1. Our role and the merchant relationship
PorchPost provides software that helps U.S. merchants offer gifting to U.S. senders and recipients. The merchant identified in the gift experience sells the products and manages its store, fulfillment, returns and customer relationship. The merchant has its own privacy notice describing its handling of personal information.
When we process buyer and recipient information to provide gifting services on a merchant’s instructions, we generally act as that merchant’s processor or service provider, as those terms are defined by applicable law. We also handle information for our own business purposes, such as administering merchant accounts, providing support, securing the Services and meeting our legal obligations. Our role depends on the particular processing activity; this policy does not reduce obligations that applicable law places on us.
If you received a gift invitation without first contacting PorchPost, the sender or merchant supplied your contact information so we could help deliver the gift. Receiving an invitation does not itself enroll you in unrelated marketing.
2. Information we collect and its sources
Merchant and team information: names, email addresses, business and store information, account identifiers, roles, access permissions, settings, subscription information and communications. We receive this information from account users, their organization, Shopify and our authentication provider.
Buyer and gift information: buyer details supplied through the merchant’s checkout, the intended recipient’s contact details, gift messages, selected products or options, order identifiers, amounts, payment and refund status, and gift activity. We receive this information from senders, merchants and Shopify.
Recipient and delivery information: the name, email address, delivery address and any phone number you provide, your gift selection or decline decision, address corrections, and shipment or tracking information. We receive this information from you and through the merchant’s order and fulfillment systems.
Support and privacy requests: contact information, the contents of requests, information reasonably needed to verify identity or authority, and records of our response.
Technical information: device and browser information, IP addresses, authentication and session information, request and security records, diagnostic information and interactions needed to operate and protect the Services. Hosting and other service providers may collect technical information when your device connects to them.
Payments for gifts are handled through the merchant’s Shopify checkout and payment providers. Merchant subscription charges are handled through Shopify billing. PorchPost receives the transaction and billing information needed to operate the Services; we do not receive or store complete payment-card numbers or card security codes through these payment flows.
Please do not include medical information, government identification numbers, financial account credentials or other unnecessary sensitive information in gift messages or support requests.
3. How we use information
We use personal information to create and manage accounts and store connections; process gift instructions; send gift invitations, reminders and service updates; enable recipients to choose or claim gifts and provide delivery details; coordinate order updates and gift-card outcomes; display relevant status; administer merchant billing; provide support; detect misuse and security problems; maintain and improve service reliability; respond to privacy requests; and meet legal obligations.
When we process buyer and recipient information on a Merchant’s behalf, we use it to provide and support the gifting service on that Merchant’s instructions, subject to applicable law. A gift sender’s provision of an email address is not blanket permission for unrelated marketing.
4. Who receives information
Merchants and fulfillment providers. We disclose gift and delivery information to the relevant merchant and its authorized personnel and systems, including Shopify. Delivery information may then be used by the merchant’s fulfillment providers and carriers to ship and support the order.
Senders and recipients. We share the information needed for the gift experience, including the sender’s name and message with the recipient and relevant gift status with the sender. Your recipient delivery address is shared with the store to ship your gift and will appear on the sender’s order. The sender may therefore be able to see it through the merchant’s order experience. Do not assume that your delivery address is hidden from the sender.
Service providers. We use providers for hosting, data storage, authentication, transactional email, diagnostics and support. Providers reflected in our current service architecture include Vercel, Convex, Clerk, Resend and Sentry. Their access depends on the service they perform and its configuration. Shopify also processes information in connection with the merchant’s store and payment services under its applicable agreements and privacy notices.
Legal and business matters. We may disclose information where reasonably necessary to comply with applicable law or valid legal process, protect people and the Services, investigate fraud or enforce our agreements. Information may be transferred in connection with a merger, acquisition, financing, reorganization or sale of assets, subject to applicable law and confidentiality protections appropriate to the transaction.
We may also disclose information at your direction or with valid consent. A merchant’s or other independent party’s subsequent handling of information is governed by its own obligations and notices. This does not remove our responsibility for our own disclosures or for providers acting on our behalf.
6. Advertising and tracking choices
We do not sell personal information or share it for cross-context behavioral advertising, and we do not use advertising trackers on the Services. We do not use buyer or recipient gift information for targeted advertising or to train general-purpose AI models.
Because we do not engage in these sale, sharing or targeted-advertising activities, an opt-out preference signal such as Global Privacy Control does not change those practices. Traditional browser Do Not Track signals do not change the necessary service and security processing described in this policy. A Merchant’s own storefront and advertising practices are separate; consult its notice for its available controls.
7. How long we keep information
Our production retention policy requires PorchPost to keep recipient personal data for one year (365 days) after a gift reaches verified final closure, then erase it. Final closure requires resolution of the gift’s delivery, gift-card or refund outcome and associated obligations. Retention holds pause routine erasure.
Under that policy, authenticated Shopify customer and shop erasure requests require immediate erasure of the affected private data regardless of the routine window or holds. Copies of privacy-request data must be erased seven days after verified fulfillment. Minimal records of the request and our response may remain to document compliance.
Routine scheduled erasure is not yet enabled in production. To request deletion or ask about a particular record while automated retention is being enabled, contact support@porchpost.io. We will respond to and handle requests according to our applicable legal and contractual obligations.
We retain Merchant account information while the business relationship is active and afterward as needed for outstanding obligations. Financial, compliance and audit records may need to be retained longer than operational gift details. For these records, and for support and technical records, the relevant criteria include unresolved billing or support issues, fraud and security investigations, and applicable recordkeeping, dispute and legal-preservation requirements. We delete or de-identify information when it is no longer needed, subject to applicable law. An identifier that remains linkable to a person is still treated as personal information.
You can request deletion using the contact information below. Deletion from PorchPost does not itself delete records independently maintained by a Merchant or Shopify. Records held by service providers, including email delivery records and backups, may have separate retention periods and deletion procedures. We address deletion requests and any required coordination with providers according to our applicable legal and contractual obligations; we do not promise simultaneous removal from every system or backup.
8. Security
We use administrative, technical and organizational safeguards appropriate to the personal information we process, including controls designed to limit access and protect information in storage and transit. No service can guarantee absolute security. If you believe information or a gift link has been accessed without authorization, contact support@porchpost.io promptly.
Gift and status links may grant access to a particular gift. Keep them private and do not post or forward them to someone who should not have that access. Our obligations under applicable security and breach-notification laws are not limited by this policy.
9. Your privacy rights and requests
Depending on where you live, the law that applies and our role in processing, you may have rights to access or obtain a copy of your personal information, correct inaccuracies, request deletion, withdraw consent, or opt out of certain sales, sharing, targeted advertising or profiling. You may also have a right to appeal a denied request or complain to a privacy regulator. We do not unlawfully discriminate against people for exercising their rights.
To make a request, email support@porchpost.io with the subject “Privacy request,” or write to the address below. Tell us the Merchant and gift or account involved and how to contact you. Do not send passwords, full payment-card details or a private gift link. We may ask for information reasonably needed to verify your identity or an authorized agent’s authority. We use verification information only for verification and related security and compliance needs.
If we process the relevant information on behalf of a Merchant, we will help direct the request to that Merchant and assist as required. You may contact the Merchant directly as well. We will not provide one person with another person’s private information merely because they participated in the same gift. We respond within the period required by applicable law and explain a denial or lawful extension where required. You can send an appeal to support@porchpost.io with the subject “Privacy appeal.”
California residents may request information about any disclosures of their personal information for third parties’ direct marketing purposes under California’s Shine the Light law. We do not make those disclosures. Nevada residents may also submit a request to opt out of sales of covered information to support@porchpost.io; we do not sell that information.
10. Children and processing locations
The Services are intended for adults aged 18 or older who can enter a binding agreement. They are not directed to children. Please do not provide personal information about a child through the Services. If you believe we have received a child’s personal information contrary to this policy, contact support@porchpost.io so we can investigate and take appropriate action.
PorchPost is offered for use in the United States by U.S. merchants, senders and recipients. Gifts may be delivered only to eligible U.S. addresses. This user-eligibility restriction does not mean that all service providers process information only in the United States. Information may be processed in the United States and other locations where our providers operate, subject to applicable safeguards.
11. Changes and contact
We may update this policy as our practices or legal obligations change. We will publish the revised policy with its effective date and provide additional notice or obtain consent when required. An update does not authorize a use of previously collected information that requires separate permission under applicable law.
IBT Development, doing business as PorchPost Email: support@porchpost.io Mail: 1575 W Horizon Ridge Pkwy, Henderson, NV 89012, United States