Privacy Policy

PopFlow (“we”, “us”, or “our”) operates the PopFlow service available at popflow.dev (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using PopFlow, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

Information you provide directly:

• Your Webflow account email address, obtained via Webflow OAuth authorisation (used for account identification, billing, and support).
• Popup and announcement-bar configurations you create: names, trigger settings, content (headlines, body text, images), and style settings.
• If you contact us through the contact form, the name, email address, and message you submit (processed via Resend to respond to you).
• Billing information (Pro plan): if you upgrade, your email is shared with our payment processor Stripe to create a customer and subscription; we store the resulting Stripe customer and subscription identifiers. We never receive or store your card details.

Information collected automatically:

• Webflow site IDs and site names associated with your installations.
• An OAuth access token, stored encrypted at rest, required to call the Webflow API on your behalf.
• Standard server log data including IP addresses, browser type, and pages visited, retained for up to 30 days.

Information collected from your site visitors:

• Email capture: the email address a visitor types into a popup’s email-capture form (only when you have enabled that feature). No names, browsing history, advertising cookies, fingerprinting, or cross-site tracking are collected.
• Impression & click analytics: when a popup or bar is shown, or its call-to-action is clicked, the injected script sends the popup/bar ID and the event type to the PopFlow API (/api/track) so you can see views, clicks, and conversion rate. The visitor’s IP address is processed transiently for rate-limiting / abuse-prevention and is not stored against the analytics event.
• Where it is sent: captured emails are transmitted over HTTPS to the PopFlow API (/api/leads), stored in our database associated with your installation, and — if you enable lead notifications — emailed to you, the site owner, via our email provider Resend (see Sub-processors below). Visitor data is never sold or shared with advertisers or other third parties.
• Retention & deletion: captured emails are retained until deleted. You can export your leads at any time, and deleting a popup removes all of its captured emails. Disconnecting PopFlow (see Data Retention) deletes all captured emails for that site within 30 days. To erase an individual visitor’s email, email us at hello@popflow.dev.
• Your responsibility: you are responsible for obtaining any appropriate consent from your site visitors before collecting their data.

We use the information we collect to:

• Provide, operate, and maintain the PopFlow Service.
• Authenticate with the Webflow API to inject and manage custom code on your behalf.
• Store and serve your popup configurations to your Webflow site visitors.
• Communicate with you about your account, including important service updates.
• Improve and develop new features for the Service.
• Comply with legal obligations.

We do not sell, trade, or rent your personal information to third parties.

Your data is stored in a PostgreSQL database hosted by Neon (serverless Postgres) and our application runs on Vercel infrastructure. Both services are SOC 2 compliant.

We implement industry-standard security measures to protect your data. OAuth tokens are stored encrypted at rest. However, no method of transmission over the internet or electronic storage is 100% secure.

We use the following third-party services to operate PopFlow:

• Webflow — We use the Webflow OAuth 2.0 API to read your site information and inject custom scripts. Your use of Webflow is also governed by Webflow’s Privacy Policy.
• Vercel — Hosts our application. See Vercel’s Privacy Policy.
• Neon — Hosts our database. See Neon’s Privacy Policy.
• Resend — Sends email notifications to you (the site owner) when a visitor submits their email through one of your popups. The lead’s email address is included in that notification. See Resend’s Privacy Policy.
• Stripe — Processes Pro-plan payments. If you upgrade, your email is shared with Stripe to create a customer and manage your subscription; card details are entered directly with Stripe and never reach PopFlow. See Stripe’s Privacy Policy.

The script PopFlow injects into your Webflow site does not set cookies and does not track visitors across other websites or for advertising. It does use your visitors’ browser local storage and session storage for a single purpose: to remember which popups or announcement bars a visitor has already seen, so we can respect your “show frequency” setting (for example, “once per session” or “once per week”). This data stays in the visitor’s browser and is not sent to us.

Our dashboard application does not use advertising or tracking cookies.

We retain your account data for as long as your installation is active. When you use the in-app “Disconnect site” action, or email us a deletion request, we delete your installation data, popup and bar configurations, and all associated captured email addresses within 30 days. Note: removing the app from Webflow’s own Apps panel revokes our access but does not automatically erase data already stored — use “Disconnect site” in the PopFlow dashboard, or contact us, to have it deleted.

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the data we hold about you.
• Rectification — Request correction of inaccurate data.
• Erasure — Request deletion of your data.
• Portability — Request your data in a portable format.
• Objection — Object to certain types of processing.

To exercise any of these rights, email us at hello@popflow.dev. We will respond within 30 days.

PopFlow is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us at hello@popflow.dev.

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the “Last updated” date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, please contact us:

• Email: hello@popflow.dev
• Website: popflow.dev