First Light Holdings LLC Privacy Policy

First Light Holdings LLC Privacy Policy Overview

This Privacy Policy details the types of data and information that we collect from users of our Site and Services, how we use and safeguard this data, and your rights regarding your information.

Our Services That Process Data

First Light Holdings's primary Services focus on providing Number Lookup and Phone Number Intelligence. When you use our Services (e.g., by submitting a phone number for lookup, either through the Website GUI or our API), we process the data you provide (such as phone numbers) to query our internal databases and/or third-party data providers to return information such as LRN, CNAM, spam scores, or other related telecommunication data. Our data processing mechanisms are designed with privacy and security in mind.

Lookup Pass (mobile apps for iOS and Android)

Lookup Pass is a consumer service of First Light Holdings, offered through the Lookup Pass mobile apps and at lookuppass.com. It is covered by this Privacy Policy. Lookup Pass is not a separate company and does not maintain a separate privacy policy.

What the app collects. When you create an account we collect your email address and first name. When you look up a phone number, we receive and store that number together with the result, so the app can show you your lookup history. If you report a number as spam, scam or a robocall, we store that report attributed to your account. If you add a number to Protected Numbers, we store that number and re-check it periodically so we can alert you when its spam labeling or caller ID changes.

Numbers you look up are not your contacts. The app does not read, upload, or request access to your address book, your call history, or your messages. A number reaches us only when you type it, paste it, or explicitly share it to the app. Sharing a contact card to Lookup Pass sends us only the phone number in it.

Call blocking works on your device, not on our servers. If you turn on call screening, we send your device a list of numbers with poor reputations. Your phone compares incoming calls against that list locally. We do not receive, see, or store who is calling you, and we are not able to. On iOS this is provided through Apple's Call Directory extension, which by design gives an app no visibility into your calls. The extension stores the screening list on your device and sends nothing to us.

One exception, on Android only, and only if you switch it on. The Android app offers an optional setting, "Identify unknown callers", which is off unless you choose it. On Android, with it on, when a number that is not in your contacts calls you, your phone sends us that number so we can look up the caller's name and show it to you. The iOS app has no such feature. That is the only circumstance in which we receive a number that called you, and we store it the same way we store any other lookup. Turning the setting off in My Pass stops it immediately. Everything described above continues to work on your device either way.

What the app does not collect. The Lookup Pass apps contain no advertising, no analytics or attribution SDKs, and no third-party trackers. We do not use the device advertising identifier, and we do not track you across other companies' apps or websites. We do not sell personal information.

Subscriptions and payment. Subscriptions purchased inside the iOS or Android app are processed by Apple or Google. We receive confirmation that a purchase is valid and its renewal status. We never receive your card number.

Deleting your account. You can delete your account from within the app, under My Pass. Deleting closes the account and removes your name, email address, postal address, phone numbers, protected numbers, sign-in credentials and the rest of your profile. If your subscription is billed by Apple or Google, deleting your account does not cancel it — only the store can, so cancel it in your App Store or Google Play subscription settings. See "Information Correction & Deletion" below.

How long we keep data

Account data (your profile, protected numbers and settings) is kept for as long as your account exists and is removed when you delete the account, as described above.

Lookup history (the numbers you looked up and their results) is kept while your account exists so the app can show it to you. After you delete your account, those records are no longer linked to any name, email address or other personal identifier.

Billing and transaction records are retained after deletion for accounting, tax and dispute purposes, as required by law, but no longer tie to your personal data.

Server request logs (IP address, device type and the requests the app makes) are retained for security and operations.

Information We Collect

We collect information to provide and improve our Services. The types of information we collect can be categorized as follows:

Personal Information:

This is information that identifies you as an individual or relates to an identifiable individual. This may include:

• Account Information: When you register for an account, we may collect your name, unique identifier (such as account ID), email address, physical address, telephone number, geolocation, and IP address.
• Contact Information: If you contact us for support or other inquiries, we may collect your name, email address, phone number and the content of your communication.
• Payment Information: When you purchase balance or services, payment is processed by our third-party payment processor (Stripe). We do not store your full payment card details. We may receive and store transaction identifiers, purchase history, and limited billing information as necessary for account management and support.
• Phone Numbers Submitted for Lookup: When you submit phone numbers to our Services for lookup.
• IP Addresses: We collect IP addresses of users accessing our Site and Services for purposes such as rate limiting, security, abuse prevention, and analytics.
• API Keys: If you generate an API key, we store a hashed version of the key and associated information like an alias.

Non-Personal Information (Usage Data & Automatically Collected Information):

This is information that does not directly reveal your specific identity.

• Web Server Log Files: Like most websites, we use log files. This data includes IP addresses, browser type, Internet Service Provider (ISP), date/time stamps, referring/exit pages, and clickstream data to analyze trends, administer the site, track user movement, and gather demographic information.
• Query Logs: We maintain logs of lookups performed, which may include the number queried, options selected, results obtained (e.g., if from cache or provider), timestamp, IP address (for free lookups or API calls), and associated user ID or API token ID (for authenticated users). This is used for billing (balance deduction), rate limiting, service improvement, and providing lookup history to users.
• Cookies, Pixel Tags, and Similar Technologies:
  • Cookies: We use cookies essential for the functioning of our Site and Services, such as session cookies for logged-in users and CSRF protection cookies.
  • Google AdSense: We plan to use Google AdSense to display advertisements on our Site. Google AdSense uses cookies (including third-party cookies like the DoubleClick cookie) to serve ads based on a user's prior visits to our Website or other websites. This enables Google and its partners to serve ads based on your visit to our sites and/or other sites on the Internet. You may opt out of personalized advertising by visiting Google's Ads Settings. For more information on how Google uses data when you use our partners' sites or apps, see https://www.google.com/policies/privacy/partners/.
• "Do Not Track": We will endeavor to respect "Do Not Track" signals from browsers where technically feasible, which may limit some forms of data tracking for analytics or advertising.
• Device Information: We may collect general information about the device used to access our Services, such as device type or operating system, for analytics and to improve compatibility.

First Light Holdings does not knowingly collect more Personal Information than is necessary to provide and improve our Services, manage user accounts, process payments, and ensure the security and integrity of our platform.

How We Use Your Information

We use the information we collect for purposes including:

• To provide, operate, and maintain our Services.
• To process your transactions and manage your balance.
• To create and manage your account, and send you administrative information, including confirmations, invoices, technical notices, updates, and security alerts.
• To respond to your comments, questions, and provide customer service.
• To improve the Site and Services, including by monitoring and analyzing trends, usage, and activities.
• To implement security measures, prevent fraud and abuse (including IP-based rate limiting).
• To display advertisements (e.g., via Google AdSense).
• To comply with legal obligations and enforce our Terms and Conditions.

Data Sharing & Disclosure

First Light Holdings does not sell your Personal Information or the Personal Information of your end-users. We only share information under the following limited circumstances:

Third-Party Service Providers:

• Number Lookup Providers: To perform the core number lookup service, the phone numbers you submit are shared with our upstream data provider(s) to retrieve the requested intelligence. We strive to work with providers who maintain high data protection standards.
• Payment Processors: We use Stripe for payment processing. We share necessary transaction information with Stripe to facilitate payments. Stripe's use of your personal information is governed by their privacy policy.
• Email Delivery: If we use a third-party service to send emails (e.g., account verification, notifications), your email address will be shared with them for that purpose.
• Advertising Partners: As mentioned, Google AdSense collects information via cookies to serve personalized ads.
• Other Vendors: We may use other vendors for services like hosting (AWS), analytics, or customer support tools, who may process data on our behalf under strict confidentiality and data protection agreements.

Legal Compliance and Protection:

We may disclose information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Business Transfers:

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction, subject to standard confidentiality arrangements.

Aggregated or Anonymized Data:

We may share aggregated or anonymized information that does not directly identify you for research, analytics, or service improvement purposes.

Data Processing Agreement

Please review our full Data Processing Agreement for more details on how we handle personal data, particularly when acting as a Data Processor for data you submit.

Data Security

First Light Holdings takes reasonable and appropriate technical and organizational measures to protect Personal Information from loss, misuse, unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved in the processing and the nature of the Personal Information. This includes using SSL/TLS encryption for data in transit, hashing passwords, and implementing access controls. However, no internet-based site or data transmission can be 100% secure, and we cannot guarantee the security of your information.

Your Privacy Rights & Access to Information

Depending on your jurisdiction, you may have certain rights regarding your Personal Information. These may include:

• The right to access the Personal Information we hold about you.
• The right to request correction of inaccurate Personal Information.
• The right to request deletion of your Personal Information, subject to certain legal limitations.
• The right to object to or restrict certain processing of your Personal Information.
• The right to data portability.
• The right to opt-out of the "sale" or "sharing" of your Personal Information (as defined by applicable laws like CCPA/CPRA).
• The right to withdraw consent, where consent is the basis for processing.

To exercise these rights, or if you have questions about your Personal Information, please contact our Data Compliance Officer using the details provided below. We may need to verify your identity before processing your request. We will respond to your request within the timeframes required by applicable law.

Information Correction & Deletion

If you believe that the information we have recorded about you is incorrect, you are welcome to contact us so we can update it. You also have the right to request that we delete certain information about you. Please contact us at regulatory@verirouteintel.com or support@verirouteintel.com to submit such requests. We may ask you to verify your identity.

SMS Terms and Conditions

Upon messaging opt-in (if such a feature is offered), the end user agrees to receive messages from First Light Holdings regarding account alerts, communications, marketing, etc. End users can opt-out by replying STOP or request more information by replying HELP. Message frequency varies. Message and data rates may apply. If you need assistance or have questions about our SMS service, reply with "HELP" to any SMS message you receive, or contact our customer support team at support@verirouteintel.com. Mobile information will not be shared with unrelated third parties or affiliates for their marketing/promotional purposes.

SMS Messaging Opt-In Policy

By providing your mobile number and opting-in, you consent to receive SMS messages from First Light Holdings, LLC related to the following topics: "Maintenance", "Service", "Security", "Marketing", "Product Updates", "Promotions". These may include informational messages, alerts, and updates specific to your account or services with us. You can unsubscribe at any time by following the instructions in our messages, replying “STOP,” or contacting us directly. Please be aware that opting out of SMS notifications may impact your ability to receive certain service-related information from us.

SMS Messaging Opt-Out Policy

If you wish to stop receiving SMS messages from us, you can opt-out by replying “STOP” to any of our messages or by contacting us. Note that opting out of SMS may limit your access to certain features or updates related to First Light Holdings, LLC. If you decide to re-subscribe, please contact us directly or follow the opt-in instructions provided on our website.

Privacy Policy for SMS Messaging

We respect your privacy and are committed to protecting your personal information. Your phone number and SMS preferences are securely stored and will only be used for the purposes you have consented to, as described above. We do not share your phone number with third parties, except as required by law or as part of our services to deliver messages securely and efficiently.

CCPA/US State Privacy Laws Opt-Out — "Do Not Sell Or Share My Personal Information"

Privacy laws, such as the California Consumer Privacy Act (CCPA) or the Virginia Consumer Data Protection Act (VCDPA), afford residents of some states the right to opt out of the "sale" or "sharing" of personal information. This may include the transfer of data to third parties (like advertising partners) to predict your preferences or interests to personalize ads for you. To exercise your "do not sell or share" rights, or to opt-out of targeted advertising cookies where applicable, please contact us at regulatory@verirouteintel.com. We may ask you to verify your identity. You may also be able to manage preferences for advertising cookies through your browser settings or opt-out tools provided by advertising industry groups.

Data Compliance Officer

Should you have any questions related to your privacy or would like to speak with our Data Compliance Officer, please use the contact information below:

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will post any changes on this page and indicate at the top of the policy the date it was last revised. We encourage you to review this Privacy Policy periodically. For material changes, we may provide more prominent notice or obtain consent as required by law.

Contact Us

If you require more information or have any questions concerning our Privacy Policy, please feel free to contact us at regulatory@verirouteintel.com or support@verirouteintel.com.