Includewell for Webflow: Privacy Policy
Last updated: October 1, 2026
Includewell is a Webflow app made by Great Work LLC, 651 N Broad St Suite 206, Middletown, DE 19709, USA (hello@greatwork.company). This policy covers what Includewell collects, why, where it goes, how long we keep it and how to delete it.
What Includewell stores
| What | Why | Kept for |
|---|---|---|
| Your site's Webflow access token, encrypted (AES-256-GCM) | To read your site, page list, CMS and assets for audits and to write the fixes you confirm | Until you remove Includewell, uninstall it or revoke access; then deleted |
| Site id, workspace id, site name and its published domains | To apply your plan and to know which addresses to audit | As long as Includewell is connected |
| Settings: re-check schedule, digest switch and the email it goes to, the "prepared by" name for reports, your statement answers (organization, contact email and phone, chosen status, plans) | So reports and statements start from what you entered | Until you remove Includewell |
| Audit results: for each issue, the check, where it is (page path, CMS collection, item and field, asset id, a short CSS path), a short excerpt (the element's opening tag or up to 80 characters of its text), counts, and who ran the audit (Webflow user email) | The Site audit tab, reports, the statement's known limitations and the trend | Full detail for your last 2 audits; counts for 24 months |
| While an audit runs: the pages to visit and the findings per page | To finish the audit without holding pages in memory | Deleted when the audit ends |
| Dismissed issues: which issue, why (decorative, checked by hand, hidden), who and when | Reports show what was reviewed by a person | Until you un-hide it or remove Includewell |
| Fix history: who, when and what (a summary), and the old values of what a fix changed (rich text field, image alt text, asset alt text, Designer settings), encrypted (AES-256-GCM) | Undo | The old values for 30 days; the summary for 24 months |
| Digest emails, once email is on: when the last one went out | At most one a week | Until you remove Includewell |
| Server request logs: time, method, path, status, duration | Security and troubleshooting | 30 days. Not logged: query strings, tokens, request bodies, emails, page content |
What we don't store. Includewell reads your published pages and stylesheets during an audit and keeps only the findings above; it keeps no copy of your pages, CMS content or images. It doesn't collect your site visitors' data and adds no code, widget, overlay or cookies to your site. It doesn't read form submissions, ecommerce data or users.
Personal data. The personal data Includewell holds is your Webflow user email (sessions, receipts, who ran an audit or made a fix or dismissal, and the digest once email is on) and the contact details you type into the statement generator. Excerpts of your published pages can contain personal data if your public pages do. We don't sell personal data, don't use it for advertising and don't use it to train AI models. Includewell sends none of your content to any AI service: alt text comes from what you type or from a template of your own fields.
Third parties and every domain Includewell talks to
| Domain | Who | What |
|---|---|---|
| api.webflow.com, webflow.com | Webflow, Inc. | Your site, page list, CMS and assets through the Data API, the fixes you confirm, and the sign-in (OAuth) screen |
| Your published site (its custom domains and its webflow.io address) | You | IncludewellBot reads your public pages and robots.txt during audits, like a search engine would |
| cdn.prod.website-files.com (and other Webflow-hosted file addresses your pages use) | Webflow, Inc. | IncludewellBot reads the stylesheets your pages load, to measure contrast |
| addons.greatwork.company | Great Work LLC (our server, hosted at DigitalOcean, New York) | Includewell's backend and our licensing service: your site id, workspace id and verified email, to run your trial and plan |
| checkout.stripe.com, billing.stripe.com | Stripe, Inc. | Payment and billing, only when you click a plan or Manage billing. Stripe holds your card details; we never see them |
| api.resend.com | Resend, Inc. | Only once email is switched on for Includewell: the audit digest you turn on (recipient, site name, counts; never page content) |
| greatwork.company | Great Work LLC | Product page, documentation and this policy |
Our server runs on DigitalOcean (United States). Data is encrypted in transit (TLS) everywhere.
Retention and deletion
- Remove Includewell (Settings) stops a running audit and deletes the Webflow token (revoked at Webflow first), audits, issues, history, dismissals, settings, statement answers and the undo journal for your site, at once.
- Uninstall or revoke access in Webflow: we delete the token and your site's data the next time Webflow tells us the access is gone (on our next request or audit, and at the latest by the next daily check).
- Audit detail beyond your last 2 audits is deleted (counts stay for 24 months for the trend); undo values are deleted after 30 days (retention runs daily).
- If your trial or plan ends, audits and fixes pause and nothing is deleted for 30 days. After 30 days without a plan, everything for the site is deleted.
- To ask for a copy or deletion of your data, email hello@greatwork.company. We answer within 30 days.
Your rights
Depending on where you live (for example the EU, UK or California), you can ask to access, correct, delete or export your personal data, and object to or restrict its use. Email hello@greatwork.company. Our legal basis for processing is the contract with you (providing the app you installed) and our legitimate interest in keeping the service secure.
Children
Includewell is a business tool and isn't meant for children under 16; site visitors are never involved.
Changes
We'll post changes here and update the date above. If a change matters, we'll say so in the app.
Contact
Great Work LLC, 651 N Broad St Suite 206, Middletown, DE 19709, USA. hello@greatwork.company