Privacy policy

Porch Routes is operated by Vector UX LLC (Utah). For visitors to this website and for the people who create and use business accounts, we decide how personal information is used — the law calls that a controller or a business.

For the customers a business delivers to (“recipients”) and the drivers who run its routes, we act only on that business’s instructions — a service provider or processor. If you received a delivery from a business that uses Porch Routes and want to see, correct or delete your information, contact that business: they decide, and we help them carry it out.

Website visitors

Pages viewed and rough, aggregated traffic counts through privacy-friendly site analytics when enabled (Google Analytics 4 measurement ID only — page views and approximate location; no advertising cookies and no cross-site tracking of individuals). When analytics is not enabled, we do not load a third-party analytics script. Nothing on the site identifies you unless you fill in the contact form, which asks for your name, email address, business and message so we can reply.

People with a business account

Name, email address, role and the business you belong to; sign-in records; the settings and content you create; support conversations. Card details go straight to our payment processor and never touch our servers.

Emails we send to business accounts

Besides the emails you need to use your account (sign-in links, password resets, receipts and billing notices), we send account owners and team members a small number of tips and product emails, such as help getting your first route out. For these tips and product emails only, we record whether each one was delivered, whether it was opened, and whether a link in it was clicked, so we can tell which emails are useful and send fewer that aren’t. Opens are measured with a small image in the email and links go through our email provider first; both are approximate, because some mail apps load images automatically and others block them. We don’t track sign-in, password, receipt or billing emails, and we never track the delivery updates a business sends to its own customers this way.

Every tips and product email has an unsubscribe link that works in one click. Unsubscribing stops them; it doesn’t affect the emails your account needs to work.

Drivers

• The name, phone number or email address the business enters so a route can be sent to you.
• Your phone’s GPS position while a route is running — from when you start the route until you finish it, and never otherwise. It powers the dispatch board and the customer’s tracking page. The drive screen shows a live indicator while it’s on.
• The proof you capture at each stop: photos, signatures, notes and the outcome you chose, with the time.

Delivery recipients

• Name, delivery address, phone number and email address, delivery instructions and what was ordered, as the business entered them.
• The messages sent to you and whether they were delivered, and any reply you text back.
• The rating and comment you leave on your tracking page, if you choose to.
• Whether your tracking link was opened. Tracking pages carry no analytics or advertising code.

• To plan routes, send them to drivers, and show each business how its delivery day is going.
• To send the delivery updates a business has turned on, under that business’s name, and to keep a log of every one.
• To show a recipient their own delivery — and only theirs — on a tracking page.
• To run accounts, billing, support and security, and to meet legal duties.
• To send account owners and team members occasional tips and product emails, and to see which ones are opened and clicked so we can send better ones and fewer of them.
• To improve planning and estimates using aggregated, de-identified information that can’t identify anyone.

We keep information only as long as it’s needed for the purpose above, then delete or de-identify it. The windows we can state today:

• Subprocessors that run parts of the service for us — hosting, database, email, texting, payments and map data. Each one, and what it receives, is listed on our subprocessors page.
• The business you deal with. A recipient’s data is visible to the business that delivers to them and to its drivers, as they need it to complete the delivery.
• Legal requests, when the law requires it, and a successor if the company is sold or merged, under the same commitments.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. All the categories of sharing above exclude text-messaging originator opt-in data and consent; that information is not shared with any third party, other than the carriers and messaging provider needed to deliver the message itself.

Delivery texts are sent by the business you ordered from, under its name, through Porch Routes. They tell you when a delivery is scheduled, on its way, almost there, delivered or couldn’t be completed, with a link to your tracking page. Message frequency varies by delivery. Message and data rates may apply. Reply STOP to cancel and HELP for help. The full programme description is in our messaging terms.

Drive mode asks your phone for its location and shares it with your business’s dispatch board and with the customer whose stop you are heading to, only while a route is running. You can see when it’s on, and it stops when the route is complete. Your business is responsible for any notice or agreement the law where you work requires before it tracks your location at work.

If your business has enabled Google Maps Platform, Google’s terms also apply to location handled through Google’s services; see the Google Privacy Policy.

A tracking page shows only the recipient’s own delivery: the business’s name, where the truck is while it’s on the way, a progress timeline, the proof photo once it’s delivered, and a place to rate it. It never shows other stops, other people’s addresses, the full route or the driver’s phone number. Links stop working 30 days after the route date.

Depending on where you live you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to opt out of sales or sharing (we do neither). We won’t treat you differently for exercising a right.

• Account holders and website visitors: use the contact form or email hello@porchroutes.com. We verify requests by confirming control of the account’s email address, and we respond within the time the law allows.
• Recipients and drivers: contact the business you dealt with. If you contact us instead, we’ll pass your request to them and help them fulfil it.
• An authorised agent may make a request for you with proof of their authority.
• Because we don’t sell or share personal information, a Global Privacy Control signal has nothing to switch off; we treat it as an opt-out regardless.

Every business’s data is kept apart on the server, the database enforces row-level security, data is encrypted in transit, and proof files live in private storage behind links that expire. The security page describes the measures in detail. No system is perfectly secure; if we learn of a breach affecting you we will tell you and, where we act for a business, tell that business without undue delay.

Porch Routes is for businesses and isn’t directed to children. We don’t knowingly collect information from anyone under 16.

Our servers and database are hosted in the United States (Supabase and Vercel). If we ever accept customers outside the United States we’ll put an appropriate transfer mechanism in place first.

When we change this policy we update the date at the top; for material changes we notify account owners by email before they take effect.

Privacy questions: the contact form, hello@porchroutes.com, or by post to Vector UX LLC, 460 Academy Avenue, Colorado City, AZ 86021, United States.