Privacy Policy

Last Revised: August 12, 2026

First Light Holdings LLC, a North Carolina limited liability company (“First Light Holdings,” “we,” “us,” or “our”), operates KBD Systems(“KBD,” the “Platform,” or the “Services”) and values your privacy. This Privacy Policy describes how we collect, use, share, and safeguard information in relation to our website (kbdsystems.com — the “Website” or “Site”) and the features, products, and online services we provide. We strive to comply with applicable data privacy laws and regulations, including aspects of the GDPR, CCPA/CPRA, VCDPA, and similar regulations where they apply to our operations and users.

KBD is an all-in-one marketing-automation platformfor experts, coaches, creators, agencies, and small businesses. It generates and runs marketing on the customer’s behalf: content, landing pages and funnels, email campaigns and automations, a CRM, offers and checkout, and course or membership delivery — much of it drafted by AI from the customer’s own brand inputs. KBD is white-label and multi-tenant, so agencies may resell it to their own clients.

Please also review our Terms and Conditions of Use (“Terms”) and our Data Processing Agreement (“DPA”) for further details on service use and data handling.

Overview

This Privacy Policy details the types of data and information that we collect from users of our Site and Services, how we use and safeguard this data, and your rights regarding your information.

Our Services That Process Data

KBD’s primary Services provide marketing automation: generating marketing content and assets, building landing pages and funnels, sending email campaigns and automations, managing a customer relationship management (CRM) database of the customer’s own contacts, and processing offers, checkout, and course or membership delivery. When you use the Services, we process the data you provide to operate the Platform, generate the content you request, and deliver marketing on your behalf. Our data processing mechanisms are designed with privacy and security in mind.

KBD does not collect telephone numbers or send SMS/text messages — marketing through the Platform is email-based.Because we neither collect phone numbers nor originate text messages, KBD’s use of the Platform does not create SMS/TCPA obligations for you.

Information We Collect

We collect information to provide and improve our Services. For some information we act as a Data Controller (deciding the purposes and means of processing); for other information we act as a Data Processor(processing on a customer’s behalf and on their instructions). The types of information we collect can be categorized as follows.

Account Information (KBD acts as Controller)

This is information about the account holders who register for and use KBD. It may include:

• Account details: your name, email address, and account identifiers.
• Login credentials: a passkey (WebAuthn public-key credential). We do not store passwords in plaintext.
• Plan & billing metadata: your subscription plan and limited billing information such as transaction identifiers and the card’s last four digits and expiry as returned by our payment processor. We do not store full payment card numbers.
• IP addresses: collected when you access the Site and Services for security, rate limiting, and abuse prevention.
• Product usage & event data: page views, feature usage, and email engagement (such as opens and clicks) for emails the customer sends through the Platform.

We do not collect telephone numbers.

Customer Content & Contact Data (KBD acts as Processor)

When a customer uses the Platform, they may upload, create, or store content and data that KBD processes on their behalf. The customer is the Controller of this data and is responsible for having a lawful basis and any required consent. This may include:

• Brand inputs: the customer’s brand and messaging profile (“Brand DNA”) and related inputs used to generate marketing content.
• Generated content: the marketing copy, pages, funnels, and assets created and stored in the Platform.
• Contacts: the customer’s own leads, subscribers, and contacts — typically email address, name, tags, and email engagement events. This data is email-based; no phone numbers are collected.

Site Visitor & Automatically Collected Information

• Web server log files: like most websites, we use log files that include IP addresses, browser type, date/time stamps, and referring pages, used to administer the Site, ensure security, and analyze trends.
• Cookies and similar technologies: we use cookies essential to the functioning of the Site and Services, such as session cookies for logged-in users and CSRF-protection cookies.
• Analytics and advertising tags: a tag is loaded on a site only where its owner has configured one, and nothing of that kind loads (and no request is made to those companies) where none is configured. On kbdsystems.com today that means two: Google Analytics 4, for site analytics; and the LinkedIn Insight Tag, which measures whether our LinkedIn advertising works and which allows LinkedIn to build an audience of people who have visited this site so we can advertise to them again. The Platform can also load a Meta pixel where an owner enters one; none is configured for kbdsystems.com. These tags set or read cookies and identifiers in your browser, and they are how the retargeting described in the “Do Not Sell or Share” section below happens.
• Device information: we may collect general information about the device used to access the Services, such as device type or operating system, for analytics and compatibility.

KBD does not knowingly collect more Personal Information than is necessary to provide and improve our Services, manage user accounts, process payments, and ensure the security and integrity of our platform.

AI Processing

KBD uses an AI model provider, Anthropic, PBC (Claude), to generate marketing copy and assets from the customer’s brand inputs. Inputs sent to the provider’s API are not used to train the provider’s models. A core product guardrail is honesty: KBD does not fabricate statistics or testimonials.

How We Use Your Information

We use the information we collect for purposes including:

• To provide, operate, and maintain our Services, including generating marketing content and delivering email campaigns on the customer’s behalf.
• To process your transactions and manage your subscription and billing.
• To create and manage your account, and to send administrative information such as confirmations, invoices, technical notices, updates, and security alerts.
• To respond to your comments and questions and provide customer service.
• To improve the Site and Services, including by monitoring and analyzing trends, usage, and activity.
• To implement security measures and prevent fraud and abuse, including IP-based rate limiting.
• To comply with legal obligations and enforce our Terms.

Data Sharing & Disclosure

KBD does not sell your Personal Information or the Personal Information of your contacts. We only share information under the following limited circumstances.

Third-Party Service Providers (Subprocessors)

We use trusted third parties to process data on our behalf under confidentiality and data protection obligations, and only to provide the Services:

• Supabase, Inc. — database and file-storage hosting (customer data at rest).
• Vercel Inc. — application hosting and content delivery.
• Postmark (Wildbit/ActiveCampaign) — transactional and broadcast email delivery.
• Authorize.Net (a Visa solution) — payment processing.
• Stripe, Inc. — payment processing (alternative processor).
• Anthropic, PBC — AI generation of marketing content (Claude); API inputs are not used to train models.
• Google LLC — analytics (GA4) and Search Console, only where enabled by the customer.
• LinkedIn Corporation — the LinkedIn Insight Tag on the KBD Systems marketing site: advertising measurement and website-visitor audiences for our own LinkedIn advertising.
• Meta Platforms, Inc. — the Meta pixel, where a site owner has configured one. None is configured for kbdsystems.com.
• Keap — read-only CRM integration, only when a customer connects their own Keap account; KBD reads, and never writes to, that account.

Our current list of subprocessors is maintained in, and governed by, our Data Processing Agreement.

Legal Compliance and Protection

We may disclose information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction, subject to standard confidentiality arrangements.

Aggregated or Anonymized Data

We may share aggregated or anonymized information that does not directly identify you for research, analytics, or service-improvement purposes.

Data Processing Agreement

Please review our full Data Processing Agreement for more details on how we handle personal data, particularly when we act as a Data Processor for the contact and lead data you submit to the Platform. In that role, you remain the Controller of that data and are responsible for its lawful basis and consent.

Data Security

First Light Holdings takes reasonable and appropriate technical and organizational measures to protect Personal Information from loss, misuse, unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved and the nature of the information. This includes using SSL/TLS encryption for data in transit, passkey-based authentication, and access controls. However, no internet-based site or data transmission can be 100% secure, and we cannot guarantee the security of your information.

Your Privacy Rights & Access to Information

Depending on your jurisdiction, you may have certain rights regarding your Personal Information under laws such as the GDPR, CCPA/CPRA, and VCDPA. These may include:

• The right to access the Personal Information we hold about you.
• The right to request correction of inaccurate Personal Information.
• The right to request deletion of your Personal Information, subject to certain legal limitations.
• The right to object to or restrict certain processing of your Personal Information.
• The right to data portability.
• The right to opt out of the “sale” or “sharing” of your Personal Information (as defined by applicable laws such as CCPA/CPRA).
• The right to withdraw consent, where consent is the basis for processing.

Where we process contact data on a customer’s behalf as a Processor, we will refer requests from that customer’s contacts to the customer as Controller and will cooperate in responding. To exercise your rights, or if you have questions about your Personal Information, please contact our Data Compliance Officer using the details below. We may need to verify your identity before processing your request, and we will respond within the timeframes required by applicable law.

Information Correction & Deletion

If you believe that the information we have recorded about you is incorrect, you are welcome to contact us so we can update it. You also have the right to request that we delete certain information about you. Account holders can update and delete much of their data directly through the dashboard, or you may contact us at privacy@kbdsystems.com or support@kbdsystems.com to submit such requests. We may ask you to verify your identity.

CCPA / US State Privacy Laws — “Do Not Sell or Share My Personal Information”

Privacy laws such as the California Consumer Privacy Act (CCPA/CPRA) and the Virginia Consumer Data Protection Act (VCDPA) give residents of some states the right to opt out of the “sale” or “sharing” of personal information. KBD does not sell personal information. KBD does, however, operate the LinkedIn Insight Tagon this marketing site, which lets LinkedIn build an audience of people who have visited it so that we can advertise to them again on LinkedIn. Some state privacy laws treat that as “sharing” personal information for cross-context behavioral advertising, so we tell you plainly rather than relying on it not counting. It applies to visitors of this website; it is not applied to a customer’s own contacts, and their contact data is never disclosed to any advertising network.

How to opt out. Turn off “Ads outside of LinkedIn” and data collection in your LinkedIn account’s advertising settings, which stops the tag being usable for advertising to you; block third-party cookies or use a tracking-protection setting in your browser; or send a Global Privacy Control signal, which we honour where our platform receives it. You may also email privacy@kbdsystems.com and ask us to exclude you, and we will. To make any other privacy request, contact us at the same address. We may ask you to verify your identity.

Data Compliance Officer

Should you have any questions related to your privacy or wish to speak with our Data Compliance Officer, please use the contact information below:

ATTN: Data Compliance Officer
First Light Holdings LLC
4030 Wake Forest Rd, Ste 349
Raleigh, NC 27609
USA
privacy@kbdsystems.com

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will post any changes on this page and indicate the date it was last revised at the top of the policy. We encourage you to review this Privacy Policy periodically. For material changes, we may provide more prominent notice or obtain consent as required by law.

Contact Us

If you require more information or have any questions concerning our Privacy Policy, please contact us at privacy@kbdsystems.com or support@kbdsystems.com.