Privacy Policy
Porchlit shows businesses which companies visit their website. It is operated by IV Consulting ("we", "us"). This policy covers two groups of people: customers who use Porchlit (the app at porchlit.ivconsulting.in, its API and its MCP server), and website visitors who browse a site where a customer has installed the Porchlit pixel.
Who is responsible
For data about website visitors, the customer who installed Porchlit on their website decides what is collected and why: they are the controller, and we process the data on their behalf as their processor. Customers must tell their visitors about Porchlit in their own privacy notice and, where the law requires it, ask for consent before the pixel runs. For data about customers (your account), we are the controller.
Website visitors
What the pixel collects
- Network information. The IP address of the visit and the browser's user-agent string (browser and operating system).
- Page activity. Pages viewed, page titles, the referring page, campaign tags in the URL (UTM parameters), and how long a page was actively in view.
- Identifiers. A random first-party device ID stored in a cookie and local storage on the customer's own domain, and a random session ID in session storage. These only let the customer's site recognise a returning browser. They are not shared between different customers' websites.
- Details you choose to share. If you type a work email into a form on the customer's website, or click a link the customer sent you that carries your email, the pixel can record that email so the customer knows the visit was yours. Porchlit skips form capture when your browser sends a Global Privacy Control signal and the customer has turned that setting on (the default).
How a company is identified
Porchlit looks up who the IP address belongs to in public sources: the regional internet registries (RDAP / WHOIS), reverse DNS, and an open IP-to-network dataset. If the address belongs to a business, university or public body's own network, the visit is labelled with that organisation. Addresses from home broadband, mobile networks, VPNs, proxies and cloud providers are left anonymous. Porchlit does not use data brokers or identity graphs to find out who an individual is. A customer can also learn which networks their own identified visitors use; this is kept within that customer's workspace and never used for anyone else.
Company details
For organisations that have been identified, Porchlit gathers public business details (name, industry, size, location, website technologies) from the organisation's own website and, for some customers, from Clay. Only the company's domain is sent to Clay, never a visitor's IP address or browsing activity.
Your choices
- Block or clear cookies and local storage for the website, use a private window, or turn on Global Privacy Control in your browser.
- To access or delete data about your visits, contact the website you visited (they control it). You can also email info@ivconsulting.in and we will pass your request to them and help them answer it.
Customers
- Account information. Your email address, the waitlist details you submit (website, notes) and your workspace name. If you set a password we store only a salted scrypt hash.
- Workspace content. The websites you add, settings, tags, segments, API keys (stored as hashes) and apps you connect over OAuth.
- Usage and security logs. Sign-in times, admin actions (for example approvals and deletions) and server logs, used to keep the service secure.
We use this information to run Porchlit, decide on and manage access, send sign-in codes and service emails, keep the service secure, and comply with the law. We do not use customer or visitor data for advertising and do not use it to train AI models.
Service providers
| Provider | Purpose | Data |
|---|---|---|
| OVHcloud | Hosting. Servers and database run in Canada (Beauharnois). | All service data |
| Resend | Sending sign-in codes and access emails | Customer email addresses |
| Clay | Optional company enrichment, only for workspaces where it is switched on | Company domains only |
| Regional internet registries (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) | Public registry lookups for network ownership | IP addresses being looked up |
We do not sell personal data, and we do not share it with anyone else except where the law requires it.
Retention and deletion
- Raw IP addresses on visits are removed after 90 days. The company match and visit history stay.
- Visits and page views older than 13 months are deleted automatically.
- Sign-in codes expire after 10 minutes and are deleted within a day.
- A customer can export all their data at any time (Install and settings, then Export) and delete their workspace and all its data from the same page. Deletion is immediate in the live database; backups roll off within 30 days.
Security
Traffic is encrypted with HTTPS. Each customer's data is kept in a separate workspace and every request is checked against it. API keys, OAuth tokens and sign-in codes are stored only as hashes. Access to Porchlit is by approval only, and administrative actions are logged.
International transfers
Data is stored in Canada. Where data from the UK or EU is processed, we rely on Canada's adequacy decision and, where needed, standard contractual clauses. Customers who need a data processing agreement can email us.
Your rights
Depending on where you live (for example under GDPR, UK GDPR or US state laws such as the CCPA), you may have the right to access, correct, delete or export your data, or to object to or restrict its use. Customers can do most of this in the app; anyone can email info@ivconsulting.in. You can also complain to your local data protection authority.
Children
Porchlit is a business tool and is not directed at children under 16.
Changes
We will update this page when our practices change and change the date above. We will tell customers by email about material changes.
Contact
IV Consulting · info@ivconsulting.in · ivconsulting.in