Privacy policyPrivacy policy

Who we are

Porchlight is a small web agency based in Alberta, run as a sole proprietorship. We build websites for local businesses and keep them running. In this policy, “we” and “us” mean Porchlight.

This policy explains how we handle personal information on our website, when you contact us, and when you’re a client. Alberta’s Personal Information Protection Act (PIPA) applies to most of what we do. Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) applies when personal information crosses a provincial or national border in the course of our business, for example when we work with a business in another province. We follow both.

Who to contact about privacy

Our Privacy Officer is responsible for how we handle personal information. They answer questions about this policy, including how our service providers outside Canada handle personal information, and they handle requests and complaints. Email contact@porchlightdev.com.

What we collect

When you ask for a demo or contact us: what you’d like (a demo, to get started, or an answer to a question), your name and business name, your type of business, your phone number or email (or both), your website or social page if you share it, anything you write in your message, and the template you picked, if you chose one from our samples.

When you request a change to your site: your name, business name and email, your phone number if you give it, your website address, what kind of change it is and which page, your instructions, any photos or files you add, and the date you need it by, if there is one.

When you email us: your email address, your message and anything you attach.

How our forms work: we don’t keep your form answers in a database. Each request, with any files you add, becomes one email to us. Our host, Cloudflare, sends it to our inbox at Microsoft Outlook, and we keep it there like any other email. The email also shows when your request arrived and a random request number.

When you’re a client: your contact and billing details, your signed agreement and payment history, the content for your site (like your logo, photos, text, hours, services or menu, and links), access to accounts you give us so we can connect your site (like your domain account), and your change requests and anything you attach to them.

If you pay by card, our payment processor, Stripe, handles the payment. We never see or store your full card number.

When we build a demo for a business: we may use public information about the business, like its name, hours, services, photos and reviews from its Google Business Profile, website or social pages. When a demo shows reviews, it names each reviewer by first name and last initial only. We show a demo only to that business.

Businesses we might contact: to find businesses that might want a website, we keep a list of local businesses made from public sources, such as business licence lists and public map data. It holds public business details, like the business’s name, address, phone number, website and type of business. We use it only to decide which businesses to contact, in person or by phone. If you’d rather we didn’t contact your business, tell us, and we’ll make a note and stop.

When you visit our website:

• Our website doesn’t set cookies, and it has no advertising or social media trackers. Our host, Cloudflare, may set a security cookie in some cases, for example to check that a visitor isn’t a bot. It’s needed to keep the site safe and isn’t used for tracking or advertising.
• Apart from Cloudflare’s analytics script, our pages load nothing from other companies. Fonts and images come from our own site, and there are no embedded maps, videos or social media buttons.
• We count visits with Cloudflare Web Analytics. A small script from Cloudflare records the page you viewed, the site that sent you there, your browser, operating system and device type, your country, and how fast the page loaded. It works out your country from your connection, for these totals only. It doesn’t use cookies or other storage in your browser, it doesn’t identify you, fingerprint you or build a profile of you, and it doesn’t follow you across other websites. We see only totals, like visits a day or the most-viewed pages. Cloudflare processes this information in the United States.
• Cloudflare processes technical information, such as your IP address and browser type, to deliver our pages and protect the site from attacks. We don’t receive this information, apart from the security reports and overall traffic counts Cloudflare shows us, like attacks it blocked.
• A few settings are saved in your own browser: whether you paused animations, whether you closed an announcement, and on our sample sites, choices like a menu size. They stay on your device, we never receive them, and you can clear them in your browser’s settings.
• When you send a form, our form service writes one short log line: a random request number and whether it worked, or which question needed fixing. It never contains what you typed. Cloudflare deletes these lines after a few days. Cloudflare’s automatic log of each request to our forms is switched off.
• Our website check runs entirely in your browser. We never receive your answers or your score.
• Our sample sites are for made-up businesses and collect nothing. Their booking, ordering and contact buttons only show a note.

How we use it

• To reply to you, and to build and show you your demo
• To build, run and support your website, and to handle your change requests
• To bill you and keep business and tax records
• To send you service messages about your account, like invoices, confirmations and notices
• To decide which local businesses to contact, using public business details
• To count visits to our website and see which pages are used, in totals only
• To keep our website and systems secure
• To meet our legal obligations

We don’t use your information for anything else without asking you first, unless the law requires or allows it.

Your consent

When you send us a form or an email, you agree to us using your information to answer it, as this policy describes. When you become a client, you agree to us using your information to provide your service. You can withdraw your consent at any time by emailing us. If you’re a client, we may still need some information to provide your service and to meet legal and tax rules, and we’ll tell you if withdrawing your consent affects your service.

Emails

• We email you to reply to a request or message you’ve sent us, and, if you’re a client, about your service: confirmations, invoices, receipts and notices.
• If you give us a phone number, we may call or text it to reply to you.

Who we share it with

We don’t sell or rent personal information. We share it only with service providers that help us run our business, and only what they need:

• Cloudflare, Inc. hosts our website, protects it from attacks, and delivers our form requests and emails to our inbox. Cloudflare is based in the United States and runs data centres around the world, including in Canada.
• Cloudflare Web Analytics counts visits to our website, as described above. Cloudflare processes this information in the United States.
• Microsoft (Outlook.com) provides our email inbox, where your requests and emails are kept. Microsoft is based in the United States and stores email in its data centres there and in other countries.
• Stripe processes card payments and keeps the billing records for them. Stripe stores this information mainly in the United States.

Each of them also has its own privacy policy, but we stay responsible for the information we give them.

These are all the service providers outside Canada that handle personal information for us today. Before we use any other one for personal information, for example to store client websites and their backups, we’ll add it to this list, with its country and what it does, and change the date at the top of this policy.

We may also share information with a bookkeeper or accountant who helps with our taxes, with government bodies like the Canada Revenue Agency when the law requires it, and with others when the law requires it or to protect our rights, for example in a legal dispute. If our business is sold, merged or incorporated, your information may go to the new owner or company, which must keep protecting it as this policy says.

Booking, ordering and payment platforms you choose for your own site (like OpenTable, Square or Fresha) have their own privacy policies.

Information stored outside Canada

The service providers listed above, including Cloudflare Web Analytics, store or process information outside Canada, mainly in the United States, and in other countries where they have data centres, for the purposes listed above. While it’s there, the laws of that country apply, and its courts, police and other authorities may be able to get access to it.

To learn more about how our service providers outside Canada handle personal information, ask our Privacy Officer at contact@porchlightdev.com.

How long we keep it

• Requests and messages you send us, with any attachments: only as long as we reasonably need them to respond to you and for our business and legal purposes, then deleted. Emails that are part of your agreement or billing records, like a quote you accepted, are kept as those records.
• Your signed agreement and billing records: 6 years after the end of the tax year they relate to, as the Canada Revenue Agency requires.
• Your website’s content and files: while you’re a client, and after that only as long as we reasonably need them, for example to send them to you if you ask.
• Logins you give us: until we no longer need them, and no later than the end of your service.
• A demo for a business that doesn’t sign up: until the business tells us it isn’t interested, or until we no longer need it.
• Our list of local businesses: while we use it, updated from public sources. If you’ve asked us not to contact your business, we keep that note so we can respect it.
• Backups of client websites can hold copies a little longer. They’re deleted on a regular schedule.

When we no longer need information, we delete it.

How we protect it

We use reasonable safeguards, suited to a business our size and to how sensitive the information is, to protect it from loss, theft and use or access by anyone who shouldn’t have it. We also choose reputable service providers.

No system is perfectly secure, but we work hard to protect your information. If a breach creates a real risk of significant harm to you, we’ll tell you and the privacy commissioner, as the law requires.

Your choices and rights

You can ask to see the personal information we have about you, how we’ve used it and who we’ve shared it with. You can also ask us to correct it, or withdraw your consent. Email contact@porchlightdev.com. We’ll reply within 30 days, at no charge, and we may need to confirm who you are first. If we can’t give you something, we’ll tell you why.

If you’re not happy with our answer, you can contact the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca). For information that crossed a provincial or national border, you can also contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Websites we build for clients

When we build and host a website for a business, that business is responsible for the personal information its visitors send through the site, like contact form messages. We handle that information only to run the site for them, and we don’t use it for anything else. Questions about a client’s website should go to that business.

Children

Our services are for businesses. We don’t knowingly collect information from children.

Changes to this policy

Before we change how we handle personal information, for example by adding a new tool, we’ll update this policy, post the new version here and change the date at the top. If a change is significant, we’ll also tell our clients by email.

Contact us