Privacy Policy

1. Introduction

FFL Bridge ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our FFL dealer locator API service and website.

Please read this privacy policy carefully. By using our services, you consent to the practices described in this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Name
• Company/business name
• Website URL (optional)
• Password (stored securely hashed)

2.2 API Usage Data

When you use our API, we automatically collect:

• API request logs (endpoints accessed, timestamps)
• IP addresses
• Search queries (ZIP codes, coordinates)
• Response times and status codes
• User agent strings

2.3 Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers, CVVs, or full payment details on our servers. Stripe's privacy policy governs the handling of payment information.

3. How We Use Your Information

We use the collected information to:

• Provide, operate, and maintain our services
• Process transactions and send related information
• Send administrative communications (service updates, security alerts)
• Monitor and analyze usage patterns to improve our services
• Detect, prevent, and address technical issues or abuse
• Enforce our terms of service and usage limits
• Comply with legal obligations

4. Information Sharing and Disclosure

We do not sell your personal information. We may share information in the following circumstances:

• Service Providers: With third-party vendors who assist in providing our services (e.g., Stripe for payments, hosting providers)
• Legal Requirements: When required by law, subpoena, or legal process
• Protection of Rights: To protect our rights, privacy, safety, or property
• Business Transfers: In connection with a merger, acquisition, or sale of assets

5. Data Security

We implement appropriate technical and organizational security measures to protect your information, including:

• Encryption of data in transit (TLS/SSL)
• Secure password hashing (bcrypt)
• API key hashing (we never store plaintext API keys)
• Regular security audits and monitoring
• Access controls and authentication

6. Data Retention

We retain your account information for as long as your account is active. API usage logs are retained for 90 days for analytics and debugging purposes. You may request deletion of your account and associated data at any time by contacting us.

7. Your Rights

Depending on your location, you may have the following rights:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Object to or restrict processing of your information
• Data portability
• Withdraw consent at any time

To exercise these rights, please contact us at privacy@fflbridge.com.

8. Cookies and Tracking

We use essential cookies for authentication and session management. We do not use third-party tracking cookies or advertising networks. Our analytics are privacy-focused and do not track individual users across websites.

9. Third-Party Services

Our services integrate with:

• Stripe: Payment processing (Stripe Privacy Policy)
• Vercel: Hosting (Vercel Privacy Policy)
• Supabase: Database hosting (Supabase Privacy Policy)

10. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our services after changes constitutes acceptance of the updated policy.