Replacewell for Webflow: Privacy Policy
Effective date: October 1, 2026 Publisher: Great Work LLC, 651 N Broad St Suite 206, Middletown, DE 19709, USA Contact: hello@greatwork.company
This policy covers the Replacewell app for Webflow (the "App"): the panel that runs in the Webflow Designer and the Great Work server it talks to. It doesn't cover Webflow's own products, which have their own policy.
1. Summary
- The App reads and changes your site's text only when you ask it to, through Webflow's official APIs.
- Great Work stores two things: an encrypted Webflow access token for each connected site, and your license status. Page text and CMS content are never stored on our servers.
- Undo history is kept in your own browser for 30 days, not on our servers.
- We don't sell or share personal information, show ads, use analytics trackers or cookies in the App, or use your content to train AI.
2. What we process, and why
| Data | Why | Where it lives and for how long |
|---|---|---|
| Webflow OAuth access token for the site(s) you approve, its scopes, the site and workspace ids it covers, timestamps | To read and update CMS items you choose, and to confirm which site you're working on | Our server, encrypted with AES-256-GCM. Deleted when you disconnect, when Webflow tells us it's revoked (for example after you uninstall), or by our daily check, so within 24 hours of an uninstall |
| Webflow user id and email, and the site id, from Webflow's identity check each time you open the App | To confirm who you are and which site you're on; the email is the billing contact for receipts | Held in memory for the 15-minute session. The site id, workspace id and email are passed to our billing service (below) |
| CMS items and fields you search (text fields only), page text, SEO fields, alt text and link URLs | To show the preview and apply the changes you approve | CMS content passes through our server's memory during the request only and is never written to disk or logs. Page text, SEO fields, alt text and links are read and written in your browser through the Designer API and never reach our server |
| Undo history: the text before and after each change of a run | So you can undo or resume a run | Your browser (IndexedDB for the App's own frame), 30 days or until you clear it. Never sent to us |
| License record: site id, workspace id, billing email, plan, trial dates, Stripe customer and subscription ids | To run the trial and paid plans | Our billing service at addons.greatwork.company, for as long as you have a trial or plan, then as long as tax and accounting law requires |
| Server request logs: time, method, path (without query strings), status and duration. Your IP address is used in memory for rate limiting and not logged | Security and reliability | Our server, 30 days. Never includes tokens, codes, IP addresses, page or CMS content |
3. Third parties and domains
The App talks only to these:
- webflow.com / api.webflow.com (Webflow, Inc.): the Designer API and Data API, and the OAuth screens.
- addons.greatwork.company (Great Work LLC): our backend and billing service, hosted on a DigitalOcean server in the United States (DigitalOcean, LLC is our infrastructure provider).
- checkout.stripe.com and billing.stripe.com (Stripe, Inc.): only if you click to buy or manage a plan. Stripe processes payment details under its own privacy policy; we never see card numbers.
- greatwork.company: our docs, privacy and terms pages, opened only when you click them.
- Resend (Resend, Inc.): sends receipts and billing emails from hello@greatwork.company.
We don't use any other subprocessors for the App.
4. Sharing
We don't sell, rent or share personal information. We disclose it only to the providers above, to do what this policy describes, or if the law requires it.
5. AI and model training
The App uses no AI services. Nothing it processes is used to train any model.
6. Security
Tokens are encrypted at rest and never sent to your browser. The App's backend runs as its own unprivileged user behind HTTPS (TLS) with strict CORS and short-lived sessions. Every session is bound to the site Webflow confirms, not to anything your browser claims. Report a security issue to hello@greatwork.company; we treat it as urgent.
7. Your choices and rights
- Disconnect a site any time in the App (Settings > Disconnect this site) or uninstall the App in Webflow.
- Clear Undo history in the App (Settings) or by clearing your browser's site data.
- Cancel your plan any time from Manage billing.
- If you're in the EEA, UK or California, you can ask us to access, correct, export or delete personal information we hold about you. Write to hello@greatwork.company; we reply within 30 days.
8. Children
The App is for businesses and website builders and isn't directed at children under 16.
9. Changes
We'll post changes here with a new effective date and, for material changes, email paying customers at least 14 days before they apply.