Privacy policy

Last updated October 13, 2026

Draft. This page still has details to fill in and hasn't been reviewed by a lawyer. It isn't in force yet.

Porchlight is run by Porchlight Local Search. It analyzes what search engines and AI assistants already show publicly about a local business, and emails the results. This page explains what we collect, why, and what you can ask us to do about it. It covers porchlightscore.com and the reports we produce.

The short version

For a free report, the only personal information we ask you for is your email address. If you buy a plan, Stripe handles your payment.
We use it to confirm your request, send your report link, and (only if you tick the box) send occasional tips.
Everything else in a report comes from public sources: Google, our data vendors, the U.S. Census and the business's own website.
We don't sell your information or share it for advertising.
You can ask us to delete your information at any time.

What we collect

Information you give us

Your email address, when you request a report, and whether you opted in to marketing email.
The business you pick: its Google listing, plus its industry or website address when Google doesn't tell us.
Payment details, if you buy a plan. You enter your card and billing details on Stripe's checkout page, so we never see or store your full card number. We keep your Stripe customer and subscription references, your plans and locations, and a record of paid changes, so we can run your account.

Information we collect automatically

Your IP address, which we store only as an irreversible hash. We use it to rate-limit requests, because each report costs us money to produce. Cloudflare, which serves the site, keeps its own short-lived request logs.
Anti-bot checks. We use Cloudflare Turnstile on the report form. It may set a cookie needed to tell people from bots, and it does not track you across sites.
Browser storage. We store a short-lived Google Places session identifier in your browser so searching costs less. We don't use advertising or analytics cookies.

Information about the business in the report

All of this is already public. For the business you ask about, and the competitors appearing near it, we collect:

Its Google Business Profile: name, address, phone, categories, hours, description, photo counts, rating and review counts.
Where it appears in Google's local map results across a grid of points around its service area.
Its public Google reviews, including the review text, star rating, date, the reviewer's public display name and any owner reply. We use these to measure how fast reviews arrive and what customers mention. See "Reviews and reviewers" below.
Pages from the business's own website, fetched the way any visitor or search engine would.
Answers that AI assistants give to buying questions about that type of business in that area, so the report can show who they recommend.
Neighborhood statistics from the U.S. Census, which are aggregated and not about any individual.

If you have a paid plan

Daily checks of your listing. Once a day we fetch your Google profile and its newest reviews, so we can spot changes and new reviews. We keep what we fetch, including review text and reviewers' display names, as raw vendor data.
Review alerts. When new reviews arrive, the email we send you includes the review text, the reviewer's display name and, when there is one, a suggested reply.
Reply drafts. Each new review that hasn't been answered goes into your replies inbox with its text and the reviewer's display name, so you can see the review a draft answers. To write a draft, we send the review, your business's name, trade and phone number, and any note you add when asking for a rewrite, to Anthropic.

Reviews and reviewers

Reports include public reviews and the display names their authors chose to show on Google. We use them only to analyze the business's review performance for that report and, for a business on a paid plan, to alert its owner to new reviews and draft replies the owner can post. We don't build profiles of reviewers, contact them, or use their information for anything else. If you are a reviewer and want your review removed from our copy of a report, email us and we'll remove it. Removing it from Google itself is something only you or Google can do.

Why we use your information

To confirm you asked for the report, so we don't spend money producing reports for fake addresses.
To deliver the report and email you its link.
To prevent abuse and keep our data costs under control.
To improve the product, by looking at which checks people run and what they cost us.
To run a paid plan: billing, receipts, daily checks, review alerts, reply drafts, and the account emails it needs.
To send tips, only if you opted in. Every one of those emails has an unsubscribe link.

Who we share it with

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We do use these providers:

Cloudflare: hosting, storage, bot protection.
Google Places: business search and profile details.
DataForSEO: map rankings, profile details, reviews and AI assistant answers.
Anthropic: the model that writes the report's explanations and reply drafts. Your email address is never sent to it.
Resend: sends our email, and therefore handles your email address.
Stripe: processes payments for paid plans. It receives your email address and payment details, and handles them under its own privacy policy.

We may also disclose information if the law requires it, or to protect our rights or someone's safety. If the business is ever sold, information may transfer with it, and this policy would continue to apply until you're told otherwise.

How long we keep it

Your email address and report history: until you ask us to delete them.
Confirmation links: they expire 24 hours after they're sent, and we only ever store a hash of them.
Reports: kept so your link keeps working, and deleted on request.
Raw vendor data behind a report or a daily check, including review text and reviewers' display names: deleted within 12 months.
Your replies inbox, with review text and reviewers' display names: each review is deleted 90 days after it arrives, or 30 days after you close it, whichever comes first.
Cached lookups: between one hour and seven days, depending on the lookup.

Your choices

Unsubscribe from tips with the link in any of those emails. We'll still send the emails needed to deliver a report you asked for.
Ask us for a copy of what we hold about you, or ask us to correct or delete it, by emailing james@porchlightscore.com.
California residents may request the categories and specific pieces of personal information we've collected, ask us to delete or correct it, and are entitled not to be treated differently for asking. We don't sell or share personal information as those terms are used in the CCPA, so there's nothing to opt out of.

Security

Traffic is encrypted in transit. Confirmation links and IP addresses are stored as hashes, not in their original form. No service can promise perfect security, but we keep what we collect small on purpose.

Children

This is a tool for businesses. It isn't directed at children, and we don't knowingly collect information from anyone under 13.

Where we operate

We serve businesses in the United States, and information is processed there and in other countries where our providers operate. We're not set up to handle requests under the GDPR or other non-US privacy laws.

Changes

If we change this page we'll update the date at the top. For material changes affecting people who have given us an email address, we'll say so by email. See also our terms of service.

Contact

Questions about this page: james@porchlightscore.com (Porchlight Local Search).