Privacy policy
What Porchlight stores, why we keep it, who helps us process it, and how you stay in control of it.
The short version. We keep what we need to run Porchlight for you and nothing more. The chats on your website belong to you, and we handle them only on your instructions. We never sell data or show ads. Payments go through Paddle, so we never see your full card number.
Who we are
Porchlight is a live chat, AI answer and help desk service at porchlight.1001toolbox.com. It is run by 1001 Toolbox, operated by Ehtesham Ali, and is one of the tools at 1001toolbox.com. In this policy “we” and “us” mean 1001 Toolbox. You can reach us about anything here at hello@1001toolbox.com.
Two kinds of data, two roles
- Your account. When you sign up and run a workspace, we decide how that data is used, so we are its controller.
- What you and your visitors put into Porchlight. Chats, tickets, contacts, help-centre articles and files belong to the business that owns the workspace. That business is the controller; we are its processor and handle the data only to provide Porchlight to it. If you chatted with a website that uses Porchlight, the website owner is the right first contact for your data (see “Your rights” below).
What we collect
Account and workspace data
- Your name, email address and password. We store the password only as an Argon2 hash, never in readable form.
- Sign-in security: two-factor secrets and single sign-on settings (stored encrypted), passkeys, and a record of active sessions with a hashed IP address and the browser that signed in.
- If you sign in with Google, Microsoft or your company’s SSO, the name and email address that provider shares with us.
- Your workspace: its name, sites, team members and their roles, settings, and an audit log of admin changes.
- Billing details you give us, such as a billing email, address and tax ID, plus your plan and invoice history.
Data in your workspace
- Chat transcripts and the files sent in chats, tickets, and the emails sent to your Porchlight mailboxes.
- Contacts and the notes and attributes your team adds to them.
- Help-centre articles, saved replies, and the pages or documents you add as sources for AI answers.
- Call records, if you use voice and video.
Visitors to websites that use Porchlight
When someone opens the chat widget on a customer’s website, Porchlight stores:
- A random visitor ID, saved in the visitor’s browser so a returning visitor sees their earlier conversation.
- The messages they send, and their name, email address or phone number if they choose to give them.
- Approximate location (country, region and city) worked out from the IP address at the time, plus browser, operating system, device type, language and time zone.
- The pages viewed during the visit, the referring page and campaign tags.
- A one-way hash of the IP address, used to limit abuse. We never store a visitor’s raw IP address. Card numbers typed into chat are masked before they are saved.
Our public website
On public pages such as this one we may use Google Analytics to count visits and see which pages are useful. It is not used inside the dashboard or in the chat widget. See “Cookies and browser storage” below.
How we use it
- To run Porchlight: deliver messages, route chats, send notifications, show reports and keep your workspace working.
- To keep accounts and the service secure, and to prevent spam and abuse.
- To send service emails, such as sign-in codes, invitations, receipts and important changes. We do not send marketing email without your consent.
- To answer support requests.
- To understand how Porchlight is used in aggregate, so we can improve it.
We do not sell personal data, use it for advertising, or train AI models on your workspace data.
AI answers (Lamplighter)
AI answers are off until a workspace turns them on for a site, and a workspace can switch AI off entirely. When they are on, the visitor’s question, the recent conversation and the most relevant passages from the workspace’s own sources are sent to Anthropic (the Claude models) to write a reply. Text from the sources you add is sent to Voyage AI to build the search index used to find those passages. Both process the text only to return a result to us. Anthropic’s commercial terms do not allow it to train its models on this data.
Who we share it with
We share data only with the services that help us run Porchlight, and only what each one needs:
- Paddle handles checkout, payments, invoices and refunds as our Merchant of Record. Paddle processes your payment details; we never see or store your full card number. See Paddle’s privacy notice.
- Email delivery through Resend, Postmark or an SMTP provider, to send the emails above and the replies your team sends from Porchlight.
- Hosting and storage: Porchlight runs on our own server, rented from a hosting provider, with files kept in S3-compatible object storage.
- Anthropic and Voyage AI, only for workspaces that use AI answers.
- Google Analytics, on public pages only.
- Have I Been Pwned, to warn you if a password has appeared in a known breach. Only the first five characters of a hash of the password leave our server.
- Google or Microsoft, only if you choose to sign in with them.
We may also disclose data if the law requires it, or to protect our users or the service from fraud or abuse. Some of these providers process data outside your country, including in the United States and the European Union. We rely on their contractual safeguards for those transfers.
Cookies and browser storage
| Name | Where | What it does | How long |
|---|---|---|---|
pl_rt | Cookie, dashboard | Keeps you signed in. It is HttpOnly and only sent to the sign-in API. | Until you sign out or the session ends (30 days at most) |
pl:vid:<site> | Local storage, on websites using the widget | The widget’s random visitor ID, so a returning visitor sees their conversation. | Until the visitor clears site data |
pl-landing-theme | Local storage, this website | Remembers whether you chose the light or dark theme. | Until you clear site data |
_ga, _ga_<id> | Cookies, public pages | Google Analytics: counts visits and pages viewed. | Up to 2 years |
The dashboard also keeps small preferences in your browser, such as which device this is for notifications. You can block or delete Google Analytics cookies in your browser, or install Google’s opt-out add-on. Porchlight works without them.
How long we keep it
- Account data is kept while your account exists.
- Conversation history is kept for your plan’s history period (1 year on Free, 3 years on Pro, as long as you choose on Business), or for less time if you set a shorter retention period in your workspace.
- Deleting a workspace gives you 14 days to change your mind; after that its data is permanently deleted.
- Visitor data can be erased at any time by the workspace, including on a visitor’s request.
- Backups are kept for 14 days and then overwritten.
- Billing records are kept by Paddle and by us for as long as tax and accounting law requires.
Security
All traffic is encrypted with TLS. Passwords are hashed, sign-in and integration secrets are encrypted at rest, IP addresses are hashed, and access to production systems is limited to the operator. Two-factor sign-in is available to every user and can be required for a whole workspace. No system is perfectly secure; if a breach affects your data, we will tell you without undue delay.
Your rights
You can ask us to access, correct, delete or export your personal data, and you can object to or ask us to limit how we use it. Much of this is self-service: edit your profile in the dashboard, export or delete workspace data from its settings, or delete your account. For anything else, email hello@1001toolbox.com and we will reply within 30 days.
If you chatted with a website that uses Porchlight, that website owner controls your data. Use the “Your data” option in their chat widget or contact them, and we will help them answer you. If you contact us directly, we will pass your request to them. You can also complain to the data protection authority where you live.
Children
Porchlight is a business tool and is not meant for children under 16. We do not knowingly collect their personal data. If you think a child has given us data, email us and we will delete it.
Changes to this policy
We will update this page when our practices change and change the date at the top. If a change is significant, we will email workspace owners before it takes effect.
Contact
1001 Toolbox, operated by Ehtesham Ali. Email hello@1001toolbox.com.