1. Who we are and what this policy covers
KCB Credit LLC provides credit-reporting and verification services to business customers in the United States.
This policy describes information handled through KCB’s public website at kcbcredit.app and, after its authorized launch, kcbcredit.com. It covers website inquiries, pricing and account-setup requests, newsletter subscriptions, service-status subscriptions at status.kcbcredit.app, live chat, support requests, invoice lookup, and the website’s connection to secure onboarding.
Credit-report ordering, consumer-report disputes, verification authorizations and consumer statement uploads can involve additional information and separate notices. This policy does not replace those notices or a required consumer financial privacy notice. The consumer statement upload and service-text program has a separate Privacy Policy at https://admin.kcbcredit.app/privacy-policy.
For privacy questions or requests, contact support@kcbcredit.com or call 844-217-5633. Mailing address: KCB Credit LLC, 1407 N Batavia St #201, Orange, CA 92867.
Do not include Social Security numbers, passwords, complete payment numbers, identity documents or private upload links in general inquiry forms, ordinary email or chat. Ask for the appropriate secure submission method.
2. Information we collect and how we use it
The information involved depends on the feature you use. We receive information directly from you, from your organization or its authorized representatives, from providers involved in the requested service, and automatically through your browser and network connection.
Inquiries and account setup. We collect names, work email addresses, telephone numbers, company names, business type, report-volume ranges, loan-origination-system details, service interests and information you include in an inquiry. We use this information to respond, discuss pricing, carry requested details into onboarding, and maintain sales and service records.
Pricing, billing and service requests. We process selected plans, requested integrations, comparison assumptions, product quantities and estimated costs. Invoice lookup involves invoice or account identifiers and the billing email or other details requested by that feature. We use these details to answer requests, locate invoices and connect you to payment services. A pricing inquiry does not by itself enroll you in the newsletter.
Newsletter. If you separately subscribe, we record your name, email, optional company, subscription status, signup date and the consent wording you accepted. These records support newsletter delivery and unsubscribe handling.
Service-status subscriptions. If you choose status updates, we collect your email, optional name and company, consent wording and time, subscription state, confirmation and unsubscribe records, and delivery records. We use these details to confirm your email, send incident, maintenance and service-change updates, manage opt-outs and prevent abuse. Delivery records include the outgoing message, recipient address, delivery attempts, times and provider result. Status updates and newsletters are separate subscriptions.
Chat and support. We process the contact details, messages, files and feedback you submit through chat or support. If you choose to submit a support ticket from a chat, the ticket can include the displayed conversation, filenames and file links, together with your request details. These records are used to answer questions and provide support. Opening chat also makes browser and page information, such as the page URL and title, available to the chat provider. The technical browser information and files a provider handles depend on the feature you open.
Website and security information. Hosting and security services process technical connection information, including IP addresses, to deliver and protect the site. Abuse controls also use hashed IP addresses or email addresses with time windows and request counts. A hash is not a promise that the underlying information is anonymous. The website’s first-party measurement records a browser-session identifier, broad referral category, timestamps, and events such as visits, pricing interest, chat use and onboarding progress. These records help us understand use of the website and sales progress. A session can be connected to an inquiry after you submit your details; it is not anonymous. This measurement event payload does not contain credit-report contents, payment numbers, form text, complete browsing URLs or private application links. The site also loads Cloudflare Web Analytics for website-performance measurement, which is separate from KCB’s lead-linked measurement. Cloudflare describes this service as using timing metrics without tracking individual users across its customers’ websites.
Secure onboarding. The connected onboarding workflow requests business and contact details, signer and guarantor information, agreements, signatures and supporting business or identity documents, depending on the application. These workflows can collect company and office addresses, business identifiers and licenses, ownership information, contact and signer details, guarantor information, identity and business documents, signatures and agreement records, and application activity. Payment workflows also process billing details, payment authorizations, provider tokens and transaction or payment-status records. For example, the application can request a guarantor’s home address and an ownership document such as a driver’s-license copy. Do not send these materials through a general contact form.
3. When information is disclosed
KCB staff and providers involved in the feature you use receive information for that feature. These include Cloudflare for website hosting, database and object storage; Resend for application and status email delivery; LiveChat for chat; HelpDesk when ticket services are enabled; the connected billing service and QuickBooks for invoice lookup and invoice payments; PandaDoc for designated signing workflows; Google Drive for configured document archiving; Backblaze B2 for configured independent database and document backups; and Basis Theory or Authorize.Net for designated payment collection, tokenization or processing workflows. The providers used depend on the feature and account configuration. Payment details should be entered only in the designated secure payment fields.
Submitting a ticket from chat can disclose the conversation and linked-file information to the ticket provider. Following a payment or other provider-hosted link also brings you to a service with its own privacy notice.
KCB does not sell or share website visitor or lead information with advertising platforms for targeted advertising.
4. Cookies, browser storage and privacy signals
The site uses cookies and browser storage for different functions:
- Account setup: a secure journey cookie reconnects submitted details and plan selection to the application for up to seven days.
- Support: when ticket services are enabled, a secure support cookie can last up to one day for the ticket workflow and abuse controls.
- Login and verification: secure sessions and short-lived verification cookies support access. The inspected account-session configuration is up to 12 hours; a pending multi-factor challenge is up to 10 minutes.
- First-party measurement: sessionStorage holds a measurement identifier. When a stored identifier is reused after it is more than 30 minutes old, the site creates a new identifier. Session storage generally lasts for the browsing session, subject to browser behavior.
- Interface and chat: session storage remembers dismissed help invitations and chat-feedback choices. Opening live chat loads the chat integration and its provider-managed authentication storage.
When your browser sends Global Privacy Control or indicates Do Not Track, the website’s normal code does not send its first-party session-measurement events. Requests to the session-event endpoint carrying Global Privacy Control are also ignored. The site may still record a submitted inquiry or account setup and related sales-progress details. These settings do not control every provider component or the separate Cloudflare performance beacon, delete submitted inquiries or stop necessary account and security functions. You can manage cookies and browser storage through your browser settings; blocking necessary storage may interrupt some features.
A browser-storage expiry is not the deletion date for a sales inquiry, application, agreement, chat or payment record.
5. Retention and security
Approved retention targets and implementation plan
We have approved the following retention targets and plan to update our internal procedures and, where needed, applicable provider settings to implement them. These are planned practices, not a statement that each system or provider currently enforces them. They are not a promise that all existing copies are deleted automatically at these times:
- First-party website measurement: 90 days from the browser session start. The existing cleanup described below is triggered by later valid events rather than a daily deletion job.
- Inactive sales prospects: 12 months after the last meaningful sales contact or inquiry response, if there is no active customer relationship or application.
- Routine support chats and tickets: 24 months after the request is closed or the last substantive support activity, whichever is later.
These targets do not set the retention period for an active customer or application, consumer reports, signed agreements, billing or payment records, subscription consent or suppression records, or information subject to a legal hold. We may need to retain relevant information longer for applicable recordkeeping requirements, an active service, a dispute, a security incident or another legal obligation. Subscription and opt-out records are also used to document choices and avoid sending unwanted messages. Retention and deletion requests remain subject to the applicable law and the information involved. Contact Compliance about a particular record or request, including the current retention that applies to it.
Current technical expiry and backup limits
The first-party measurement implementation removes session rows whose start time is more than 90 days old when another valid measurement event runs its cleanup routine. It does not delete separate sales, lead or application records. Application-journey records expire after seven days and expired rows are removed during later account-start requests; expiration of that journey does not delete a saved application.
Support-request deduplication records older than 30 days are removed during later ticket submissions. This does not delete the HelpDesk ticket or chat. Status confirmation links expire after one hour, but expiry does not itself delete subscriber or delivery records. Newsletter and status opt-outs change subscription state rather than automatically erasing the record. The website does not apply these technical time limits as a single deletion deadline for separate sales inquiries, support histories, applications, signed agreements, payments, subscription records, provider copies or backups. Configured independent backups can be subject to storage-retention controls that prevent deletion before the configured period ends. Contact Compliance through the details below about the information involved in a retention or deletion request.
The website uses measures such as secure session cookies, access checks and designated secure application and payment workflows. No internet service can guarantee absolute security. Keep account credentials and private application or upload links confidential.
6. Your choices and privacy requests
You can browse public information without sending an inquiry or subscribing. Some requested services require information to answer you, verify access or complete the service.
To stop newsletter or status emails, use the relevant unsubscribe link in that type of email or contact support@kcbcredit.com. Newsletter and status opt-outs are separate. Unsubscribing does not by itself cancel an application, delete your records or stop necessary account and transaction communications.
KCB’s Compliance Department handles privacy deletion requests under its existing policies and procedures. Send privacy and deletion requests to support@kcbcredit.com. You may also use the contact details in section 1 to ask about access, correction or other applicable privacy rights. Describe your request and provide a way to contact you. Do not send sensitive identity documents until an appropriate secure verification method has been arranged.
Available rights, verification and permitted retention exceptions depend on the law and information involved. The separate consumer statement policy explains choices for that service, including its text-message opt-out.
7. California and other applicable rights
Where the California Consumer Privacy Act applies, California residents can have rights to know or access, correct and delete personal information; opt out of the sale of personal information and of sharing for cross-context behavioral advertising; limit certain uses or disclosures of sensitive information; and receive nondiscriminatory treatment for exercising these rights, subject to applicable requirements and exceptions. Business-contact information can be covered. Other laws may provide additional rights.
You may contact KCB using section 1 about applicable California direct-marketing disclosure rights.
8. Audience and external services
KCB’s business website is intended for mortgage and other business professionals in the United States. Links to news publishers, social networks and other external sites lead to services operated by others. Review their privacy information before supplying data there.
9. Changes to this policy
We will post updates on this page and revise the effective or last-updated date. For material changes, we will provide additional notice as required by applicable law. If a new use requires consent, we will obtain that consent before making the new use.