Privacy and security policy

The short version

• We do not sell personal information, and we do not share it for advertising.
• Your business records belong to you. We use them only to run the service.
• Each store’s data is kept separate from every other store’s.
• We never store a full card number or security code. Our payment processor holds them and gives us a token.
• Fingerprints are taken only with written consent, encrypted, used only for NFA transfers, and destroyed on schedule.
• Mobile numbers and text message consent are never shared for marketing.

1. Who this policy covers

This policy explains how Battle Ready Tech, LLC (“Battle Ready Tech”, “we”, “us”) handles personal information for the Omniscient software and this website. It covers three groups of people:

• Visitors to this website, including people who book a demo or contact us.
• Customers and their staff: the dealers, ranges and other businesses that subscribe to Omniscient, and the people who use it for them.
• Our customers’ customers: the shoppers, buyers, members and students whose information a dealer keeps in Omniscient.

For that third group, the dealer decides what is collected and why. We process that information on the dealer’s behalf as its service provider, and the dealer’s own privacy notice applies. If you bought from or visited a dealer that uses Omniscient, contact that dealer first about your information.

2. What we collect

From website visitors and demo requests: your name, business name, email, phone, shop type, current software, your message, and the time you book. Our servers also log technical details such as IP address, browser and pages requested.

From customers and their staff: account and contact details, business and license details, logins and security settings, billing contact and address, and records of how the service is used, including sign-ins and changes for the audit trail.

From customers who apply for payment processing: the business and owner details our payment processor requires, including owners’ Social Security numbers and the business bank account. We keep these encrypted only until the processor accepts the application, and then we delete them.

For dealers, about their customers, depending on the features the dealer uses:

• contact details, purchase and order history, loyalty, gift card, layaway and store credit records;
• identity details and ID scans used for age checks, ATF Form 4473, background checks and the A&D book;
• NICS and state background check results and transaction numbers;
• NFA transfer records, photos and fingerprints (see section 5);
• range waivers, memberships, classes, certifications and check-ins;
• text messages, emails and, where the dealer turns it on, recorded phone calls.

Payment cards and bank accounts at checkout. When a shopper pays, card numbers, security codes and bank account numbers pass through our servers over an encrypted connection to our payment processor, which returns a token. We store the token, never a full card number, security code or bank account number.

3. How we use it

• to provide, run, secure and support the service, including backups and the audit trail;
• to process payments and bill for subscriptions;
• to answer questions, book demos and send service messages;
• to find, investigate and stop fraud, abuse and security incidents;
• to improve the service, using aggregated or de-identified information where we can;
• to meet our legal duties and respond to lawful requests.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use our customers’ customer records for our own marketing.

4. Who we share it with

We share personal information only with:

• Service providers who help us run Omniscient, under contracts that limit their use to serving us. These are hosting and storage, network security (Cloudflare), payments (Fortis), text messages and phone calls (Twilio), email delivery, sales tax calculation, address lookup, email address checking, and AI model providers (OpenAI and Anthropic) for optional AI features such as writing help, call transcription and summaries, and spam screening of form submissions.
• The dealer whose customer you are, and the companies that dealer chooses to connect, such as distributors and shipping carriers.
• Government agencies when a dealer submits records to them, such as background checks and NFA submissions, or when the law requires it, such as a valid subpoena or court order.
• A buyer or successor if our business is merged, sold or reorganized, under the same protections as this policy.

Scanned 4473s you upload are read by software on our own servers so you can search them. No outside text-recognition service reads them.

5. Fingerprints and other biometric data

Some dealers use Omniscient to take fingerprints for NFA transfers. When they do:

• a fingerprint is taken only after the person signs a written consent that explains the purpose and how long it is kept;
• it is used only to file that person’s NFA transfers with ATF through that dealer, including later transfers, so the person does not have to be printed again;
• it is encrypted at rest with an extra layer of encryption, and never sold, leased, traded or used for any other purpose;
• it is shared only with ATF, for the transfer, and with us, because we run the dealer’s records system;
• it is destroyed 3 years after the person’s last NFA transfer with that dealer, or sooner if the person asks or withdraws consent. A daily check destroys any that have reached that date, and every destruction is logged. Any copy in a backup is deleted when that backup expires.

Passport-style photos for NFA forms are not used to identify anyone by face.

6. Text messages

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from every category of sharing in this policy and will not be shared with any third party. Message frequency varies. Message and data rates may apply. Reply “stop” to opt out, or “help” for help.

7. How we protect it

• Separation between stores. Every store’s records are tied to that store, and one store cannot see another store’s records.
• Encryption. Data is encrypted in transit, and sensitive records, credentials and biometric files are encrypted at rest.
• Access control. The dealer decides who gets in. Role-based permissions limit what each person can see and do, and two-factor sign-in is available.
• Sessions. Sessions are monitored and can be ended after inactivity or a security-sensitive event.
• Audit trail and backups. Sign-ins are logged, compliance record changes are kept in a tamper-evident trail, and compliance records are backed up.
• Our staff. Our staff reach a store’s records only to support that store, and every staff sign-in to a store is logged.

No system is perfectly secure. If a breach affects your personal information, we will tell the affected dealer, and you where the law requires, without undue delay.

8. How long we keep it

We keep customer records while the subscription is active. After it ends, the dealer has 30 days to export them, and then we delete them, except what the law requires us to keep, what is in routine backups until they expire, and what we need for a legal claim. Dealers are responsible for keeping their own ATF and other required records for as long as the law requires. Demo requests and website logs are kept only as long as we need them.

9. Your choices and rights

Depending on where you live, you may have the right to know what personal information we hold about you, get a copy, correct it, delete it, and opt out of certain uses. We honor these requests for everyone, not only where the law requires. We will not treat you differently for asking.

Email [email protected] to make a request. We will confirm who you are before we act, and we answer within 45 days. If your information is in a dealer’s records, we will pass your request to that dealer, because some records (such as the A&D book and 4473s) must be kept by law and cannot be deleted on request.

10. Cookies

This website uses only the cookies it needs to work, such as keeping you signed in and protecting forms. It does not use advertising or cross-site tracking cookies.

11. Children

Omniscient and this website are for businesses and adults. We do not knowingly collect personal information from anyone under 13 through this website.

12. Where data is kept

Omniscient is offered in the United States of America, and data is processed in the United States of America.

13. Reporting a security issue

If you believe you have found a security vulnerability, email [email protected] with the details. Please give us a reasonable time to fix it before you tell anyone else, and do not access, change or delete anyone else’s data while testing.

14. Changes

We may update this policy. We will post the new version here with a new date, and tell customers about changes that matter by email or in the service.

Contact

Battle Ready Tech, LLC, 4009 E Flower Ave, Mesa, AZ 85206. Privacy questions: [email protected].