What we collect, and what we do with it.

Who we are

Porchlight is a small Australian business that builds websites for other small businesses and runs their advertising. This page follows the Australian Privacy Principles under the Privacy Act 1988 (Cth), whether or not they formally apply to a business our size.

The question form

The question form on the front page collects your name, your email address, the question you typed, and the time you sent it. We use them to answer you, and for nothing else. The message is emailed to us and kept.

We keep a question while we're talking to you and for 12 months after, so a follow-up has its context. Then we delete it. Ask sooner and we delete it sooner.

Starting a site at /start

The questions at /start ask what you do, what it's called, where you work, and the mobile number your call button dials. They also ask for what goes on the site itself, such as testimonials and hours. If you use "Find my business", the name you type is sent to the Australian Business Register's public lookup. Any match you pick is marked as the register's until you confirm it.

Your answers build a private draft of your site. An unpaid draft starts with a 24-hour limit. Your resume link shows the deadline and any available extension. The draft and its answers are deleted when that time runs out. If you go on to pay, the answers become your client record and stay for the life of the engagement.

Where an AI model reads your draft

After you have paid the deposit and submitted your draft, an automated review can read its wording. Before anything is sent, phone numbers, email addresses, ABNs, licence numbers, contact names and addresses, and the names under testimonials are replaced with placeholders. What the model reads is your business's words about its work: its name, trade, services, suburbs, the response time you state, the text of testimonials without their names, and the visible text of the draft site with the same details blanked. It checks spelling, wording and claims, and suggests changes for you and for us to decide on. Every change it makes is recorded with what changed and why, and can be undone.

The review runs on Claude, a model made by Anthropic, through Amazon Bedrock in AWS's Sydney region. AWS states that what is sent to Bedrock is not shared with the model's maker and is not used to train models. Nothing you type into the question form, and nothing your own customers send through your finished site, is read by an AI model.

The review is switched off as of 15 September 2026. When it is switched on, this section is the notice, and the date below changes.

Paying

Payments are taken on a page run by Stripe. Your card or bank details are entered there and handled by Stripe under Stripe's privacy policy; we never see the number. Stripe tells us that a payment succeeded, the amount, and a reference we use to match it to your draft.

Email we send you

We send email to run your order and your account, and for nothing else. We send no newsletters or promotions. Every message comes from an address at porchlight.au, sent through Amazon Simple Email Service in Sydney. You can reply to enquiries@porchlight.au.

• Your question. The question form emails your question to us. We answer you by email ourselves; the form sends you no automatic message.
• Your draft. If you ask us to save your draft, we send you one email with a link back to it. If the draft is unpaid, we send one reminder about three hours before its deadline. If you ask for a fresh link, we send it to the address on file. Email privacy@porchlight.au to have your draft deleted, which ends these.
• Your order. After you pay your deposit we email you once when your new website is ready to review. Stripe emails your payment receipt. A tax invoice is emailed automatically on payment.
• A Founding 10 code. If you ask for one, we email it to you after we check your business and its ABN.
• Your reports. Once you are a client we email your report, weekly during a campaign and monthly otherwise, to the address you gave us for reports. Each one has a “Stop these reports” link that pauses them in one tap, with no login. Your dashboard stays live.
• Quote requests from your website. Each request sent through your website's form is emailed to your business so you can ring back. It carries the sender's name, phone number, email address and message.
• MyPorchlight. We email an invitation to your account. We also email a fresh sign-in link if you ask for one, and a one-time code each time you sign in.

To stop any other email, or to stop all of them, email privacy@porchlight.au from the address concerned. We will do it within 30 days and tell you when it is done.

Who sees it

Porchlight does — the person running the business, and nobody else on our side. We do not sell, rent or trade what you give us, and we never will. Keeping enquiry data first-party is part of what makes us a small business operator under the Act.

Where it is stored, and who else touches it

• Amazon Web Services, Sydney. Everything we run is in AWS's Sydney region. Your enquiry, your intake answers and your draft are stored there. The emails in “Email we send you” are sent from there, through Amazon Simple Email Service. The AI review of draft wording, described above, runs there too.
• Google. Once you're a client, your advertising runs on Google Ads, and Google receives what it needs to run and measure it. The typefaces are hosted with this website; loading them does not contact Google Fonts. If you say yes to the advertising notice, Google is also told, once, that a website draft was started here. That lets us see whether our advertising works. It is one conversion event, not your name, your phone number or your draft. Nothing goes to Google if you say no, if you don't answer, or if your browser sends a Global Privacy Control signal. You can change your answer any time from Cookie and advertising choices in the footer.
• Meta (Facebook and Instagram). If you say yes to the advertising notice, Meta is told when a website draft is started, a question is sent, or a website is paid for, as described under the cookie section below. It is not your name, your phone number, your email or your draft. Nothing goes to Meta if you say no, if you don't answer, or if your browser sends a Global Privacy Control signal.
• Stripe. Only when you pay, as above.

That is the complete list. The exceptions are a Google conversion tag and the Meta pixel, which stay off unless you say yes. Otherwise there are no advertising trackers or third-party analytics scripts on this website.

Operational builder events are kept only in the protected Porchlight state store for delivery, support and audit. They are not an analytics product and are not written to a local Lambda filesystem.

The one cookie this site sets

The notice at the foot of each page asks a single yes or no, and your answer covers everything in this section. Yes turns these on. No turns them off and removes what they stored.

• Visit counting. Page views, call button taps and form taps are counted whatever you answer. Counting needs no cookie and identifies no one.
• Our session cookie. This site uses one cookie of its own, tr_session. It groups your visit into a session so we can see whether a page holds people's attention. It carries no name or email, it never leaves this site, and it disappears after 30 minutes of inactivity. Turn this off on its own, any time.
• Google advertising measurement. Google's tag runs only after you say yes. Google receives the address and title of the page you are on. It also learns, once, that a website draft was started here. That lets us see whether our advertising works. We send no name, phone number or draft. It may store _gcl_aw and _gcl_au, which record that a visit came from a Google ad.
• Meta advertising measurement. Meta's pixel (Facebook and Instagram) runs only after you say yes. Meta receives the address of the page you are on, and learns when a website draft is started, a question is sent, or a website is paid for, with the amount. We send no name, phone number, email or draft. Our server also sends Meta those same moments directly, with your browser's internet address and type so Meta can match them to its own records; it does this only after the same yes. It may store _fbp and _fbc, which record a visit and whether it came from a Meta ad.

Nothing goes to Google or Meta before you say yes, or if you don't answer. A Global Privacy Control signal from your browser counts as a no. You can change your answer any time from Cookie and advertising choices in the footer.

Google, Meta and Stripe are global companies and may process what they receive outside Australia, under their own policies linked above. Everything we hold ourselves stays in Sydney.

Getting a copy, or getting rid of it

Email privacy@porchlight.au from the address you used and say what you want: a copy of what we hold about you, a correction, or deletion. We'll do it within 30 days and tell you when it's done. An unpaid draft is deleted automatically after its current deadline. Deleting a client record ends the engagement, and we'll say so before we do it.

If something goes wrong

If you think we've handled your information badly, tell us first and we'll fix it. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner.

Changes

If this page changes, the change is dated here. Last changed 19 October 2026.