Privacy Policy

Last updated: 30 September 2026

Stacked Workflows is a Chrome extension, with an optional Claude Desktop add-on, that helps GoHighLevel users manage their own automation workflows. This policy explains what the extension accesses, where that data goes, what our website records, and what we keep about your licence. In short: the extension works through your own logged-in GoHighLevel session, your GoHighLevel data is processed in your browser, and none of it is sent to Stacked Digital. The extension contacts our servers only to validate your licence key and to check for updates. If you turn on the AI add-on, the workflow content Claude works on goes to Anthropic through your own Claude account, as described below. The Claude Desktop add-on also sends us anonymous bug reports when one of its tools fails, so we can fix bugs quickly. They are built from a fixed list of technical details, never your GoHighLevel data, ids or tokens; the short error text in a report, and anything Claude writes when it files one, is filtered for names, contact details and message content on a best-effort basis. You can switch them off (see "Anonymous bug reports" below).

What the extension accesses

Your GoHighLevel session (authentication information). To read and change your own workflows, the extension uses the session token from your logged-in GoHighLevel tab, the same credential the GoHighLevel builder already uses. It is stored locally in your browser, with its expiry time and the address of the page it came from, and is sent only to GoHighLevel's own servers on your behalf and, if you turn the add-on on, to the local Claude bridge on your computer.
Workflow content (website content). When you use a feature, the extension reads the content of the workflow you have open, its steps, messages and triggers, so it can back it up, summarise, audit or edit it.
Tab addresses on GoHighLevel. It reads the URL of your active GoHighLevel tab to detect which sub-account and workflow you have open, and looks for open tabs of GoHighLevel domains you have linked. It does not read your browsing history, and it does not run on other websites, including the GoHighLevel form, survey, booking and chat widgets embedded on third-party sites.
A hidden refresh tab. GoHighLevel session tokens expire roughly hourly. When a fresh one is needed for an action or for Claude, the extension may briefly open an inactive background tab to your own GoHighLevel account (the last builder page you used, or your linked agency domain), wait for GoHighLevel to issue a new token, and close it. This only works while you are logged in to GoHighLevel in Chrome and never visits any other site.
Your settings and licence. Your preferences, the accounts you have linked, and your licence check (key, plan, licence name) are stored in the extension's local storage. The licence record is also mirrored to Chrome's sync storage, which Google syncs between the Chrome profiles you are signed into, so you only enter the key once.

We do not: sell or transfer your data to third parties; send your GoHighLevel data, session or workflow content to Stacked Digital's servers; run analytics or tracking inside the extension; use your data for advertising, creditworthiness or lending; or use it for anything unrelated to managing your workflows.

Where your data goes

Workflow reads and writes go directly from your browser to GoHighLevel, using your existing session. Backups and exports you create are downloaded to your own computer. Nothing about your GoHighLevel account is routed through us. The extension makes three kinds of request to servers we control, none of which carry GoHighLevel data: the licence check described below; a fetch of workflows.stackedlabs.io/config.json, a small data file that lets us update GoHighLevel endpoint addresses without a new release (data only, never code); and a fetch of version.json when you open the popup, so it can show an update notice. Those requests carry only standard request metadata such as your IP address, which our hosting provider (Cloudflare) processes to serve them.

Licence activation

To confirm your licence is active, the extension sends your licence key to our licence server (a Cloudflare Worker) when you activate, and re-checks it periodically: about weekly when you open the popup, and daily in the background while you use the extension. The key is the only thing the extension sends; it contains no GoHighLevel data. The server replies with your plan and licence name. We do not keep a log of validation checks beyond the transient request handling Cloudflare performs to serve them.

What we keep about your licence. When you buy, Stripe passes us your name and email address, and we create a licence record containing your licence key, name, email, plan, status (active or revoked), any expiry date, the purchase date and the Stripe checkout, payment and customer references. We use it to validate the key, email it to you, and switch it off automatically on a refund or chargeback. We keep this record for as long as the licence exists and for our accounting obligations afterwards. You can ask us to delete it at any time (see Contact); deleting it deactivates the licence.

The optional AI add-on ("Connect to Claude")

If you turn on "Connect to Claude" and install the Claude Desktop add-on, the extension passes your GoHighLevel session token to a small helper (the add-on) running on your own computer, over a local-only connection (127.0.0.1) that accepts requests from this extension alone. The token itself never leaves your machine: the add-on uses it to talk to GoHighLevel on your behalf and to nothing else. While the add-on is on, the extension also gives it a short local record of the most recent GoHighLevel API requests your browser made, capped at the last 150: the method, the address, the response status and, for workflow-builder endpoints only, a short excerpt of the request body with tokens, secrets, email addresses and phone numbers stripped out (login, user, contact and payment requests never include a body). Claude can ask for this record when it needs to understand an endpoint.

What Claude reads does leave your machine. When you ask Claude to list, read, audit, build or edit a workflow, Claude Desktop sends the workflow content it reads (and, if requested, that recent-request record) to Anthropic to generate its reply, under your own Claude account and Anthropic's privacy policy. Stacked Digital never receives any of it. The add-on is off by default, works only with an active licence, and you can turn it off at any time from the extension popup.

Anonymous bug reports (Claude Desktop add-on)

The Claude Desktop add-on sends us a short, anonymous bug report when one of its tools fails in a way that points to a bug on our side: an unexpected crash inside a tool, a required setting that never reached the add-on, an edit to a live workflow that did not read back the way it should, GoHighLevel not answering an edit, or a workflow the add-on built that does not match the plan it was given. Claude can also file a report itself, with the add-on's report_issue tool, when it believes a Stacked Workflows tool misbehaved; the tool's reply tells you it was reported and shows exactly what was sent. Reports are on by default, because they are how we find and fix bugs before you have to tell us about them. Everyday refusals are not reported: GoHighLevel rejecting a workflow as invalid, a request Claude got wrong, an expired login, or your own internet connection dropping.

What a report contains:

a random install id created on your computer, so we can tell one computer hitting a bug fifty times from fifty computers hitting it once. It is random, not derived from your licence key, name, email address or anything else, and our server keeps only a one-way hash of it;
the add-on's version, the name and version of the app running it (for example Claude Desktop), your operating system type (such as macOS or Windows) and your Node.js version;
the kind of report, which tool was involved, the names (never the values) of the settings the tool was given and of any required setting that never arrived, and a fixed word describing what went wrong;
the kind of error, a shortened error message with ids, email addresses, phone numbers, links, domain names and quoted text removed, GoHighLevel's response status and error code (a fixed code such as a rule name, never a name or id), and the file and line in our own code where it happened;
for a workflow that did not match its plan: a few counts (for example how many steps were planned and how many were built);
a fingerprint (a one-way hash of the error) so repeats of the same bug are counted together, the report format version, and the date we received it;
for a report Claude files: which tool, what was expected and what happened (a sentence or two each, length-limited, with the same removals), a severity, and the names of the settings used.

Never sent: your GoHighLevel data (workflows and their names, steps, messages, email or SMS content, contacts, tags, custom fields, calendars or forms); email addresses or phone numbers; any GoHighLevel id (agency, sub-account, workflow, contact or trigger); your session token or licence key; or the values of anything you or Claude entered into a tool. None of these is ever a field of a report. The only free text in a report is the shortened error message and, in a report Claude files, its short description of what went wrong, and that text is filtered on a best-effort basis: before sending, the add-on removes anything that looks like an id, token, email address, phone number, link, domain name or quoted text, and capitalised words that look like names, from every text field, and if anything still looks like an id, token, email address, phone number, link or domain name, the report is dropped, not sent. Our server repeats those checks and throws away any report that fails them. A pattern cannot recognise every name (one written in lower case or in a non-Latin script, for example), so Claude is instructed never to put client names, contact details or message content in a report it files, and the tool shows you exactly what it sent.

Reports go over HTTPS to our licence server (a Cloudflare Worker) and are stored in our own database (Cloudflare D1). Cloudflare processes your IP address to deliver the request and to limit how many reports one address can send, as it does for any web request; the report does not include it and we do not store it with the report. We use reports only to find and fix bugs, never for advertising, and we do not share them. Individual reports are deleted after 90 days; the running tally we keep for each distinct bug (how often it happened, the versions and apps it was seen on, and its most recent report) is deleted 12 months after that bug was last seen. Sending never slows down or blocks a tool: reports go in the background, are limited on your computer (the same bug at most once a day, and at most 10 reports an hour), and are simply discarded if our server can't be reached. The add-on keeps a copy of the last few reports it sent in ~/.ghlwf, so you can see exactly what left your computer.

Switching them off. In Claude Desktop, open Settings, then Extensions, then Stacked Workflows, and turn off Send anonymous bug reports. That stops every report, including ones Claude would file. It takes effect the next time the add-on starts (restart Claude Desktop to be sure). If you run the add-on outside Claude Desktop, set the environment variable SWF_REPORTS=off instead. The Chrome extension does not send bug reports; nothing about it has changed.

This website (analytics)

Separately from the extension, our marketing website (workflows.stackedlabs.io) records how visitors find and use the site. This runs on every page of this website, never inside the extension, and has no access to your GoHighLevel account or workflow data.

Our own first-party beacon. A small script served from this site sends events to our licence server, which stores them in our own database (Cloudflare D1). It records the event type (a page view, a click on a button, or a click on a checkout link), the page path, the text of the button you clicked, the first-touch source of your visit (the UTM source and campaign on the link you arrived from; otherwise the referring site's hostname, "facebook" or "google" for tagged ad clicks, or "direct") and a random session id. The session id lives in your browser's sessionStorage, is not a cookie, and is discarded when you close the tab. The beacon does not record your name, email address or IP address. When a purchase completes, our server records a purchase event with the Stripe checkout session id and the amount; that id also appears on your licence record, so we can tell which visit converted. We keep these events for funnel reporting and do not share them.
Meta Pixel (to measure advertising performance) and Microsoft Clarity (anonymised heatmaps and session replay, so we can see where visitors get stuck). These third-party tools may set cookies and receive standard web-analytics data, such as the pages you view. On a purchase, our server also sends Meta a Purchase event containing a one-way hashed (SHA-256) version of the email you entered at checkout, so ad performance can be measured without sharing the address itself.

Opting out. To stop our own beacon counting your browser, open any page on this site with ?notrack=1 added to the address (for example workflows.stackedlabs.io/?notrack=1). This stores a flag in your browser's local storage and persists until you clear site data or visit with ?notrack=0. Meta Pixel and Clarity can be blocked with your browser's tracking controls or an ad-blocker.

Data retention

In the extension: settings, linked accounts, the cached session token and the licence check live in your browser's extension storage and are removed when you uninstall the extension or clear its data. The licence record mirrored to Chrome sync is removed when you clear the extension's data or its sync data.
In the add-on: the session token is written to a file in your home folder (~/.ghlwf, readable only by your user account) so Claude stays connected between restarts; delete that folder to remove it. The random install id used by the bug reports, and a small file with the report rate limits and a copy of the last few reports sent, are kept in the same folder; deleting the install id makes the add-on start a new one. The recent-request record is held in memory and vanishes when the add-on stops.
On our servers: the licence record, for the life of the licence (see above); website analytics events, for funnel reporting; the add-on's anonymous bug reports (individual reports for 90 days, the tally for each distinct bug for 12 months after it was last seen). We do not store any GoHighLevel data.

Changes

We may update this policy as the product evolves. Material changes will be reflected on this page with a new "last updated" date.

Contact

Questions about privacy, or a deletion request? Email support@stackeddigital.com.