Okaywell for Webflow: Privacy Policy
Effective date: October 1, 2026 Okaywell is made by Great Work LLC, 651 N Broad St Suite 206, Middletown, DE 19709, USA ("we"). Contact: hello@greatwork.company. This policy covers the Okaywell app for Webflow (the Designer Extension, the review pages your reviewers open, and our backend at addons.greatwork.company).
What Okaywell does with your data
When you send CMS items for review, Okaywell reads them from your Webflow site through Webflow's API (the version you're working on and the published version), keeps an encrypted copy of what was sent so every reviewer sees the same thing, and shows it to the reviewers you named on a page only their personal link opens. It records their decisions and comments. If you ask, it publishes the approved items. It never edits your content.
Items can contain personal data (for example names in a blog post). Reviewer emails and names are personal data you give us so we can address the review to them. Reviewers don't need an account.
What we store, and for how long
| What | Why | How long |
|---|---|---|
| Webflow access token for your site (encrypted, AES-256-GCM) | to read items and publish approved ones through Webflow's API | until you remove Okaywell, uninstall it, or revoke access |
| Copies of the items sent for review (encrypted) | so every reviewer sees exactly what was sent | 30 days after the review closes, then deleted |
| Workflows: step names, rules, due dates, approver names and emails | to send reviews to the right people | until you delete the workflow or remove Okaywell |
| Reviews: title, note, collection and item names, who sent it, reviewer names and emails, when links were opened and emailed, decisions | to run the review and show you its status | as long as the audit trail (below) |
| Reviewer comments, overall and per field (encrypted) | so you know what to fix | as long as the audit trail |
| Audit trail: sends, links opened, decisions, publishes, seat changes | your record of who approved what | 12 months on Standard and Workspace, 36 months on Pro |
| Editor seats: Webflow user id and email of each teammate who sent a review | plan seat limits | until the seat is freed or you remove Okaywell |
| Branding (Pro): your name and accent color | shown on review pages | until you change it or remove Okaywell |
| Site name, site ID, workspace ID, the email of the signed-in Webflow user | to identify the site for billing and send receipts | while you use Okaywell; billing records as tax law requires |
Review links are signed, not stored, and stop working after 60 days, when a review is cancelled, or when a link is reissued. When a trial or plan ends, sending new reviews pauses; you can read reviews and export the audit trail for 30 days, then the site's data is deleted. Server logs record the time, method, path and status of each request for 30 days. Review link paths and OAuth callbacks are not logged at all, and logs never include tokens, query strings, request bodies or CMS content.
Who processes data (every third-party domain the app contacts)
| Domain | Who | What for |
|---|---|---|
| webflow.com, api.webflow.com | Webflow, Inc. | OAuth sign-in, reading items, publishing approved items |
| website-files.com (Webflow's asset CDN, e.g. cdn.prod.website-files.com) | Webflow, Inc. | the reviewer's browser loads your item images straight from Webflow's CDN; Okaywell doesn't copy them |
| api.resend.com | Resend, Inc. | sending review invitations and reminders to reviewers, once email is turned on (until then you send the links yourself) |
| addons.greatwork.company | Great Work LLC (our server, hosted by DigitalOcean in New York, USA) | runs the backend and the review pages, licensing |
| checkout.stripe.com, billing.stripe.com | Stripe, Inc. | payments and billing (we never see card numbers) |
| greatwork.company | Great Work LLC | product, documentation, privacy and terms pages |
We don't sell personal data, don't use your content for advertising or to train AI models, and don't use advertising or analytics trackers in the app or on review pages. No person at Great Work looks at your reviews unless you ask us to help with a specific problem and give us permission, or the law requires it.
Deletion
- Remove Okaywell from this site (Settings) deletes every workflow, review, item copy, comment, audit row, seat and branding setting for the site, cancels open review links, and revokes and deletes our Webflow token.
- Uninstall or revoke: when Webflow tells us the authorization is gone (any request answered "unauthorized", plus a daily check, because Webflow sends no uninstall notice), we delete the token and all data for its sites, usually within 24 hours.
- A reviewer can ask us to delete their name, email and comments at hello@greatwork.company; we tell the site owner.
- Your Webflow CMS items are never changed by removal or deletion.
Your rights
You can ask for a copy of your data, correction or deletion at hello@greatwork.company. If you are in the EU or UK you can also complain to your data protection authority. For personal data in your CMS items and your reviewers' details, you are the controller and we process it for you (see the terms for a data processing agreement).
Security
Tokens, item copies and comments are encrypted at rest with keys kept outside the database, each bound to its purpose. Review links are signed per reviewer and expire. Review pages run no scripts and send strict security headers. The backend runs under its own unprivileged user on a hardened server, behind TLS. The Designer Extension never receives a Webflow token.
Changes
We'll post changes here and update the date; material changes are announced in the app. This policy's retention section covers data retention for every item we store.