Porchlight Data Processing Addendum (DPA)

Last updated: June 20, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between Porchlight ("Porchlight," "we," "us") and the landlord or property manager using the Service ("Customer," "you") (the "Agreement"). It governs Porchlight's processing of personal data on the Customer's behalf in connection with the Porchlight AI-assisted SMS maintenance concierge (the "Service").

1. Definitions

Terms such as "controller," "processor," "data subject," "personal data," and "processing" have the meanings given under applicable data protection laws. Resident Data means personal data relating to the Customer's residents that Porchlight processes on the Customer's behalf — names, mobile phone numbers, message content, maintenance details, and related metadata.

2. Roles of the Parties

• Customer is the controller of Resident Data and determines the purposes and means of processing.
• Porchlight is the processor, processing Resident Data only on the Customer's documented instructions.

The Customer is responsible for ensuring it has a lawful basis and necessary consents (including SMS opt-in) to collect Resident Data and instruct Porchlight to process it.

3. Scope and Purpose of Processing

Porchlight processes Resident Data only to provide and support the Service: receiving and storing inbound maintenance messages; AI-assisted bilingual (EN/ES) triage; coordinating and dispatching contractors; sending status updates; and providing support, security, and service-improvement functions consistent with the Customer's instructions. Porchlight will not process Resident Data for any other purpose, will not sell it, and will not share it for cross-context behavioral advertising.

4. Duration

Porchlight will process Resident Data for the duration of the Agreement and until deletion or return under Section 10.

5. Confidentiality

Porchlight will treat Resident Data as confidential and ensure authorized personnel are bound by appropriate confidentiality obligations.

6. Security Measures

Porchlight maintains appropriate technical and organizational measures, including: encryption of data in transit and at rest; access controls and least-privilege, role-based access; authentication for administrative access; logging and monitoring; use of reputable cloud infrastructure with industry-standard security; and periodic review of security practices. The Customer is responsible for the security of its own credentials and devices.

7. Subprocessors

The Customer authorizes Porchlight to engage subprocessors. Porchlight imposes data-protection and security obligations on each subprocessor substantially consistent with this DPA and remains responsible for their performance. Porchlight will update this page before authorizing a new subprocessor so the Customer can review and, where applicable, object.

Current Subprocessors

This subprocessor list is kept current at this page.

8. Data Subject Requests

Taking into account the nature of processing, Porchlight will provide reasonable assistance to help the Customer respond to data-subject requests (access, correction, deletion, objection). If Porchlight receives a request directly from a data subject, it will, unless legally prohibited, promptly inform the Customer and direct the data subject to the Customer.

9. Personal Data Breach Notification

Porchlight will notify the Customer without undue delay after becoming aware of a personal data breach affecting Resident Data, including known details of nature, affected data subjects, likely consequences, and measures taken, and will reasonably cooperate with the Customer's own breach-notification obligations.

10. Return and Deletion of Data on Termination

Upon termination, Porchlight will, at the Customer's choice, return and/or delete Resident Data in its possession and delete existing copies within a commercially reasonable period, except where retention is required by law. Backups are deleted per routine retention cycles.

11. General

If this DPA conflicts with the Agreement regarding Resident Data processing, this DPA controls. All other terms remain in effect.

Contact

privacy@porchlightmanagement.app or legal@porchlightmanagement.app.