Privacy Policy

Last updated: 9 September 2026

Stacked Workflows is a Chrome extension, with an optional Claude Desktop add-on, that helps GoHighLevel users manage their own automation workflows. This policy explains what the extension accesses, where that data goes, what our website records, and what we keep about your licence. In short: the extension works through your own logged-in GoHighLevel session, your GoHighLevel data is processed in your browser, and none of it is sent to Stacked Digital. The extension contacts our servers only to validate your licence key and to check for updates. If you turn on the AI add-on, the workflow content Claude works on goes to Anthropic through your own Claude account, as described below.

What the extension accesses

• Your GoHighLevel session (authentication information). To read and change your own workflows, the extension uses the session token from your logged-in GoHighLevel tab, the same credential the GoHighLevel builder already uses. It is stored locally in your browser, with its expiry time and the address of the page it came from, and is sent only to GoHighLevel's own servers on your behalf and, if you turn the add-on on, to the local Claude bridge on your computer.
• Workflow content (website content). When you use a feature, the extension reads the content of the workflow you have open, its steps, messages and triggers, so it can back it up, summarise, audit or edit it.
• Tab addresses on GoHighLevel. It reads the URL of your active GoHighLevel tab to detect which sub-account and workflow you have open, and looks for open tabs of GoHighLevel domains you have linked. It does not read your browsing history, and it does not run on other websites, including the GoHighLevel form, survey, booking and chat widgets embedded on third-party sites.
• A hidden refresh tab. GoHighLevel session tokens expire roughly hourly. When a fresh one is needed for an action or for Claude, the extension may briefly open an inactive background tab to your own GoHighLevel account (the last builder page you used, or your linked agency domain), wait for GoHighLevel to issue a new token, and close it. This only works while you are logged in to GoHighLevel in Chrome and never visits any other site.
• Your settings and licence. Your preferences, the accounts you have linked, and your licence check (key, plan, licence name) are stored in the extension's local storage. The licence record is also mirrored to Chrome's sync storage, which Google syncs between the Chrome profiles you are signed into, so you only enter the key once.

Where your data goes

Workflow reads and writes go directly from your browser to GoHighLevel, using your existing session. Backups and exports you create are downloaded to your own computer. Nothing about your GoHighLevel account is routed through us. The extension makes three kinds of request to servers we control, none of which carry GoHighLevel data: the licence check described below; a fetch of workflows.stackedlabs.io/config.json, a small data file that lets us update GoHighLevel endpoint addresses without a new release (data only, never code); and a fetch of version.json when you open the popup, so it can show an update notice. Those requests carry only standard request metadata such as your IP address, which our hosting provider (Cloudflare) processes to serve them.

Licence activation

To confirm your licence is active, the extension sends your licence key to our licence server (a Cloudflare Worker) when you activate, and re-checks it periodically: about weekly when you open the popup, and daily in the background while you use the extension. The key is the only thing the extension sends; it contains no GoHighLevel data. The server replies with your plan and licence name. We do not keep a log of validation checks beyond the transient request handling Cloudflare performs to serve them.

What we keep about your licence. When you buy, Stripe passes us your name and email address, and we create a licence record containing your licence key, name, email, plan, status (active or revoked), any expiry date, the purchase date and the Stripe checkout, payment and customer references. We use it to validate the key, email it to you, and switch it off automatically on a refund or chargeback. We keep this record for as long as the licence exists and for our accounting obligations afterwards. You can ask us to delete it at any time (see Contact); deleting it deactivates the licence.

The optional AI add-on ("Connect to Claude")

If you turn on "Connect to Claude" and install the Claude Desktop add-on, the extension passes your GoHighLevel session token to a small helper (the add-on) running on your own computer, over a local-only connection (127.0.0.1) that accepts requests from this extension alone. The token itself never leaves your machine: the add-on uses it to talk to GoHighLevel on your behalf and to nothing else. While the add-on is on, the extension also gives it a short local record of the most recent GoHighLevel API requests your browser made, capped at the last 150: the method, the address, the response status and, for workflow-builder endpoints only, a short excerpt of the request body with tokens, secrets, email addresses and phone numbers stripped out (login, user, contact and payment requests never include a body). Claude can ask for this record when it needs to understand an endpoint.

What Claude reads does leave your machine. When you ask Claude to list, read, audit, build or edit a workflow, Claude Desktop sends the workflow content it reads (and, if requested, that recent-request record) to Anthropic to generate its reply, under your own Claude account and Anthropic's privacy policy. Stacked Digital never receives any of it. The add-on is off by default, works only with an active licence, and you can turn it off at any time from the extension popup.

This website (analytics)

Separately from the extension, our marketing website (workflows.stackedlabs.io) records how visitors find and use the site. This runs on every page of this website, never inside the extension, and has no access to your GoHighLevel account or workflow data.

• Our own first-party beacon. A small script served from this site sends events to our licence server, which stores them in our own database (Cloudflare D1). It records the event type (a page view, a click on a button, or a click on a checkout link), the page path, the text of the button you clicked, the first-touch source of your visit (the UTM source and campaign on the link you arrived from; otherwise the referring site's hostname, "facebook" or "google" for tagged ad clicks, or "direct") and a random session id. The session id lives in your browser's sessionStorage, is not a cookie, and is discarded when you close the tab. The beacon does not record your name, email address or IP address. When a purchase completes, our server records a purchase event with the Stripe checkout session id and the amount; that id also appears on your licence record, so we can tell which visit converted. We keep these events for funnel reporting and do not share them.
• Meta Pixel (to measure advertising performance) and Microsoft Clarity (anonymised heatmaps and session replay, so we can see where visitors get stuck). These third-party tools may set cookies and receive standard web-analytics data, such as the pages you view. On a purchase, our server also sends Meta a Purchase event containing a one-way hashed (SHA-256) version of the email you entered at checkout, so ad performance can be measured without sharing the address itself.

Opting out. To stop our own beacon counting your browser, open any page on this site with ?notrack=1 added to the address (for example workflows.stackedlabs.io/?notrack=1). This stores a flag in your browser's local storage and persists until you clear site data or visit with ?notrack=0. Meta Pixel and Clarity can be blocked with your browser's tracking controls or an ad-blocker.

Data retention

• In the extension: settings, linked accounts, the cached session token and the licence check live in your browser's extension storage and are removed when you uninstall the extension or clear its data. The licence record mirrored to Chrome sync is removed when you clear the extension's data or its sync data.
• In the add-on: the session token is written to a file in your home folder (~/.ghlwf, readable only by your user account) so Claude stays connected between restarts; delete that folder to remove it. The recent-request record is held in memory and vanishes when the add-on stops.
• On our servers: the licence record, for the life of the licence (see above); website analytics events, for funnel reporting. We do not store any GoHighLevel data.

Changes

We may update this policy as the product evolves. Material changes will be reflected on this page with a new "last updated" date.

Contact

Questions about privacy, or a deletion request? Email [email protected].