Privacy Policy

1. Who We Are and What This Covers

APB360 is provided by GunTRAC LLC (“APB360”, “we”, “us”, “our”), 7311 Fairmont Dr, Foley, AL 36535. We provide firearm and equipment records, training and qualification records, and ATF compliance tools to law enforcement and public safety agencies and to Type 7 and higher federal firearms licensees (“FFLs”).

This Privacy Policy explains how we collect, use, share, and protect personal information through:

• this web site, apb360.com (the “Site”);
• the APB360 customer portal at my.apb360.com and the portals we run for individual customers on other apb360.com addresses (the “Portal”);
• the APB360 and GunTRAC mobile applications and our application programming interfaces (the “Apps” and the “API”); and
• the related services, emails, and text alerts we provide (together with the Portal, Apps, and API, the “Services”).

This policy is part of our Terms of Service. Words defined there, such as “Subscriber” and “User Content”, mean the same here. The Services are offered in the United States and are intended for business and government use.

2. Our Role: Records We Hold for Customers

Our customers are agencies and licensees (“Customers”). They put records into APB360 about their own operations: their employees and officers, the firearms and equipment they hold, who has custody of what, training and qualification results, and, for FFLs, the acquisition and disposition records federal law requires them to keep. Those records are the Customer’s User Content.

For those records, we act as a service provider on the Customer’s behalf. The Customer decides what goes in, who in its organization may see it, and how long it is kept beyond what the law requires. We use it only to provide and secure the Services for that Customer, to support them, and as the law requires. Each Customer’s records are kept separate from every other Customer’s, and one Customer cannot see another’s.

If you are an employee of a Customer, or a person who appears in a Customer’s records (for example, a buyer in an FFL’s acquisition and disposition record), the Customer is responsible for that information. Please send questions or requests about it to that agency or licensee. If you contact us, we will pass your request to the Customer and help them respond.

3. Visitors to apb360.com

The Site is informational. It sets no cookies and loads no analytics, advertising, or social media tracking scripts.

• Demo requests. The Request a Demo form does not send anything to our servers. It builds an email in your browser that you send from your own email program. We receive what you choose to send: typically your name, role, organization, state, phone number, and what you would like to see.
• Email and phone. When you email or call us, we receive your contact details and what you tell us, and we use them to answer you and follow up on your inquiry.
• Server logs. Our hosting provider records standard request information when the Site is visited, such as IP address, the page requested, browser type, and time. We use these logs only to operate and secure the Site.

4. Information We Collect in the Services

Account information

When a Customer gives you an account, we hold your name, email address, username, the organization you belong to, and the roles and groups that set what you may do. Passwords are stored only as one-way hashes. If you turn on two-step sign-in, we store your passkey’s public key or an encrypted authenticator secret. Customers that sign in through their own Microsoft account do so through Microsoft, and we receive the account details Microsoft provides for sign-in.

Sign-in and activity records

To keep the Services secure and to give Customers a reliable audit trail, we record:

• each sign-in and sign-out, with the account, time, IP address, and browser or device description;
• each form submitted or record saved, with who submitted it, when, from which IP address and browser, the page, and the content submitted. Passwords, sign-in codes, card numbers, keys, and tokens are removed before the record is kept;
• changes to records, such as custody changes, inspections, qualifications, corrections, and approvals, with who made them and when; and
• each scan made with the Apps (for example of a barcode or RFID tag), with the time, the user, and the result.

Records Customers keep about people

Depending on what a Customer uses, its records may include:

• Employees and officers: name, badge or employee number, position, contact details, address, driver’s license number, employment status (for example retired or on leave), notes, the equipment issued to them, and their training, qualification, and range results.
• Acquisition and disposition records (FFLs): the names, addresses, and contact details of the people and businesses a licensee acquires firearms from or disposes of them to, license numbers, and the identification, Form 4473, and NICS references that federal regulations require.
• Contacts: people a Customer keeps in its contact and call records, or chooses to notify about alerts.

Files, photos, and signatures

Users upload documents, photos, and signatures: for example a photo taken to certify that an employee still holds an item, a signed form, or a document attached to an asset. We store these files for the Customer. To make photos and documents searchable, our cloud provider’s text recognition reads the printed text in uploaded images. We do not use facial recognition.

People without an account

• Public repair (RMA) requests: when you ask a manufacturer that uses APB360 for a repair or return, we collect what you enter (name, business, address, phone, email, FFL number, the firearm’s make, model, and serial number, your invoice, and any files you attach) and your IP address, and pass it to that manufacturer.
• Upload and self-certification links: when a Customer sends you a link to upload documents or confirm equipment you hold, we collect what you submit and the IP address it came from.

Support

When you ask for help, through email, phone, or the help widget in the Portal, we receive your contact details and what you tell us.

5. Location Information

Some records are more useful when they show where they were made. With your permission, through your browser’s or phone’s location setting, the Portal and Apps record your device’s location when you complete certain actions: marking items during an inventory audit or checklist, saving a step of an electronic SOP or traveler, and scanning or moving assets with the Apps. That location is kept with the record, and an asset’s last known location is kept with the asset.

We collect location only when you take one of these actions, not continuously in the background. You can turn location off in your browser or phone settings at any time; the action still works without it. Customers may also define geofences, areas on a map that trigger alerts when assets enter or leave them.

6. How We Use Information

We use personal information to:

• provide the Services, including keeping each Customer’s records, running the reports, alerts, and emails a Customer turns on, and delivering text alerts a user opts into;
• secure the Services: verify sign-ins, detect and investigate misuse, and keep the audit trail Customers rely on;
• help Customers meet their legal obligations, such as ATF recordkeeping and responding to trace requests;
• answer questions, provide support, and send service messages such as security notices and changes to our terms;
• understand how the Portal is used so we can fix problems and improve it; and
• comply with the law, enforce our Terms of Service, and protect the rights and safety of our Customers, users, and others.

We do not sell personal information, rent it, or share it for cross-context behavioral advertising, and we do not use Customer records for advertising or marketing to the people in them.

7. Service Providers and Other Disclosures

We share personal information only as described here.

Service providers

We use trusted companies to run the Services. They may use the information only to provide their service to us:

• Amazon Web Services: hosting, databases, file storage, system email, and the text recognition described in Section 4. Data is stored in the United States.
• Google: maps and address lookup in the Portal, spam protection (reCAPTCHA) on the public repair request form, usage measurement (Google Analytics) in the Portal, and some fonts and scripts that Portal pages load from Google.
• Freshworks: the help widget in the Portal.
• Telnyx: delivering the text alerts users opt into (Section 8).
• Microsoft: sign-in for Customers that choose to use their Microsoft accounts.
• Weather services: when a page shows the weather for a location, that location is sent to a weather service.
• Overwatch Technology: our managed IT and cybersecurity partner, which helps us keep our infrastructure secure.

At a Customer’s direction

• ATF. When an FFL checks a license with ATF’s FFL eZ Check, the license number is sent to ATF. When an FFL answers an ATF trace request through APB360, the disposition details the licensee approves are sent to ATF.
• Customer-connected services. Some Customers connect their own accounts with other providers, for example a Twilio account for their own calls and texts. Information sent through those connections is governed by the Customer’s arrangement with that provider.
• Integrations. Developers a Customer authorizes to use the API can reach that Customer’s records, as described in our Terms of Service.

Legal and business reasons

• Legal requirements. We disclose information when we believe in good faith that the law requires it, such as in response to a valid subpoena, court order, or other legal process, or to protect the rights, property, or safety of APB360, our Customers, or others. Where the law allows, we tell the affected Customer before we disclose its records.
• Business transfers. If APB360 is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

8. Text Message Alerts

Portal users can choose to receive text message alerts about their own account. Only you can turn them on, signed in to your own account: you enter your mobile number, agree to the alert terms, and confirm the number with a code we text you. We keep a record of when, and from which IP address and browser, you agreed, and the exact words you agreed to. Message frequency varies. Message and data rates may apply. Consent is not a condition of using APB360.

Reply STOP to any alert to stop them, or turn them off in your account. Reply HELP for help, or email help@apb360.com. The full alert terms are on our text alert terms page.

We use your mobile number only to send the alerts you chose and to answer STOP and HELP. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third parties, except our text message provider, which uses them only to deliver our messages.

9. Cookies and Similar Technologies

The Site (apb360.com) uses no cookies.

The Portal uses:

• Sign-in and security cookies that keep you signed in, protect two-step sign-in, and confirm your permissions. The Portal does not work without them.
• Browser storage to remember small preferences, such as which table columns you chose, and to hold a receipt on screen after you save.
• Google Analytics cookies, which help us understand how the Portal is used. You can block them with your browser settings or Google’s opt-out add-on without affecting how the Portal works.
• cookies set by the help widget, and by reCAPTCHA on the public repair request form.

We do not use cookies for advertising. Our services do not respond to browser “Do Not Track” signals, because we do not track users across other sites.

10. How Long We Keep Information

We keep information for as long as we need it for the purposes in this policy, as a Customer directs, and as the law requires. In particular:

• Customer records are kept while the Customer’s subscription is active. Inactive accounts are stored, not deleted, as described in our Terms of Service. When a subscription ends, the Customer may export its records, and may ask us to return or delete them, except records we must keep by law or that form part of the permanent records below.
• Firearm acquisition and disposition records are kept as federal law requires. They are never rewritten: a correction is recorded alongside the original, so the history can always be inspected.
• Audit records (sign-in records, form submission records, and the history of changes, scans, and custody) are kept permanently. They are designed so that they cannot be changed or deleted, because Customers rely on them for investigations, inspections, and legal proceedings.
• File transfers are deleted automatically 30 days after upload.
• Public repair requests are deleted once they have been passed to the manufacturer and are no longer needed to confirm them.
• Inquiries and support messages are kept as long as we need them to help you and keep a record of our customer relationships.

11. How We Protect Information

We protect information with administrative, technical, and physical safeguards suited to the records our Customers entrust to us, including:

• encryption in transit: the Services are served over HTTPS only, using TLS 1.2 or newer;
• optional two-step sign-in with passkeys or an authenticator app, and sessions that expire;
• separation of each Customer’s records, and role-based permissions, including read-only roles that can see but never change records;
• encrypted storage of sign-in secrets and service keys, and only fingerprints, not the links themselves, of one-time upload and certification links;
• short-lived, signed links for file downloads;
• audit trails of sign-ins and changes; and
• infrastructure in Amazon Web Services, managed with our cybersecurity partner. See CJIS compliance for more.

No system is perfectly secure, as our Terms of Service explain. If we learn of a breach of security that affects personal information, we will notify affected Customers and, where the law requires, affected individuals and authorities.

12. Your Choices and Requests

• Account users can update their profile in My Account, turn two-step sign-in and text alerts on or off, and ask their organization’s administrator to correct or remove records.
• People in a Customer’s records, including employees and an FFL’s buyers and sellers, should contact that agency or licensee (see Section 2). Some of those records, such as federal firearm records, cannot be deleted while the law requires them to be kept.
• Everyone else, including visitors and people who contacted us, may ask what personal information we hold about them, and ask us to correct or delete it, by emailing help@apb360.com.

Some U.S. state laws give residents rights over their personal information, such as to know, correct, or delete it, and to opt out of its sale or use for targeted advertising. We do not sell personal information or use it for targeted advertising. To make a request, email help@apb360.com. We will confirm your identity before acting on it, respond within the time the applicable law allows, and will not treat you differently for making a request.

13. Children

The Services are for businesses and government agencies, and users must be at least eighteen (18) years old. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

14. Changes to This Policy

We may update this policy as the Services change. The “last updated” date at the top always shows the current version. If we make a material change, we will notify Customers by email or with a notice in the Portal before it takes effect.

15. Contact Us

For questions about this policy or to make a request about your personal information, contact us: