Privacy

FFL Inspector is built so that Form 4473s, A&D pages, scans, and the findings from a review are not written to a database, disk, or email.

A file you upload exists in your browser tab, is sent over HTTPS to run the review, and is discarded when the response is returned. Findings remain on screen until you refresh, close, or press Destroy. That is a product rule, not a slogan.

What we do keep: your sign-in (email or Google/X identity) and which monthly plan you have. Stripe, when connected, keeps payment details in Stripe — not the forms. The live knowledge Sheet and Doc are the attorney’s teaching files, not customer records. Do not put real client 4473s in those files.

The review is processed on U.S. app infrastructure. The AI layer should be run with Zero Data Retention before real customer forms go through. Default API logging is not the same as “the app stored it.” Ask before you put live 4473s on the wire.

This tool does not replace the FFL’s duty to complete and retain original records as ATF requires. We are not a system of record.