Privacy Policy | Porchlight

Porchlight is run by Assertive Agency ("we", "us"). This policy explains what we collect when you visit porchlighthub.com or use the Porchlight app, why we collect it, who we share it with and the choices you have. Questions go to hello@porchlighthub.com.

What we collect

Account details: your name, email, and if you give them, phone number, business name and website. If you sign in with Google we receive your name, email and a Google account ID. We never see your Google password.
Your password is stored only as a one-way scrambled value (scrypt hash). Nobody at Porchlight can read it.
Your businesses: the website addresses you add and what we read from their public pages (text, services, contact details shown on the site, logo, colors and fonts), plus the brand profiles, posts, edits, schedules and keep or pass choices you make.
Billing: your plan, payment status and invoices. Card details are entered on Stripe's secure page and stay with Stripe. We never see or store your full card number.
Usage and security data: sign-in times, IP address, browser type, pages used in the app and how many posts you have made this month. We use it to run your plan, keep accounts safe and stop abuse.
Messages you send us through the contact form or by email.
Cookies: see our Cookie Policy.

How we use it

To create and run your account and sign you in safely.
To read your website and write and design your posts.
To publish the posts you approve, on the dates you choose, if you connect social accounts.
To take payment and manage your plan.
To send account emails such as confirmations, password resets and receipts, and, only if you agreed, tips and product news. You can stop those at any time.
To keep the service secure, fix problems and improve it. Lessons we learn from keep and pass choices are stored as anonymous counts only, with no business names, post text or personal details.

We do not sell your personal information, and we do not use your posts or website content to advertise other businesses. US residents, see your US privacy rights below.

Legal basis (UK and EU visitors)

We use your information to provide the service you signed up for (contract), to keep it secure and improve it (legitimate interests), to meet legal duties such as tax records (legal obligation), and for marketing emails and non-essential cookies only with your consent.

Who we share it with

We use a small number of trusted providers who process data for us under contract:

Anthropic (Claude) to understand your website and write posts.
Stripe to take payments and manage subscriptions.
Google if you choose to sign in with Google.
Upload-Post to publish approved posts to the social accounts you connect.
Pexels for free stock photos in image posts.
Google Analytics to understand how the website is used. Analytics cookies are only set if you accept them in the cookie banner.
Our hosting and email providers, which store our servers, database and mailboxes.

We may also share information if the law requires it, or to protect our users and the service.

Connected social accounts

If you connect Facebook, Instagram, LinkedIn or X, we only use that access to publish posts you have approved. You can disconnect at any time from the Integrations page in the studio or from the platform itself.

How long we keep it

We keep your account and businesses while your account is open. When you delete your account from the Account page, your profile, businesses, posts and sessions are deleted straight away. Billing records are kept for as long as tax law requires. Security logs are kept for up to 12 months.

Your rights (everyone)

You can see and correct your details on the Account page, download your posts from the studio, and delete your account at any time. You can also ask us for a copy of your data, to correct or delete it, to limit how we use it or to object to it, by emailing hello@porchlighthub.com. UK and EU residents can also complain to their data protection authority.

Your US privacy rights

This section applies if you live in the United States, including California (CCPA, as amended by the CPRA) and states with similar laws such as Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others.

What we collect and why

In the last 12 months we have collected these categories of personal information, for the purposes listed in "How we use it" above:

Identifiers: name, email address, phone number if you give it, IP address and account ID.
Commercial information: your plan, payments and invoices.
Internet or network activity: sign-in times, browser type, pages used and cookie data.
Professional information: your business name, website and the public details we read from it.
Account login details: your email and password, used only to sign you in. Passwords are stored as a one-way hash.

We get this information from you, from the website you give us, from Google if you sign in with Google, and from the providers listed under "Who we share it with". We share it with those providers only to run the service, under contracts that limit how they can use it. We keep it for the periods set out in "How long we keep it". We do not collect sensitive personal information beyond the login details above, and we do not use any information to make decisions about you that have legal or similarly significant effects.

Selling and sharing

We do not sell personal information for money, and we have not done so in the last 12 months. We do not knowingly sell or share the information of anyone under 16.

Our own ad measurement cookies for Google and Meta load only if you turn on marketing cookies. Some state laws call this "sharing" for targeted advertising. You can opt out at any time in Cookie settings, and we treat a Global Privacy Control signal from your browser as an opt-out of sale and sharing, so marketing cookies stay off.

Your rights

Know and access: ask what personal information we hold about you, where it came from, why we use it and who we share it with, and get a copy.
Correct: ask us to fix information that is wrong.
Delete: ask us to delete your information, or delete your account yourself from the Account page.
Opt out: of sale, sharing for targeted advertising and profiling, as described above.
Portability: get your information in a format you can take elsewhere.
No discrimination: we will not charge you more or give you a worse service for using these rights.

How to make a request

Email hello@porchlighthub.com with the subject "US privacy request". To protect your account we will confirm the request from the email address on your account. You can use an authorized agent, who will need your signed permission, and we may still ask you to confirm it with us. We reply within 45 days. If we need more time, up to another 45 days, we will tell you why.

If we turn down your request, you can appeal by replying to our answer with the word "Appeal". We will respond within 60 days and explain our decision. If you are still not happy, you can contact your state attorney general.

California residents can also ask, once a year, whether we have shared personal information with others for their direct marketing. We have not.

Emails

Every marketing email we send has an unsubscribe link, and we act on it straight away. Account emails such as password resets and receipts still arrive, because the service needs them.

Security

All traffic is encrypted. Passwords are hashed, sessions are protected cookies, admin access needs a second step, and sign-in attempts and costly actions are rate limited. No system is perfect, but we work to keep your data safe and will tell you if something goes wrong that affects you.

International transfers

Some providers process data outside your country, including in the United States. Where that happens we rely on standard contractual clauses or similar safeguards.

Children

Porchlight is a business tool and is not meant for anyone under 16. It is not directed at children under 13, and we do not knowingly collect their information. If you think a child has given us information, email us and we will delete it.

Changes

If we change this policy we will update the date at the top. If the change is significant, we will tell you by email or in the app.