AgencyFlow is published by Absurdity Studio and operated by Absurdity LLC (“AgencyFlow,” “we,” “us,” or “our”). Absurdity LLC is the controller of the personal information described in this policy. This policy explains how AgencyFlow handles information when you use the macOS app, cloud features, and website, wherever you are.
Operator: Absurdity LLC, 1307 Lipton Ave SW, North Canton, OH 44720, USA. Privacy contact: joshua@absurdity.studio.
Information AgencyFlow handles
Account and subscription information
We process your email address, account identifier, signup and plan status, marketing preference, and account timestamps. If you buy a subscription, we retain Stripe customer, checkout, payment-intent, subscription, and price identifiers. Stripe, not AgencyFlow, collects and processes your card details.
The Mac app stores its login session in your macOS login Keychain and keeps a limited account cache in its Application Support directory.
Webflow connections
AgencyFlow stores local project labels, Claude MCP registration details, reported Webflow site identifiers and names, verification results, and related timestamps. Claude Code owns its MCP authorization; AgencyFlow does not copy that MCP token. A connection or scope check you start in AgencyFlow runs through the locally installed Claude command-line tool and is also subject to Anthropic’s terms and privacy practices.
Scheduled Publishing
When you use Scheduled Publishing, AgencyFlow processes your account ID, project label, Webflow site ID and name, selected staging or custom domains, scheduled time and time zone, safety settings, operation status, completion time, and bounded failure details. The separate Webflow OAuth token is stored server-side in Supabase Vault and is never returned to the Mac app. AgencyFlow uses it only to verify the selected site and domains and carry out the publish action you requested.
Page Status
When you enable Page Status, AgencyFlow processes your account ID, Webflow site and page IDs, queued and staged counts, lifecycle and attention state, reconciliation timestamps, exact webhook IDs, and SHA-256 ownership hashes used to verify AgencyFlow’s own markers.
Page Status tables do not store Webflow page names, slugs, SEO settings, page content, client or site display names, webhook bodies, or plaintext Webflow tokens. A page name is held briefly in worker memory only while AgencyFlow verifies and updates its own leading marker. Verified webhook bodies are reduced to identifiers, timestamps, and publish flags, then discarded.
More than one AgencyFlow account can enable Page Status for the same site. Each account keeps its own authorization while AgencyFlow shares one marker ledger and webhook pair. AgencyFlow does not reveal one account’s identity to another.
Diagnostics and download requests
AgencyFlow sends an error report only when you choose to report a problem. It can include app, build, and macOS versions; an optional reply email and note; a limited sanitized activity tail; and recent sanitized error events. Token-like values and authorization URLs are removed before storage and again before transmission.
If you request a download link, AgencyFlow processes your email address, coarse request source, and browser user-agent string. Short-lived hashed identifiers, nonces, and rate-limit windows help prevent abuse.
Website
The AgencyFlow website is hosted by Vercel, which can process ordinary delivery information such as an IP address, browser and device information, requested page, and request timestamp. If you accept analytics, the website also uses Google Analytics, described under Cookies and analytics. Without your consent it loads no third-party analytics script.
The website uses a session-only browser-storage flag to avoid repeating a download panel during the same visit, and a local-storage entry that remembers your cookie choice. Neither is used as an AgencyFlow account identifier.
Why AgencyFlow uses information
- Create and secure your account.
- Provide the features you turn on and verify the Webflow site you selected.
- Run and reconcile scheduled publishes and Page Status updates.
- Prevent duplicate, unauthorized, or conflicting operations.
- Process subscriptions and provide account support.
- Deliver requested download or support email and diagnose problems you choose to report.
- Protect AgencyFlow, its users, and third-party services from misuse.
- Measure how the website is used, if you accept analytics.
AgencyFlow does not sell personal information and does not use Webflow page content or page names to train machine-learning models.
Legal bases for processing (EEA, UK, and Switzerland)
If you are in the European Economic Area, the United Kingdom, or Switzerland, data protection law requires a legal basis for each way we use your personal information. These are ours.
| What we do | Legal basis |
|---|---|
| Create and run your account, provide the Webflow connection, Scheduled Publishing, and Page Status features you turn on, and keep publish history | Contract: it is necessary to provide the service you asked for. |
| Take payment through Stripe and manage your subscription | Contract. |
| Keep billing and tax records | Legal obligation where EU or UK law requires the record, and otherwise our legitimate interest in meeting our tax and accounting duties. |
| Send the download link or support reply you ask for | Taking steps you ask for, or our legitimate interest in answering you. |
| Protect AgencyFlow, its users, and connected services: security, abuse and fraud prevention, rate limiting, and handling disputes | Legitimate interests in keeping the service safe and defending against claims. |
| Diagnose problems from error reports you choose to send | Your consent, given when you choose to send the report. |
| Send product and marketing email | Your consent, which you can withdraw at any time by changing your marketing preference. |
| Deliver and secure the website, including hosting and delivery logs | Legitimate interests in running a working and secure website. |
| Measure website use with Google Analytics | Your consent, which also meets the rules that require consent before we store or read information on your device. |
Where we rely on legitimate interests, we weigh them against your rights and freedoms, and you can object as described under Your choices and rights. Where we rely on consent, you can withdraw it at any time without affecting what we did before you withdrew.
Service providers
AgencyFlow uses Webflow, Supabase, Stripe, Resend, Cloudflare, GitHub, Anthropic, and Vercel to operate the service and, if you accept analytics, Google to measure website use.
These providers can process ordinary infrastructure metadata such as an IP address, timestamp, browser or app version, and request headers under their own policies. AgencyFlow may also disclose information when legally required, to protect rights or safety, or as part of a business transaction subject to appropriate safeguards.
Retention
| Information | Retention |
|---|---|
| Processed Page Status events | 7 days |
| Transactional email outbox records | 7 days |
| Download-link requests | 30 days |
| Settled anonymous abuse-prevention state | 2 days |
| Google Analytics data, if you accept analytics | Event-level data up to 14 months, then deleted by Google. Aggregated reports that do not identify you are kept longer. |
| Error reports you submit | 180 days |
| Active Webflow credentials | Until revoked, disconnected, rejected by Webflow, or removed during verified account cleanup |
| Page Status site/page state | Until the final account disables the feature and marker/webhook cleanup is verified |
| Scheduled publish history | Up to 12 months after completion, cancellation, or final failure |
| Account/profile records | Until the account is deleted, subject to the limited exceptions below |
| Billing, tax, fraud-prevention, dispute, security, and cleanup records | Only as long as required by law or reasonably necessary for the stated purpose |
AgencyFlow can retain a non-secret ownership record when Webflow is unavailable or access has ended and cleanup cannot yet be proven. This prevents AgencyFlow from falsely reporting that externally created markers or webhooks were removed. The record is deleted after cleanup is completed.
Your choices and rights
You can sign out, remove local Claude MCP registrations, cancel future publishes, disconnect Scheduled Publishing, disable Page Status, change your marketing preference, choose whether to send an error report, and accept or decline website analytics at any time from Cookie settings in the footer.
Wherever you live, you can ask us to confirm whether we hold personal information about you, give you a copy, correct it, delete it, or export it in a portable format. If you are in the EEA, the UK, or Switzerland, you can also ask us to restrict processing, object to processing that rests on our legitimate interests, and withdraw consent you gave. Where the law of another place gives you similar rights, we honor them as that law requires.
To use any of these rights, email joshua@absurdity.studio from the address on your account, or write to the postal address under Contact. We may need to verify your identity first. There is no charge, except where the law allows one for a request that is manifestly unfounded or excessive. We will respond within 30 days, or sooner when the law requires it.
After a verified deletion request we delete your account and profile information, except the minimum billing, tax, fraud-prevention, dispute, security, and non-secret cleanup records that the law requires or that we reasonably need for those purposes, as described under Retention. Deletion is therefore not always immediate or complete, and we will tell you when we cannot delete something.
To create an account and use the cloud features you must give us an email address and the Webflow authorization you choose to grant; without them we cannot provide those features. Browsing the website does not require either.
You have the right to complain to a data protection supervisory authority. In the EEA, that is the authority in the country where you live or work or where you believe a violation happened; the European Data Protection Board lists them at edpb.europa.eu. In the UK, it is the Information Commissioner’s Office. In Switzerland, it is the Federal Data Protection and Information Commissioner. Elsewhere, it is the authority that handles privacy complaints where you live. We would like the chance to address your concern first, but you do not have to contact us before you complain.
International processing
AgencyFlow is available worldwide. Absurdity LLC is based in the United States, and AgencyFlow and its service providers process information in the United States and in other countries where those providers operate. Those countries can have data protection laws that differ from the laws where you live.
When personal information from the EEA, the UK, or Switzerland is transferred to a country that has not been recognized as providing adequate protection, we rely on a safeguard that the law recognizes. Examples are the European Commission’s standard contractual clauses, together with the UK addendum or the UK International Data Transfer Agreement where UK law applies, and a recipient’s certification under the EU-US Data Privacy Framework and its UK and Swiss extensions. You can ask how a particular transfer is safeguarded by emailing joshua@absurdity.studio.
Security
AgencyFlow uses access controls, transport encryption, server-side token custody, encrypted secret storage, bounded workers, signed webhooks, and verification before destructive cleanup. No online service can promise absolute security. Contact us promptly if you believe your account or a connected service has been compromised.
Age and business use
AgencyFlow is for people age 18 or older using the service for business or professional purposes. It is not directed to children.
Changes
We may update this policy as AgencyFlow changes or legal requirements evolve. We will post the revised policy with a new “Last updated” date and provide any additional notice required by law.
Contact
Absurdity StudioOperated by Absurdity LLC
Attn: Joshua Sauder
1307 Lipton Ave SW
North Canton, OH 44720
USA
joshua@absurdity.studio