Privacy Policy

First Light Holdings LLC, a North Carolina limited liability company (“First Light Holdings,” “we,” “us,” or “our”), operates Focal Campaign (the “Platform” or the “Services”) and values your privacy. This Privacy Policy describes how we collect, use, share, and safeguard information in relation to our website (focalcampaign.com — the “Website” or “Site”) and the features, products, and online services we provide. We strive to comply with applicable data privacy laws and regulations, including aspects of the GDPR, CCPA/CPRA, VCDPA, and similar regulations where they apply to our operations and users.

Focal Campaign is a marketing-automation platform for businesses that communicate with their customers by text message and email. It manages contacts, builds campaigns and automations, sends text (SMS) and picture (MMS) messages and email on the customer’s behalf, provides phone-number intelligence, and prepares the brand and campaign registrations the mobile carriers require.

Please also review our Terms of Service and our Data Processing Agreement (“DPA”) for further details on service use and data handling.

For some information we act as a Data Controller (deciding the purposes and means of processing); for other information we act as a Data Processor (processing on a customer’s behalf and on their instructions). Which one applies decides everything else in this policy.

Your account. When you sign up, we collect information about you and your business and we decide how it is used. We are the Controller of it, and this policy governs it.

Your contacts. The people you message are your relationships, not ours. We hold their details only to carry out your instructions and we do not use them for our own purposes. You are the Controller; we are the Processor. That arrangement is set out in the DPA. If you received a message and want your details removed, contact the business that messaged you — they control the record and we act on their instruction. Replying STOP to that message also stops it immediately and permanently, and we will honour that regardless of any later instruction from the sender.

This is information about the account holders who register for and use Focal Campaign. It may include:

• Account details: your name, business name, email address, telephone number, business address, and account identifiers.
• Registration details required by the messaging registry: legal entity name, registered address, website, business type, and tax identification number (EIN). The registry requires these to verify that a business is real before it may send messages; we collect them for that purpose and transmit them to the registry on your instruction.
• Login credentials: a passkey (WebAuthn public-key credential) and, where enabled, a time-based one-time code secret. We do not store passwords in plaintext.
• Plan & billing metadata: your subscription plan, credit consumption, invoices, and limited billing information such as transaction identifiers and the card’s last four digits and expiry as returned by our payment processor. We do not store full payment card numbers.
• IP addresses: collected when you access the Site and Services for security, rate limiting, and abuse prevention.
• Product usage & event data: sign-in times, page views, feature usage, API calls made against your account, and administrative actions taken in the Platform.

When a customer uses the Platform, they upload, create, or store content and data that we process on their behalf. The customer is the Controller of this data and is responsible for having a lawful basis and any required consent. This may include:

• Contacts: the customer’s own leads, subscribers, and contacts — typically telephone number, email address, name, custom fields, and tags.
• Message content and delivery records: the text and media of messages sent and received, timestamps, segment counts, delivery receipts and failure reasons returned by the carriers, and replies.
• Consent and opt-out events: when and how a contact was recorded as having consented, and every STOP, HELP, unsubscribe, or re-subscribe event, with its timestamp.
• Phone-number intelligence: where the customer uses these features, the carrier, line type, country, and related routing or reputation attributes returned for a number.
• Campaign content: the campaigns, automations, templates, and audience definitions the customer builds and stores in the Platform.

Because Focal Campaign sends text messages, it necessarily collects telephone numbers. A telephone number is regulated more tightly than an email address, and the consent obligations that attach to messaging it fall on the customer who loads it, not on us — see Sections 5 and 6 of the Terms.

• Web server log files: like most websites, we use log files that include IP addresses, browser type, date/time stamps, and referring pages, used to administer the Site, ensure security, and analyze trends.
• Cookies and similar technologies: we use cookies essential to the functioning of the Site and Services, such as session cookies for logged-in users and CSRF-protection cookies, and we use first-party analytics to understand which parts of the product get used.
• Device information: we may collect general information about the device used to access the Services, such as device type or operating system, for analytics and compatibility.

We do not run advertising or cross-site tracking tags on the Platform, and we never apply any such tag to a customer’s contacts. First Light Holdings does not knowingly collect more Personal Information than is necessary to provide and improve our Services, manage user accounts, process payments, and ensure the security and integrity of our platform.

Some Platform features draft message content, campaign structure, or audience suggestions with the assistance of an AI model provider. Inputs sent to the provider’s API are not used to train the provider’s models. Where a feature requires it, the content of the draft you are working on is sent; we do not send your contact list to a model provider in order to generate content, and no contact’s telephone number is transmitted for that purpose.

We use the information we collect for purposes including:

• To provide, operate, and maintain the Services, including sending the messages and email you compose or automate and reporting their outcome back to you.
• To prepare and submit brand and campaign registrations to the messaging registry on your instruction, and to correspond with the registry and the carriers about them.
• To process your transactions and manage your subscription, credits, and billing.
• To create and manage your account, and to send administrative information such as confirmations, invoices, technical notices, updates, and security alerts.
• To respond to your comments and questions and provide customer service.
• To improve the Site and Services, including by monitoring and analyzing trends, usage, and activity.
• To implement security measures and prevent fraud and abuse, including IP-based rate limiting, and to investigate complaints raised by a carrier, the registry, or a regulator about traffic sent through the Platform.
• To comply with legal obligations and enforce our Terms.

We do not sell your Personal Information or the Personal Information of your contacts, and we do not share it for cross-context behavioral advertising. We do not market to your contacts, from us or on behalf of anyone else. We only share information under the following limited circumstances.

Third-party service providers (subprocessors). We use trusted third parties to process data on our behalf under confidentiality and data protection obligations, and only to provide the Services. They fall into these categories:

• Message delivery. A messaging supplier that connects to the mobile carriers and delivers your SMS and MMS traffic. Delivering a message necessarily discloses the recipient’s number and the message content to that supplier and onward to the recipient’s carrier — this is inherent to text messaging, not a choice we make.
• The messaging registry and the mobile carriers. Your brand and campaign registration details, including your EIN, are submitted to the registry and made available to the carriers for approval.
• Phone-number intelligence. A provider that returns carrier, line type, country, and reputation data for a number submitted for lookup.
• Cloud hosting, database, and file storage. Where the Platform and your data are hosted.
• Transactional and marketing email delivery.
• Payment processing. Full card numbers are handled by the processor and do not reach our systems.
• AI model provider. For the AI-assisted features described in Section 6.
• Error monitoring and operational alerting.

Several of these providers are engaged under confidentiality terms that prevent us from naming them publicly. Our current list of subprocessors, naming each provider, is maintained in and governed by our DPA and is available to any customer on request from privacy@focalcampaign.com. We give notice before adding a subprocessor that processes contact data.

Legal compliance and protection. We may disclose information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request. We may also disclose records of a specific message or of consent to a carrier, the registry, or a regulator investigating a complaint about traffic sent from your account.

Business transfers. In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction, subject to standard confidentiality arrangements. This policy continues to apply until it is replaced with notice.

Aggregated or anonymized data. We may share aggregated or anonymized information that does not directly identify you for research, analytics, or service-improvement purposes.

Message content and delivery records are retained while your account is open, because you need them and because a carrier may require us to account for traffic sent through the Platform.

Consent and opt-out events are retained for at least four years after the account closes. That period reflects the window in which a messaging claim can be brought, and a record of consent — or of an opt-out having been honoured — is the evidence that answers it. Deleting those records early would remove your own defence and ours.

Account and billing records are retained for seven years for tax and accounting purposes. Everything else is deleted 30 days after termination, which is also the window in which you may retrieve an export.

First Light Holdings takes reasonable and appropriate technical and organizational measures to protect Personal Information from loss, misuse, unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved and the nature of the information. This includes TLS encryption for data in transit and encryption at rest; passkey and multi-factor authentication; credentials stored encrypted and never displayed again after they are set; access controls limited by role and logged; regular encrypted backups; and isolation of each customer’s data enforced in the database itself rather than only in application code, so that a coding error cannot expose one customer’s records to another.

However, no internet-based site or data transmission can be 100% secure, and we cannot guarantee the security of your information. If a breach affects your information we will notify you promptly, with what we know at the time and what we are doing about it, rather than waiting for a complete picture.

Depending on your jurisdiction, you may have certain rights regarding your Personal Information under laws such as the GDPR, CCPA/CPRA, and VCDPA. These may include:

• The right to access the Personal Information we hold about you.
• The right to request correction of inaccurate Personal Information.
• The right to request deletion of your Personal Information, subject to certain legal limitations.
• The right to object to or restrict certain processing of your Personal Information.
• The right to data portability.
• The right to opt out of the “sale” or “sharing” of your Personal Information (as defined by applicable laws such as CCPA/CPRA).
• The right to withdraw consent, where consent is the basis for processing.
• The right not to be treated differently for exercising any of these rights.

Where we process contact data on a customer’s behalf as a Processor, we will refer requests from that customer’s contacts to the customer as Controller and will cooperate in responding. The one thing we act on directly, without waiting for the customer, is an opt-out: a STOP reply is honoured by the Platform immediately and cannot be reversed by the sender.

To exercise your rights, or if you have questions about your Personal Information, please contact our Data Compliance Officer using the details below. We may need to verify your identity before processing your request — these rights are worth nothing if anyone can invoke them about someone else — and we will respond within the timeframes required by applicable law, and in any event within 45 days.

If you believe that the information we have recorded about you is incorrect, you are welcome to contact us so we can update it. You also have the right to request that we delete certain information about you. Account holders can view, correct, export, and delete much of their data directly through the dashboard, or you may contact us at privacy@focalcampaign.com to submit such requests. We may ask you to verify your identity.

Privacy laws such as the California Consumer Privacy Act (CCPA/CPRA) and the Virginia Consumer Data Protection Act (VCDPA) give residents of some states the right to opt out of the “sale” or “sharing” of personal information. Focal Campaign does not sell personal information and does not share it for cross-context behavioral advertising. We do not operate advertising or retargeting tags on the Platform, and no customer’s contact data is ever disclosed to an advertising network.

We honour a Global Privacy Control signal where our platform receives it. To make any privacy request, contact us at privacy@focalcampaign.com. We may ask you to verify your identity.

Service communications — outages, security notices, billing, registration status, and changes to these documents — come with the account and cannot be switched off while it is open. Anything promotional has a working unsubscribe link. If we send you an SMS about your own account, STOP works on it exactly as it does everywhere else.

The Services are for businesses. We do not knowingly collect information from anyone under 18. If we learn that we have, we delete it.

Should you have any questions related to your privacy or wish to speak with our Data Compliance Officer, please use the contact information below:

ATTN: Data Compliance Officer
First Light Holdings LLC
4030 Wake Forest Rd, Ste 349
Raleigh, NC 27609
USA
privacy@focalcampaign.com

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will post any changes on this page and indicate the effective date at the top of the policy. We encourage you to review this Privacy Policy periodically. For material changes we will give at least 30 days’ notice by email, and we may obtain consent where required by law.

If you require more information or have any questions concerning our Privacy Policy, please contact us at privacy@focalcampaign.com or legal@focalcampaign.com.