Privacy Policy

Effective date: 2026-04-11 Version: 2026-04-11

1. Introduction

This Privacy Policy describes how Arms Inventory ("we", "us", or "our") collects, uses, and discloses information when you use our cloud-hosted inventory management platform for federal firearms licensees (FFLs) (the "Service"). It applies to all users of the Service, including administrators, managers, and operators within customer tenants.

We act as the data processor on behalf of the customer tenant that uploads data to the Service. The customer tenant is the data controller for the personal data of its own employees, contractors, and end users. If you are a user within a tenant and have questions about how your personal data is handled, you should contact your tenant administrator first; we will forward any data subject requests we receive directly to the appropriate tenant administrator in accordance with our Data Processing Agreement.

This policy should be read together with our Terms of Service and our Data Processing Agreement.

2. Information We Collect

We collect only the information necessary to provide the Service. Specifically:

Account information. - Email address (used as the login identity). - Display name. - Role (admin, manager, or operator). - Tenant ID (which customer tenant the user belongs to). - Allowed locations (the subset of physical locations the user can access). - Authentication provider (email_password, google, or microsoft). - Hashed password (Argon2id) if email/password authentication is used. - Multi-factor authentication secret (encrypted at rest using a key derived from the JWT signing secret) and recovery codes (hashed). - Last login timestamp, password-change timestamp, and MFA-enrollment timestamp.

Uploaded documents and content. - PDF invoices from distributors. - Excel purchase order sheets. - Parsed representations of those documents, including line items, vendor names, SKUs, UPCs, quantities, unit prices, and total costs. - Firearm records, including serial numbers, manufacturer, model, caliber, type, importer, and classification.

Privacy note on serial numbers. Firearm serial numbers are property identifiers and carry heightened privacy and operational sensitivity. Current PDF and Excel parsing routes document contents through Anthropic's commercial API under zero-retention / no-training terms; parsed records are stored in the tenant's MongoDB database. The Service does not bulk-export tenant datasets to any AI provider. Customers with stricter serial-number handling requirements should review this workflow with counsel before using AI-assisted parsing in production.

Operational telemetry. - Audit log entries recording authentication events, role changes, match confirmations, receipt events, firearm state transitions, and administrative actions. Each entry includes the actor's user ID, timestamp, IP address, and a non-reversible action hash. - Request metadata such as IP address, user agent, request ID, and response status code, logged at the application and reverse-proxy layers. - Error traces, which may include stack traces, request IDs, and sanitized request metadata, submitted to our error-monitoring provider (Sentry).

Support information. When you submit a bug report through the in-app support form, we collect the text of your report, the page URL where you were when you submitted it, optional screenshot attachments, your user ID, and your tenant ID.

3. How We Use Information

We use the information we collect solely to:

• Authenticate users, enforce role- and location-based access control, and maintain per-tenant isolation.
• Parse uploaded invoices and orders and match them to each other.
• Track the receiving workflow and generate POS export records.
• Prepare confirmed acquisition handoff records for FastBound or other dealer-selected systems of record.
• Maintain an immutable audit log of security-relevant actions.
• Detect, investigate, and respond to security incidents.
• Send transactional emails (invitations, password resets, security alerts) via our email processor (Resend).
• Provide support, respond to your inquiries, and diagnose service issues.

We do not sell personal data. We do not use your User Content to train generic AI models. We do not share User Content with advertisers or data brokers.

4. Third-Party Processors

We use the following sub-processors to deliver the Service. Each has been vetted for the specific purpose for which it is used and is bound by its own data processing agreement with us.

We will update this list when we add or remove a sub-processor. The current effective list is maintained in this document and in our Data Processing Agreement.

5. Data Retention

Active tenants. While your tenant is active, we retain your User Content and account data indefinitely so long as it is required to provide the Service.

Offboarded tenants. When your tenant is terminated (whether by you or by us), we maintain a thirty (30) day offboarding window during which you may request an export of your data. At the end of that window the tenant is archived through our support-assisted offboarding process and removed from active infrastructure.

Archive and deletion. Archived tenant databases are retained for an additional period described in the account service agreement and are then destroyed unless a longer retention is required by law or to resolve an open dispute.

FastBound. Records pushed to FastBound are retained in your FastBound account under FastBound's own policies and the ATF's 20-year retention requirement. We do not control or share in that retention obligation after the record is handed off. See your FastBound agreement and account settings for the full retention matrix.

6. Data Security

We take the security of your data seriously and apply the following measures:

• Transport encryption. All traffic between your browser and our servers is protected by TLS 1.2 or higher, terminated at our reverse proxy (Caddy).
• Authentication. Passwords are hashed with Argon2id; sessions are issued as signed JWT tokens stored in HTTP-only, SameSite=Strict, Secure cookies.
• Multi-factor authentication. TOTP-based MFA is available to all users and can be required for administrators on a per-tenant basis.
• CSRF protection. All state-changing requests must carry a double-submit CSRF token matching the request cookie.
• Database access. MongoDB is protected by username/password authentication and is not directly reachable from the public internet. Per-tenant isolation is enforced at the database level.
• Audit logging. Security-relevant events are written to an append-only audit log collection that does not support updates or deletes.
• Backups and restore readiness. Production data is backed up regularly, and restore procedures are tested through documented operational drills.
• Secrets management. Secrets are loaded from environment variables and never committed to source control.

No method of transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

7. Your Rights

Depending on where you reside, you may have rights under applicable data protection laws, including the right to:

• Access the personal data we hold about you. You can view your account profile in the settings page, and your tenant administrator can view your role and allowed locations in the admin users page.
• Export your tenant's User Content. Administrators may request a full data export from the security settings area or by contacting support.
• Correct inaccurate personal data by updating your profile or asking your tenant administrator to do so on your behalf.
• Delete your data. Administrators may request tenant-wide deletion by emailing support@armsinventory.com; we will verify the request, initiate the offboarding window, and complete the archive and deletion process at the end of that window.
• Object to certain processing or request that we restrict processing of your personal data.

We will respond to verified requests within thirty (30) days. We may require additional information to verify your identity before completing a request.

8. Cookies

Arms Inventory uses a small number of first-party cookies strictly necessary to provide the Service:

• Session cookie (inventory_session). A signed JWT used to authenticate your session. HTTP-only, SameSite=Strict, Secure in production.
• CSRF cookie (csrf_token). A random token used for CSRF double-submit protection.
• Theme preference cookie. A small preference value indicating whether you prefer light or dark mode.

We do not set advertising, marketing, or analytics cookies. We do not use third-party tracking pixels.

9. Children's Privacy

The Service is intended for business use by FFL dealers and is not directed at individuals under the age of 18. We do not knowingly collect personal data from children under 18. If you become aware that a child has provided us with personal data, please contact us at support@armsinventory.com so we can take appropriate steps to remove that information.

10. International Users

The Service is currently operated exclusively from the United States and is intended for use by U.S.-licensed FFL dealers. We do not currently offer the Service internationally. If you access the Service from outside the United States, you acknowledge that your information will be transferred to and processed in the United States and that U.S. data protection laws may differ from those of your jurisdiction.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the version string at the top of this document. Material changes will be communicated by email to tenant administrators and via an in-app banner at least thirty (30) days before they take effect. Your continued use of the Service after the effective date of a revised Privacy Policy constitutes your acceptance of the revised policy.

12. Contact

Questions, comments, or requests regarding this Privacy Policy should be sent to support@armsinventory.com.