Privacy Policy

1. The short version

We collect what the product needs to run your shop, we store it encrypted with a major cloud provider, we never sell it, and your legal records belong to you. Firearms buyers' information recorded by a shop (like a 4473) is the shop's record — we process it only on the shop's behalf and never use it for advertising, profiling, or anything else.

2. What we collect

Account data: your name, email, business name, and license details you choose to store.

Business records you create: bound book entries, 4473s and their buyer information, forms, contacts, orders, products, documents you upload.

Payment-related data: order amounts and statuses, and non-secret merchant identifiers. Card numbers are entered on the payment processor's hosted pages and never reach our servers.

Technical basics: logs and diagnostics needed to keep the service reliable and secure.

3. Buyer information (4473s) — the sensitive part, plainly

When a shop completes a Form 4473, the buyer's information becomes part of that shop's federally mandated record. ALL FFL stores that record for the shop, protected by row-level security so only that shop's staff can see it, and frozen after completion the way ATF retention rules expect.

We never use buyer information for marketing, never share it across shops, never sell it, and never disclose it except at the shop's direction or where the law compels us. A shop's marketing tools only email people who transacted with that shop or subscribed to it.

Vault documents are encrypted on your device before upload — we store ciphertext we cannot read.

4. Where your data lives

Data is stored with Supabase (Postgres, hosted on major cloud infrastructure in the United States) and the site is served by Vercel. These providers process data for us under their standard data-processing terms; they have no rights to use your content.

AI features send only the content needed for the requested job (for example, the photo of a packing slip you asked us to read) to our AI provider to produce the draft you review. AI output never enters a legal record without your approval.

5. What we never do

We do not sell personal information. We do not run ads. We do not share your customer lists, your sales data, or your records with other shops, distributors, or anyone else without your direction. We do not train AI models on your private records.

6. Retention and deletion

Legal records (bound book, 4473s) follow federal retention requirements — that is the point of the product — so they are retained even after cancellation unless export and lawful deletion are completed as described in our Terms.

Everything else (account data, products, marketing lists) is deleted on request when you close your account, within 30 days, except minimal billing records the tax code requires us to keep.

7. Security

Every table is protected by row-level security; legal records reject edits at the database level; the bound book carries a cryptographic seal; vault files are client-side encrypted; secrets are held in managed server-side stores, never in the app or database. Report security concerns to security@allffl.com — we read those first.

8. Changes and contact

If this policy changes materially we will announce it in the app or by email before it takes effect.

Questions or requests (access, export, deletion): support@allffl.com.