This policy explains what personal data Porchlight collects, why, who we share it with and the choices you have. It covers the people who use Porchlight, the visitors to our website, and the people who message, comment on or buy from the Pages and accounts our users connect. We do not sell personal data.
1. Who is responsible
Porchlight is built and run by Pylogix, 1717 Saint James Place #628, Houston, TX 77056, United States, with a second office at 346 Kensington High Street, London W14 8NS, United Kingdom.
Pylogix is the controller for account data and for data about visitors to our website. When a business connects its Facebook Page or Instagram account, that business is the controller of the data about its subscribers, commenters, contacts and customers, and we process that data on its behalf.
2. What we collect
If you have an account
Your name, email address and password when you sign up. We store passwords as a secure hash, never as plain text. If you sign in with Google or Facebook, we receive your name, email address and account ID from them. We also keep your settings, team members, plan and the content you create.
From the Pages and accounts you connect
When you connect Facebook Pages or Instagram business accounts, Meta gives us access tokens and the data those permissions allow, such as Page details, posts, comments and messages. We use it only to provide the features you switch on.
About people who interact with our users' Pages
When someone messages, comments on or buys from a connected Page or account, we process what Meta shares with the business, such as their name, profile picture, page-scoped ID, the messages and comments they send, and the options they tap in a bot. If they order from a Messenger store or fill in a form, we store what they enter, such as their name, address, phone number or email address, for that business.
Contacts you upload
If you upload contacts for email or SMS campaigns, we store the names, email addresses and phone numbers you provide.
Security and usage data
We record IP addresses, browser details and sign-in times to protect accounts and investigate abuse.
3. How we use it
- to run your account and the bots, replies, posts, broadcasts and store you set up
- to send messages, emails and texts on your behalf, following your settings
- to show you reports about your subscribers and campaigns
- to send service emails, such as account confirmation, password resets and important notices
- to keep the service secure, stop spam and abuse, and enforce our Terms of Service
- to understand how people use our own website, so we can improve it
- to meet our legal obligations and the requirements of the platforms we connect to
We do not sell personal data, and we do not use data from our users' Pages or customers for our own marketing.
4. Legal bases (UK and EU)
If you are in the United Kingdom or the European Union, we rely on these legal bases: contract, to provide the service to account holders. Legitimate interests, to keep the service secure, prevent abuse and improve our website. Consent, where the law requires it for cookies or similar technology. Legal obligation, where we must keep or share data by law. For people who interact with our users' Pages, the business that owns the Page decides the legal basis.
5. Cookies
We use a session cookie to keep you signed in and similar cookies that the service needs to work. On our website we use Microsoft Clarity to see how people use it, for example which pages they open and where they click. Clarity uses cookies and Microsoft processes this data under its own privacy terms. The promo video only loads from YouTube's privacy-enhanced domain when you press play. You can block or delete cookies in your browser, but you will not be able to sign in without the ones the service needs.
6. Who we share data with
We only share personal data with companies that help us run Porchlight, and only as much as they need:
- Meta, because the service works through the Facebook and Instagram APIs, and for Facebook sign-in.
- Google, for Google sign-in and Google Fonts on our website, and YouTube when you play the promo video.
- Hosting and email. Our servers run on infrastructure we manage with our hosting provider, and service emails go through our mail server.
- Email and SMS providers you connect, which receive the messages and contact details you send through them.
- Cloudflare, which sits in front of our website to keep it fast and protect it from attacks.
- Microsoft, which provides Clarity analytics for our website.
- The business you interact with, which can see your messages, orders and form entries in its dashboard.
We may also share data when the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of the business, in which case this policy continues to apply.
7. International transfers
Pylogix works from the United States and the United Kingdom, and our providers may process data in other countries. When UK or EU law requires it, we use recognized safeguards for these transfers, such as standard contractual clauses.
8. How long we keep data
- Account data and content are kept while your account is open and deleted when it is closed. Copies in backups are overwritten on a regular cycle.
- Data from a connected Page or account is kept until you delete it, disconnect that Page or account, or close your account.
- Security records are kept as long as they are needed to protect accounts and investigate abuse.
9. Deleting your data
To remove Porchlight's access to your Facebook data, open Facebook, go to Settings, then Apps and Websites, find Porchlight or Pylogix in the list and remove it. To delete your account and the data we hold about you, send us a message through our contact page with the email address on your account. We will confirm your identity and delete the data within 30 days, apart from anything we must keep by law.
If you messaged or ordered from a business that uses Porchlight, contact that business first. If you cannot reach them, contact us and we will help.
10. Your rights
You can ask us to give you a copy of your personal data, correct or delete it, limit or stop how we use it, send it to you in a format you can move elsewhere, or withdraw consent you have given.
If you live in California or another US state with a privacy law, you have the right to know what we collect, to correct it, to delete it and to opt out of its sale or sharing. We do not sell personal data or share it for cross-context behavioral advertising, and we will never treat you differently for using your rights.
To make a request, contact us through our contact page. We may need to confirm your identity first. In the UK you can also complain to the Information Commissioner's Office, and in the EU to your local data protection authority.
11. Children
Porchlight accounts are for adults running businesses. We do not knowingly collect data from children under 13. If you believe a child under 13 has given us personal data, contact us and we will delete it.
12. How we protect data
We use encrypted connections, store passwords as secure hashes, keep platform access tokens on our servers and never show them publicly, and limit who can access our systems. No online service can promise perfect security, so please use a strong, unique password.
13. Changes to this policy
We will update this policy when our service or the law changes. If a change is significant, we will tell account holders by email or in the app before it takes effect.
14. Contact us
Questions about privacy or your data? Send us a message through our contact page and a person will reply.