Privacy Policy.

For people who want the gist:

• What we collect from visitors: website analytics (page views, referrer, approximate location), and anything you choose to send us by email. porchops.com has no form: accounts are created at app.porchops.com.
• What we collect from Customers: account info, billing info, data you connect from third-party services, data you input into the Service.
• What we don't do: sell your data for money, use your data to train general-purpose AI models, record replays of your visits, or set an advertising cookie where consent is required before you give it, or anywhere after you opt out.
• Cookies and advertising: porchops.com runs website analytics, a marketing CRM (HubSpot) and advertising tags for Google, Meta and LinkedIn, always behind your consent where the law requires it and behind an opt-out everywhere else. The Cookie Policy lists every one, and says which are in use today.
• Your privacy choices: opt out of advertising cookies at any time with a Global Privacy Control browser signal, the "Your Privacy Choices" control in the footer, or an email. See Your Privacy Choices.
• Where your data goes: to the third-party sub-processors listed in Section 9, including Anthropic for AI processing.
• Your rights: access, correction, deletion, export, restriction, objection, and (in California) opt-out of automated decision-making; specifics depend on your jurisdiction.
• Sub-processor changes: we provide at least 30 days' advance notice.
• Breach notification: without undue delay, typically within 72 hours of becoming aware (where you are a Customer affected by a breach).
• How to reach us: [email protected]

If you want the details, the rest of this policy explains everything.

This section provides the "Notice at Collection" required by the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA") effective January 1, 2026.

We do not collect:

• Sensitive personal information as defined in CCPA § 1798.140(ae) without your specific consent
• Biometric information
• Genetic information
• Information about a known child under 13 (or under 16 in jurisdictions with that digital consent age)

We do not sell personal information for money. When advertising cookies from Google, Meta or LinkedIn are set on porchops.com, the information they carry is "shared" for cross-context behavioral advertising as the CCPA defines it. You can opt out of that at any time, and we honor the Global Privacy Control browser signal as a valid opt-out: Your Privacy Choices. Section 12.8 says the same thing in the language of your rights.

porchops.com has no form. Cookies are the only way it collects personal information, so this notice is reached the same way that collection is disclosed: the Privacy policy and Cookie policy links in the footer of every page, and the consent banner that asks before a non-essential cookie is set.

For purposes of European data protection law (GDPR, UK GDPR, Swiss FADP):

• When you visit our website or sign up as a Customer, Porchops is the data controller of your personal information.
• When you use the Service to process information about your customers, prospects, or other third parties (your "End Users"), you are the data controller of that information and Porchops is the data processor acting on your behalf. We will execute a Data Processing Addendum (DPA) at your request, which is required if you process Personal Data of EU/UK/Swiss residents.

For purposes of California data protection law (CCPA/CPRA):

• Porchops is a business with respect to information we collect about visitors and Customers.
• Porchops acts as a service provider to our Customers with respect to End User information processed through the Service.

For purposes of other U.S. state laws (Colorado Privacy Act, Connecticut Data Privacy Act, Virginia Consumer Data Protection Act, Texas Data Privacy and Security Act, Florida Digital Bill of Rights, etc.), our roles map analogously: we are a controller for our own collection and a processor for End User Data we handle on behalf of Customers.

4.1 Information You Provide Directly

When you visit porchops.com without creating an account:

• Nothing you type. There is no form anywhere on porchops.com, so we collect no name and no email address here; an account is created at app.porchops.com
• Any information you choose to share via communications

When you create an account:

• Name
• Email address
• Authentication credentials (handled by Clerk, our auth provider)
• Profile information you choose to provide
• Workspace and organization details
• Billing information (when you subscribe; processed by Stripe — we do not store full payment card numbers)

When you use the Service:

• Configuration settings for Connected Services
• Playbook configurations and preferences
• Communications with our support team

When you connect a third-party service (Stripe, Gmail, HubSpot, etc.):

• OAuth tokens or API credentials authorizing our access
• Data accessed through that service per the scope you grant, including but not limited to: customer records, payment history, email metadata and content (for connected email accounts), support tickets and customer interactions, subscription and billing information

4.2 Information We Collect Automatically

Website analytics:

• IP address and approximate geographic location (city/country level)
• Browser type and version, operating system, device type
• Pages visited, time spent, referring URLs
• Date and time of visits

We use Plausible Analytics, which is designed to be privacy-respecting and works without cookies or persistent identifiers, and PostHog on porchops.com, which does set a first-party cookie and a persistent identifier. Section 15.1 describes both tools, and says what we do and do not switch on.

HubSpot, Google, Meta and LinkedIn also set cookies on porchops.com, subject to your consent where consent is required and to your opt-out everywhere else. We additionally keep a first-party attribution cookie of our own once you allow analytics, described in Section 15.1. The Cookie Policy is rendered from the same list our code reads and says which of them is in use today.

Service usage data:

• Login times and account activity
• Features and pages accessed within the Service
• Performance metrics (response times, errors)
• Audit logs of actions taken in the Service (by you, by AI Systems, by Connected Services)

4.3 Information We Collect from Third Parties

• Authentication provider (Clerk): identity verification and basic profile information when you sign in
• Payment processor (Stripe): transaction confirmations, last four digits of card, billing address. We do not store full payment card numbers.
• Connected Services: data accessed under the scope you authorize (Stripe Connect data, email metadata, etc.)

4.4 Information About Your End Users

When you use the Service, you may upload, transmit, or otherwise provide information about your customers, prospects, or other individuals ("End User Data"). We process End User Data on your behalf as a data processor. We do not control what End User Data you provide; that is your responsibility as the data controller.

End User Data may include names, email addresses, payment information, transaction history, communication content, and other personal information your business handles.

4.5 What We Don't Collect

• We don't collect biometric information
• We don't collect genetic information
• We don't track you across third-party sites, other than through the advertising cookies described in Section 15, which are set only with your consent where consent is required and never after you opt out or send a Global Privacy Control signal
• We don't use device fingerprinting beyond what's necessary for security
• We don't deploy session-replay tools that record your interactions
• We don't request information about your race, ethnicity, religion, sexual orientation, political views, union membership, or health unless you specifically choose to share it for a clear support need

We use the information we collect for the following purposes:

5.1 To Provide the Service

• Authenticating your account and securing your access
• Processing Connected Services on your behalf
• Generating AI Outputs based on your configuration and Customer Data
• Executing Authorized Actions (such as drafting communications, sending recovery emails) per your configured Playbooks
• Maintaining audit records of every action by users and AI Systems
• Providing customer support
• Processing payments and managing subscriptions

5.2 To Improve the Service

• Analyzing usage patterns to identify product improvements (using only aggregated, statistical metadata that does not include Customer Data, AI Output content, or End User Data)
• Diagnosing and fixing bugs
• Measuring performance of features
• Conducting research and developing new features

We do not use your Customer Data, End User Data, AI Outputs, or your prompts to train, fine-tune, or improve AI models — neither our own models nor any third party's general-purpose AI models. AI Outputs are generated by querying our AI providers (currently Anthropic) at the time you generate an output, subject to the contractual safeguards described in Section 9.1.

5.3 To Communicate With You

• Transactional emails about your account, billing, and the Service
• Responses to your questions and support requests
• Product updates and announcements (you can opt out of marketing emails; you cannot opt out of essential security and service notifications)
• Marketing email to people who ask to hear from us. Two senders, and they do different jobs: Resend holds the marketing email list and sends the broadcasts, and HubSpot is our marketing CRM, holding the prospect record and any campaign we run from it. Every message carries a working unsubscribe link and our postal address, and we act on an unsubscribe within ten business days at the outside, usually immediately.

5.4 For Legal and Safety Reasons

• Complying with applicable laws and regulations
• Responding to lawful government and regulator requests
• Detecting, preventing, and addressing fraud, security issues, and abuse
• Enforcing our Terms of Service
• Establishing, exercising, or defending legal claims
• Protecting the rights, property, or safety of Porchops, our Users, or others

5.5 Aggregated and Anonymized Data

We may create aggregated, de-identified, or anonymized data from your information that cannot reasonably be used to identify you, any individual, or any specific business. We may use this data for any purpose, including business analysis and product development.

6.1 Use of AI Systems

The Service uses AI Systems (including Anthropic's Claude models) to generate AI Outputs based on your Customer Data and configurations. We disclose this in compliance with EU AI Act Article 50, the CCPA's Automated Decision-Making Technology regulations effective January 2026, and similar transparency requirements globally.

When you receive output from the Service, you are receiving content generated wholly or in part by AI. When the Service sends communications on your behalf, those communications are generated wholly or in part by AI.

6.2 No Training on Customer Data

We do not use your Customer Data, End User Data, AI Outputs, or your prompts to train AI models. Our AI provider (Anthropic) processes data submitted via their commercial API under their Commercial Terms, which prohibit training on customer API data and specify a 30-day deletion window (extended for trust and safety review of policy violations). We do not enroll Customer Data in any AI provider's "data sharing for model improvement" programs.

If we change AI providers, we will only engage providers offering equivalent or stronger no-training commitments for commercial API usage. We will provide at least 30 days' prior notice of any change to this commitment.

6.3 Automated Decision-Making

We do not make solely-automated decisions that produce legal or similarly significant effects on you (the Customer). The Service may generate AI Outputs that influence decisions you make about your customers, but those decisions are yours, not ours.

If you use the Service in a way that constitutes automated decision-making about individuals, you (not Porchops) are responsible for providing required pre-use notices, opt-out mechanisms, access requests, and appeal rights under applicable law (including CCPA's ADMT regulations effective January 1, 2027, GDPR Article 22, Colorado Privacy Act profiling rules, and similar laws). We provide configuration options and audit logs to support your compliance.

For individuals located in the EEA, UK, or Switzerland, we process Personal Data based on the following legal bases:

• Contract (GDPR Art. 6(1)(b)): to provide the Service that you have signed up for and to perform our obligations under the Terms of Service
• Legitimate interests (GDPR Art. 6(1)(f)): to operate, improve, and secure the Service; to prevent fraud and abuse; to communicate about the Service; balanced against your privacy interests
• Consent (GDPR Art. 6(1)(a)): where required, such as for non-essential cookies or for communications requiring opt-in. You can withdraw consent at any time. The analytics and advertising cookies described in Section 15 are the non-essential cookies we set. In the EEA, the UK and Switzerland none of them is set until you consent in the cookie banner, and a browser sending a Global Privacy Control signal is not given them at all: we do not load the script, so no cookie and no identifier is set. You can also refuse cookies in your browser settings.
• Legal obligation (GDPR Art. 6(1)(c)): to comply with applicable laws

For End User Data you provide to the Service, you (the Customer) are responsible for establishing the appropriate legal basis under applicable law. We process End User Data on your documented instructions as a data processor.

We do not sell your personal information for money. Where advertising cookies are set on porchops.com, the CCPA calls what they carry "sharing"; Section 12.8 explains how to opt out. We share information only as described below.

8.1 With Service Providers (Sub-processors)

We share information with the third-party services we use to operate Porchops, listed in Section 9. Each sub-processor is contractually bound to:

• Use the information only for purposes of providing services to us
• Maintain appropriate confidentiality and security
• Comply with applicable data protection law
• Be governed by terms equivalent to those in our DPA (flow-down provisions)

8.2 With Connected Services

When you connect a third-party service, we share information with that service as needed to provide the integration. For example, if you connect Stripe and configure Failed Payment Recovery, we read payment data from Stripe and may write recovery actions back to Stripe per your configuration.

8.3 In Connection with Business Transactions

If Porchops is involved in a merger, acquisition, financing, sale of assets, bankruptcy, or similar transaction, your information may be transferred as part of that transaction. We will notify you of any such transfer that materially affects your rights and provide an opportunity to opt out where applicable.

8.4 To Comply with Law

We may disclose information when we believe in good faith that disclosure is necessary to:

• Comply with a subpoena, court order, or other legal process
• Comply with applicable law or regulation
• Cooperate with law enforcement investigations
• Protect the rights, property, or safety of Porchops, our Users, or others

We will challenge overly broad requests where appropriate and lawful, and we will notify affected Users where permitted by law.

8.5 With Your Consent

We may share information for any other purpose with your consent or at your direction.

8.6 What We Don't Do

We do not:

• Sell your personal information to third parties for money
• Set an advertising cookie where consent is required before you give it, or anywhere after you opt out or send a Global Privacy Control signal
• Send Customer Data, End User Data, AI Outputs or your prompts to any advertising partner
• Permit our sub-processors to use your information for their own purposes beyond providing services to us
• Use Customer Data, End User Data, AI Outputs, or your prompts to train general-purpose AI models

8.7 With Advertising and Marketing Partners

On porchops.com only, and only as described in Section 15 and the Cookie Policy, we may share information with:

• HubSpot, our marketing CRM: the email address you give us when you create an account at app.porchops.com, and, when its tracking cookies are switched on and permitted, the pages you visited on porchops.com tied to your contact record. porchops.com itself has no form, so nothing you type reaches HubSpot from this site. This is HubSpot in our own back office; it is separate from the HubSpot connector a Customer can authorize inside the product.
• Google, Meta and LinkedIn, advertising platforms: a cookie identifier, the pages you visited on porchops.com and conversion events such as a signup, so that we can measure our ads and show ads to people who have visited. They never receive Customer Data or End User Data.

Each of these partners is bound by its business terms to use what it receives on our behalf for our advertising and not to build its own profiles from it beyond what those terms allow; their own privacy pages are linked from the Cookie Policy. Whether each is in use today is stated there, not here, because that page is rendered from the list our code reads.

We use the following third-party services to operate Porchops. Each is contractually bound to appropriate security, confidentiality, and data protection obligations. We will provide at least 30 days' advance notice before adding or replacing any sub-processor that processes Customer Data.

The current published list is maintained at porchops.com/legal/sub-processors. For Customers with executed Data Processing Addendums, we will provide direct notice of new sub-processors as required by the DPA.

Termly is the consent-management vendor we have built the cookie banner on porchops.com against. The banner is not switched on yet, so Termly holds no record of anything about you today; when it goes live it holds the record of the choice you make there, alongside our own copy of it.

9.1 Data Processing by AI Providers

When the Service generates AI Outputs, your relevant Customer Data is sent to the AI provider (Anthropic and OpenAI) for processing. Specifically:

• We use Anthropic's commercial API under Anthropic's Commercial Terms
• Anthropic's Commercial Terms prohibit training using customer API data to train models
• Anthropic deletes API request data within 30 days, subject to legal hold or extended retention for trust and safety review of policy violations
• We use OpenAI's commercial API under terms that likewise prohibit training on customer API data
• We do not opt in to any AI provider's voluntary data sharing or model improvement programs

We do not log AI prompt and response content beyond what is necessary to operate the Service (such as displaying the AI Output to you, recording audit trails, and tracking costs). AI prompt and response content stored in our system is subject to the same protections as other Customer Data described in this policy.

Porchops is based in the United States. Several of our sub-processors are based in the United States or process data globally. If you access the Service from outside the United States, your information will be transferred to and processed in the United States and other jurisdictions.

For transfers from the EEA, UK, or Switzerland to the United States, we rely on:

• Standard Contractual Clauses approved by the European Commission as the transfer mechanism with our sub-processors
• Supplementary measures including encryption in transit and at rest, access controls, audit logging, and contractual confidentiality obligations
• EU-U.S. Data Privacy Framework certifications of our sub-processors where applicable
• UK International Data Transfer Agreement and Swiss equivalents where applicable

If you are subject to a data protection law that requires specific transfer mechanisms or notifications, please contact [email protected] to discuss your requirements.

11.1 Retention Periods

We retain personal information for as long as necessary to provide the Service and fulfill the purposes described in this policy:

• Account information: Retained while your account is active. Deleted within 90 days after account closure, except where retention is required by law (e.g., financial records typically retained 7 years).
• Customer Data and End User Data: Retained while your account is active. After account closure, retained for 30 days to allow recovery, then deleted, subject to your account-specific retention preferences for active accounts.
• AI Output content (within Porchops's systems): Retained per your retention preferences for active accounts; deleted with Customer Data after closure.
• Audit logs: Retained for 24 months for security and compliance purposes, then deleted.
• Marketing communications data: Retained until you opt out, then deleted within 30 days.
• Consent records (your cookie choices, the policy version you saw, the region we detected): retained for at least 18 months from the choice.
• Cookies: each cookie's lifetime is listed in the Cookie Policy.
• Backups: Retained for 90 days, then automatically purged.
• Financial records: Retained for 7 years per U.S. tax and financial regulations.
• Legal hold: Information subject to a legal hold is retained until the hold is lifted, regardless of other retention rules.

11.2 Anthropic API Data

As described in Section 9.1, AI prompt and response data sent to Anthropic via their commercial API is processed under Anthropic's Commercial Terms with a 30-day deletion window (subject to trust and safety review for policy violations).

11.3 Deletion Requests

You can request deletion of your personal information at any time as described in Section 12. We will honor deletion requests subject to legal retention obligations.

Depending on your jurisdiction, you may have the following rights regarding your personal information.

12.1 Universal Rights (We Honor for All Users)

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate or incomplete information
• Deletion: request deletion of your information, subject to legal retention obligations
• Export: request a portable copy of your information in a commonly used format
• Account closure: close your account at any time

12.2 European Economic Area, UK, and Switzerland (GDPR / UK GDPR / FADP)

In addition to universal rights:

• Restriction: request that we limit how we process your information
• Objection: object to our processing based on legitimate interests
• Automated decision-making: request human review of any solely-automated decision producing legal effects on you (note that the Service does not make solely-automated decisions about Customers as described in Section 6.3)
• Withdraw consent: withdraw consent at any time where processing is based on consent
• Lodge a complaint: file a complaint with your local data protection authority

12.3 California (CCPA / CPRA)

In addition to universal rights:

• Right to know: specific pieces of personal information collected, sources, purposes, and recipients (much of this is described in this policy and the Notice at Collection in Section 2)
• Right to delete: subject to enumerated exceptions in CCPA § 1798.105(d)
• Right to opt out of sale or sharing: we do not sell for money; where advertising cookies are set on porchops.com, that is "sharing" for cross-context behavioral advertising. Opt out at any time through Your Privacy Choices; a Global Privacy Control signal opts you out automatically (Section 12.8)
• Right to limit use of sensitive personal information: we do not use sensitive personal information in ways that would trigger this right
• Right to non-discrimination: we will not discriminate against you for exercising your rights
• Right to opt out of automated decision-making (effective January 1, 2027 for "significant decisions"): see Section 6.3

12.4 Other U.S. State Laws

We honor rights granted to you under applicable U.S. state privacy laws, including:

• Colorado Privacy Act — including profiling opt-out rights
• Connecticut Data Privacy Act
• Virginia Consumer Data Protection Act
• Texas Data Privacy and Security Act
• Florida Digital Bill of Rights
• Indiana, Montana, New Jersey, Oregon, Tennessee, Delaware, and other state laws as they take effect

These rights generally include access, correction, deletion, portability, opt-out of targeted advertising and sale, and (in some states) opt-out of profiling for "significant decisions."

12.5 Other Jurisdictions

We honor rights under applicable law including Canada (PIPEDA, Quebec Law 25), Brazil (LGPD), Australia (Privacy Act), and other comprehensive data protection laws.

12.6 How to Exercise Your Rights

To exercise any of these rights:

• Email [email protected] with your request
• Include sufficient information for us to verify your identity (typically the email address associated with your account)
• Specify which right you are exercising and what information your request relates to

We will respond within timeframes required by applicable law (generally 30 days for GDPR, 45 days for CCPA, with extensions where allowed). There is no charge for exercising these rights, except in extraordinary circumstances permitted by law.

If we receive a request from a Customer's End User, we will direct that End User to the Customer who controls the data, except where we are required by law to act directly.

12.7 Authorized Agents and Browser Signals

For California residents and others with applicable rights:

• You may use an authorized agent to submit a request on your behalf, with proper documentation
• We honor Global Privacy Control (GPC) browser signals everywhere as a valid opt-out of sale and sharing, and in the opt-in regions as a refusal of analytics cookies too. A GPC signal takes precedence over a stored preference that says otherwise.
• For automated decision-making opt-outs (CCPA effective January 1, 2027), you may submit requests through methods we provide at that time

12.8 Your Privacy Choices

The combined opt-out the CCPA regulations provide for (sale or sharing, and limiting the use of sensitive personal information) lives on one page: porchops.com/legal/cookies#your-privacy-choices, linked as "Your Privacy Choices" in the footer of every page. Four ways to exercise it: a Global Privacy Control browser signal, the "Your Privacy Choices" control in the footer, refusing cookies in your browser, or an email to [email protected]. Opting out never changes the price or the product.

We take security seriously and implement reasonable administrative, technical, and physical safeguards to protect your information, including:

• Encryption in transit: all data transmitted to and from the Service uses TLS 1.2 or higher
• Encryption at rest: Customer Data is encrypted at rest in our database
• Access controls: access to systems and data is limited to personnel who need it for their job functions
• Authentication: multi-factor authentication required for administrative access
• Tenant isolation: database-level row-level security ("RLS") ensures Customer Data is isolated by Workspace
• Audit logging: all actions in the Service are logged for security and compliance purposes
• Incident response: we maintain documented procedures for detecting, responding to, and notifying affected parties of security incidents
• Vendor security: we assess the security practices of our sub-processors

13.1 No Method Is 100% Secure

While we work hard to protect your information, no method of transmission or storage is completely secure. We cannot guarantee absolute security, and you use the Service at your own risk to that extent.

13.2 Breach Notification

If we become aware of a Personal Data Breach affecting your Customer Data:

• For Customers (where you are the data controller and we are the processor): we will notify you without undue delay, and typically within 72 hours of becoming aware. We will provide information sufficient to enable you to comply with your own breach notification obligations under applicable law (including the GDPR's 72-hour controller notification requirement to supervisory authorities).
• For information we control (such as your account information): we will notify affected individuals and regulators in accordance with applicable law.
• We will provide reasonable assistance in your investigation and notification activities.

The Service is not directed at children under 13 (or under 16 in jurisdictions where that is the applicable age of digital consent — including the EU under GDPR Art. 8 in many member states), and we do not knowingly collect personal information from children under those ages.

If you believe we have inadvertently collected information from a child, please contact us at [email protected] and we will delete it promptly.

If you use the Service to process information about End Users who are children, you are responsible for obtaining required parental consents and complying with applicable child privacy laws (such as COPPA in the United States, the Age-Appropriate Design Code in California and the UK, and similar laws elsewhere).

15.1 What We Use

The full list, with every cookie name and lifetime and whether each is in use today, is the Cookie Policy. It is rendered from the same list our code reads, so it cannot lag the site. In summary:

• Strictly necessary cookies: at app.porchops.com, the session cookies and CSRF tokens that sign you in and keep you signed in. On porchops.com there are three. pco_consent records the answer you gave the cookie banner and lasts 180 days from the day you gave it, without renewing itself on later visits, so the window really does end and we ask again. pco_regime records which privacy rules apply to your visit, worked out from your approximate location, and lasts only as long as your browser session. A third will join them when the cookie banner goes live: Termly's own cookie, holding the same answer on Termly's side so the preference center can show it back to you. None of them can be switched off, because remembering that you refused the others is itself something we have to store. The Cookie Policy lists each one and says which are set today.
• Cookieless analytics: Plausible Analytics, which does not use cookies or persistent identifiers and does not track users across sites.
• Product analytics: PostHog, on porchops.com. It does set a first-party cookie and store an identifier in your browser, so that repeat visits are recognized as the same visitor. It is not used for advertising and is not shared with advertisers. PostHog can also record a session replay; that is switched off in our code, so no replay of your visit is taken. If we turn it on, this policy says so before it starts, and text you type into form fields is masked before it leaves your browser.
• Attribution: pco_attr on porchops.com, written only once you have allowed analytics. It holds the campaign parameters that were in the link you arrived on, the first outside site that referred you, the first page you landed on, and a short label grouping that page, so a signup can be credited to what someone came to do and not only to where they landed. It lasts 30 days from your first visit and does not restart that window on later ones. Refuse analytics and it is never written.
• Marketing CRM cookies: HubSpot's tracking cookies, which recognize a returning visitor and, if you sign up, tie the pages you visited on porchops.com to your contact record. These load once you allow analytics, which is the category our code gates them on.
• Advertising cookies: Google (Ads, through Google Tag Manager), Meta and LinkedIn, for measuring our ads and showing ads to people who visited. In the EEA, the UK, Switzerland, Quebec and Brazil none of these is set until you consent; everywhere else they may be set unless you opt out, and a Global Privacy Control signal counts as an opt-out before anything loads. The Cookie Policy says which of them is in use today.

The handoff to the product. porchops.com and app.porchops.com are two different applications, so when you click through to sign up we can pass along what brought you: the campaign parameters from the link you arrived on, and, if you have allowed analytics, the analytics and CRM identifiers already in your browser. That is what lets a visit here be linked to an account you create there. Refuse analytics and only the campaign parameters travel, because those were in the address bar you opened yourself.

15.2 What We Don't Use

We do not use:

• Session replay. Our analytics vendor supports it and we disable it in code, so no recording is taken on porchops.com or inside the product at app.porchops.com.
• Device fingerprinting beyond what's necessary for security
• The Meta pixel on any page with embedded video
• Services that identify individual visitors by name from an IP address or a device
• Open-tracking pixels in marketing email to contacts in France, where prior consent is required for them
• Any advertising cookie in an opt-in region before you have consented, or anywhere after you have opted out
• Any advertising or CRM tag inside the product at app.porchops.com. Nothing in the advertising category runs there; the tags on this list are on the marketing site only

We also do not sell personal information, and we do not receive money or anything else of value for the sharing described in Section 8.7. What we get out of it is our own ads working better, which is the whole of it.

15.3 Your Choices

In the opt-in regions the cookie banner asks first, with "Reject all" next to "Accept all" on its first screen. Everywhere else the banner offers an opt-out. The "Your Privacy Choices" control at the bottom of every page reopens the preference center at any time, category by category. You can also configure your browser to refuse cookies or alert you when cookies are set; if you disable strictly necessary cookies, parts of the Service may not function correctly.

We honor Global Privacy Control (GPC) signals everywhere: a browser that sends one is treated as having opted out of advertising cookies, and in the opt-in regions as having refused analytics cookies too, before any script loads. The full set of choices, including the email route and authorized agents, is at Your Privacy Choices.

At the networks themselves. You can also limit ad personalization directly with Google, Meta, and LinkedIn. Those settings cover their whole platform, not just us.

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date and version number at the top
• Notify Customers and marketing email subscribers via email at least 30 days before changes take effect (except for changes required by law or that do not materially reduce your rights, which may take effect immediately)
• Post a notice in the Service or on porchops.com

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

For questions, concerns, or requests related to this Privacy Policy or our data practices:

Porchops, Inc.
Privacy: [email protected]
General contact: [email protected]
Security: [email protected]
Legal: [email protected]
Mailing address: Porchops, Inc. c/o Registered Agent, 131 Continental Dr, Suite 305, Newark, DE 19713, United States

For data protection authority complaints (EU/UK/Swiss residents), you may lodge a complaint with your local supervisory authority. A list is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

For California residents, our toll-free number for privacy requests will be added when we have customers in California with active accounts; until then, please use [email protected].

Data Protection Officer

Porchops has designated a privacy contact for data protection inquiries ([email protected]). We do not currently meet the threshold to require a formally appointed Data Protection Officer under GDPR Article 37, but we maintain GDPR-aligned practices and will appoint a DPO if and when our processing activities require it.

This Privacy Policy is provided to be transparent about how we handle your information. If anything is unclear, please ask. We will work in good faith to address your concerns.