Legal
Privacy notice
How Porchlight handles personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). Last updated 12 October 2026.
Who we are
Porchlight is operated by Porchlight Living (Pty) Ltd (registration number CIPC registration number), street address, Gordon’s Bay, 7140, Western Cape. Our Information Officer is Information Officer name, reachable at privacy@porchlight.co.za.
Our role
We are the responsible party for your account information. For the tenancy records an owner adds (the lease, inspections, payments), we process that information on the owner’s behalf and on the instructions of the owner and tenant using the service.
What we collect
Only what a tenancy needs: names, email and phone numbers; the lease and its key dates; rent, deposit and utilities records; inspection photos and videos; meter readings; repair requests and messages; and, where the lease needs it, an ID number, which we encrypt and only ever show as the last four digits. For children on a lease we record names only. We also keep a log of sign-ins and actions for security.
Why we use it
To provide the service you and your owner or tenant signed up for (performing the contract), to meet legal duties such as tax record-keeping, and to keep the service secure. We use consent only for optional things, like product news. We never sell your information and never use it for advertising.
Who can see it
The owner and the people on that lease, and nobody else. Our staff can only open your records to help you when you ask, and that access is logged. We share information with suppliers who help us run Porchlight (hosting, email and SMS delivery, e-signatures, payments), each under a written agreement that requires POPIA-level protection.
This website
This public website holds no tenancy records. It is hosted by Cloudflare, which serves pages from data centres close to you, including in South Africa. If you use the contact form or join the founding owners, your name, email address and message are sent by email to our own mailbox so we can reply, and we email you a short confirmation; we use them only for that, and delete founding-owner details if the pilot is not for you. Cloudflare, Google (our mailbox) and Resend (which delivers our emails) may process this outside South Africa under agreements that give protection equal to POPIA (section 72). The site sets no cookies.
Where it’s kept
On encrypted servers in South Africa, with encrypted backups. If a supplier processes information outside South Africa (for example to deliver email), we only use suppliers bound by laws or agreements that give protection equal to POPIA, as section 72 requires.
How long we keep it
For as long as your account is active, and for five years after a tenancy ends, to cover tax and legal claims. Then we delete or anonymise it automatically.
Your rights
You can ask to see, correct, download or delete your information, or object to how we use it, at any time and at no cost. We reply within 30 days. Most of this you can do yourself in Settings. If you’re unhappy with how we’ve handled your information, you may complain to the Information Regulator at inforegulator.org.za.
Security incidents
If your information is ever compromised, we will tell you and the Information Regulator as soon as reasonably possible, as section 22 requires.
Draft for the pilot. To be reviewed by a POPIA specialist before launch.