as Combwell is connected |
| Settings: re-check schedule, digest switch and the email it goes to, the "prepared by" name for reports, US or UK English | Your preferences | Until you remove Combwell |
| Your site's dictionary words and brand names | So the spelling and brand checks know them | Until you change them or remove Combwell |
| Launch checklist ticks: which item, who (Webflow user email) and when | The checklist and its PDF show who confirmed what | Until you untick it or remove Combwell |
| Audit results: for each issue, the check, what was found (a word, an address, a short text), where it is (page path, CMS collection, field and item names, a short CSS path), a short excerpt of the text around it (up to about 100 characters), counts, and who ran the audit (Webflow user email) | The Site QA tab, the checklist, reports and the trend | Full detail for your last 2 audits; counts for 24 months |
| While an audit runs: the pages and images to check, each page's title, description and icon addresses, and the findings per page | To finish the audit without holding pages in memory | Detail kept with the audit (last 2 audits); the work queue is deleted when the audit ends |
| Dismissed issues: which issue, why (hidden, intended, added to the dictionary), who and when | Reports show what was reviewed by a person | Until you un-hide it or remove Combwell |
| Fix history: who, when and what (a summary), and the old values of the CMS fields a fix changed, encrypted (AES-256-GCM) | Undo | The old values for 30 days; the summary for 24 months |
| Digest emails, once email is on: when the last one went out | At most one a week | Until you remove Combwell |
| Server request logs: time, method, path, status, duration | Security and troubleshooting | 30 days. Not logged: query strings, tokens, request bodies, emails, page content |
What we don't store. Combwell reads your published pages during an audit and keeps only the findings above; it keeps no copy of your pages, CMS content or images (images are only asked whether they load). It doesn't collect your site visitors' data and adds no code, widget or cookies to your site. It doesn't read form submissions, ecommerce data, assets or users.
Personal data. The personal data Combwell holds is your Webflow user email (sessions, receipts, who ran an audit, made a fix, dismissed an issue or ticked a checklist item, and the digest once email is on). Excerpts of your published pages and CMS fields can contain personal data if your public pages do (for example a test email address or phone number Combwell found, which is the point of the check). We don't sell personal data, don't use it for advertising and don't use it to train AI models. Combwell sends none of your content to any AI service: spelling uses dictionaries on our server, and fixes use only the words you type or pick.
Spelling dictionaries. Spelling is checked on our server with open-licensed dictionaries (SCOWL and the LibreOffice English, Spanish, French and Brazilian Portuguese dictionaries). Your text is never sent to them or to anyone else; they're files on our server.
Third parties and every domain Combwell talks to
| Domain | Who | What |
|---|---|---|
| api.webflow.com, webflow.com | Webflow, Inc. | Your site, page list and CMS through the Data API, the fixes you confirm, and the sign-in (OAuth) screen |
| Your published site (its custom domains and its webflow.io address) | You | CombwellBot reads your public pages, sitemap and robots.txt during audits, like a search engine would, and asks once for each image the pages show |
| cdn.prod.website-files.com (and other addresses your pages load images from) | Webflow, Inc., or whoever hosts that image | CombwellBot asks once whether each image loads (a HEAD request, or a GET whose body is thrown away) |
| addons.greatwork.company | Great Work LLC (our server, hosted at DigitalOcean, New York) | Combwell's backend and our licensing service: your site id, workspace id and verified email, to run your trial and plan |
| checkout.stripe.com, billing.stripe.com | Stripe, Inc. | Payment and billing, only when you click a plan or Manage billing. Stripe holds your card details; we never see them |
| api.resend.com | Resend, Inc. | Only once email is switched on for Combwell: the audit digest you turn on (recipient, site name, counts; never page content) |
| greatwork.company | Great Work LLC | Product page, documentation and this policy |
Our server runs on DigitalOcean (United States). Data is encrypted in transit (TLS) everywhere.
Retention and deletion
- Remove Combwell (Settings) stops a running audit and deletes the Webflow token (revoked at Webflow first), audits, issues, history, dismissals, words, brand names, checklist ticks, settings and the undo journal for your site, at once.
- Uninstall or revoke access in Webflow: we delete the token and your site's data the next time Webflow tells us the access is gone (on our next request or audit, and at the latest by the next daily check).
- Audit detail beyond your last 2 audits is deleted (counts stay for 24 months for the trend); undo values are deleted after 30 days (retention runs daily).
- If your trial or plan ends, audits and fixes pause and nothing is deleted for 30 days. After 30 days without a plan, everything for the site is deleted.
- To ask for a copy or deletion of your data, email hello@greatwork.company. We answer within 30 days.
Your rights
Depending on where you live (for example the EU, UK or California), you can ask to access, correct, delete or export your personal data, and object to or restrict its use. Email hello@greatwork.company. Our legal basis for processing is the contract with you (providing the app you installed) and our legitimate interest in keeping the service secure.
Children
Combwell is a business tool and isn't meant for children under 16; site visitors are never involved.
Changes
We'll post changes here and update the date above. If a change matters, we'll say so in the app.
Contact
Great Work LLC, 651 N Broad St Suite 206, Middletown, DE 19709, USA. hello@greatwork.company