TAS Legal

Privacy Policy

Last updated August 9, 2026

This page explains what personal information TAS collects when you shop with us, why we collect it, who we share it with, how long we keep it, and how you can see, correct or delete it.

Phase 1 note: this document is a structurally complete template. It has not yet been reviewed by counsel and must be before any real sale is made.

1. What we collect

We collect only what we need to sell you ammunition lawfully and get it to your door.

Account information — your name, email address, phone number, and password. Passwords are stored as salted hashes; we never see or store the password itself.
Order information — what you bought, quantities, prices, the supplier and warehouse each item shipped from, shipment tracking numbers, delivery dates, returns, and support history for the order.
Addresses — the shipping addresses in your address book and the billing address associated with your payment method.
Payment information — handled by our payment processor. We receive and store only a token, the card brand, the last four digits, and the expiry month and year. See section 3.
Checkout age and eligibility attestations — the date-of-birth or age confirmation you give at checkout, your confirmation that you are not a prohibited person, and any permit or licence document you upload where your state requires one before we can ship. These are part of the order record.
Device and usage data — IP address, browser and device type, operating system, referring page, pages viewed, searches run, and interaction events. Used for analytics, fraud prevention and debugging.
Support communications — the emails, chat messages and call notes exchanged when you contact us, including anything you choose to include in them.
Membership data — if you join TAS+, your plan, renewal date, and billing history for the membership.

We do not ask for your Social Security number, and we do not collect biometric data, precise geolocation, or sensitive categories of personal information beyond what is described above.

The site entry age confirmation

On your first visit the site asks you to confirm that you are 18 or older before you can browse. This collects nothing. It does not ask for your date of birth, your name, or any document, and your answer is not transmitted to TAS servers. Your browser writes a flag — a yes-or-no value and the timestamp of the answer — to storage on your own device, and the site reads that flag on later visits to decide whether to ask again. The keys and how long they last are listed in section 6.

Because it stays on your device, the flag is not attached to your account, your orders, or any identifier we hold, and it is never used for advertising, profiling, or measurement. It is a self-attestation and not identity verification: it records that someone using that browser answered, not who they are. It is separate from the checkout age attestation described above, which you give as part of placing an order, which does reach us, and which we retain with that order for as long as the law requires — see section 7.

2. How we use it

To fulfil your order — routing each line to a supplier, producing shipping labels, generating tracking, and telling you when each shipment leaves and arrives.
To take payment and to calculate sales tax for your delivery address.
To meet legal obligations — verifying age and eligibility, checking your delivery address against shipping restrictions, retaining purchase records where law requires it, and responding to lawful requests.
To support you — answering questions, processing returns, and investigating lost or damaged shipments.
To prevent fraud and abuse — detecting stolen cards, straw purchases, and attempts to ship to restricted destinations.
To improve the site — understanding which pages, facets and calibers people actually use, and fixing what does not work.
To send you messages you asked for — order and shipment notifications, which are transactional and cannot be opted out of while an order is open, and marketing email, which you can opt out of at any time.

3. Payment card data

TAS never stores your full card number, expiry and security code. Card details are captured directly by our PCI DSS compliant payment processor in a hosted field that we cannot read, and the processor returns a token that stands in for the card. Saving a card for next time saves the token, not the card. If the processor is breached, that is a matter we would tell you about immediately, but there is no card number on our systems to lose.

The processor is an independent controller of the payment data it holds and processes it under its own privacy policy.

We share personal information only where it is needed to run the business, and only with the parties below.

Suppliers and their warehouses — strictly to fulfil your order. A warehouse receives the delivery name and address, the contact phone number for the carrier, the items on its shipment, and the signature requirement. It does not receive your payment details, your order history, or the contents of shipments from other warehouses.
Carriers — the delivery name, address, phone number, package weight, hazard classification and adult signature requirement, so they can deliver and so you can track.
Payment processor — to authorise, capture and refund payments, and to perform fraud screening.
Service providers — hosting, email delivery, error monitoring, analytics, and customer support tooling, each under contract, each limited to processing on our instructions, and none permitted to use your data for their own purposes.
Where the law requires it — in response to a valid subpoena, warrant, court order or regulatory demand, to establish or defend legal claims, or where we believe disclosure is necessary to prevent serious harm. We do not volunteer customer purchase data to any government agency absent a legal obligation to produce it.
In a corporate transaction — if TAS is merged, acquired, or sells assets, customer data may transfer as part of that transaction, subject to this policy.

5. We do not sell your data

TAS does not sell personal information, and we do not share it for cross-context behavioural advertising. We do not rent, trade or license customer lists. What you buy is nobody else’s business, and in this category in particular we consider that a product decision as much as a legal one. We have not sold or shared personal information in the preceding twelve months.

6. Cookies, browser storage and analytics

We use a small number of cookies and similar technologies, including values stored by your browser on your own device:

Strictly necessary — session, cart contents, authentication, and security. The site does not work without these and they cannot be switched off.
Age confirmation — confirming you are 18 or older writes tas.age to local storage, holding the confirmation and its timestamp, and the entry prompt stays away on that browser for 365 days. Answering that you are under 18 writes an equivalent value to session storage, which your browser discards when the session ends. Both stay on your device; see section 1.
Preferences — remembering your ZIP code for shipping estimates, your dismissal of the announcement banner, and your facet and sort choices.
Analytics — first-party, aggregated measurement of page performance and site usage. We do not use third-party advertising pixels or retargeting tags.

You can block or delete cookies in your browser settings, and clearing site data for this domain removes the age confirmation along with everything else stored locally — the entry prompt will simply appear again on your next visit. Blocking strictly necessary cookies will break checkout. We honour the Global Privacy Control signal where your browser sends one, and treat it as an opt-out request under applicable state law.

7. How long we keep it

Account data — for as long as your account is open, and for 24 months after you close it, then deleted or anonymised.
Order and purchase records — retained for the period required by tax, accounting and firearms-related record-keeping law. Some purchase records must be kept even if you ask us to delete your account, and we will tell you which ones when you make a deletion request.
Checkout age and eligibility attestations, permits and licence copies — retained with the order they relate to, for the period the relevant state requires.
Support communications — 36 months.
Analytics and device data — 14 months in identifiable form, then aggregated.

8. Security

We encrypt data in transit with TLS and at rest, restrict internal access to personal information to staff who need it for their role, log administrative access, require multi-factor authentication on internal systems, and use a PCI DSS compliant processor so that card data never reaches our infrastructure.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your personal information we will notify you and the relevant authorities within the timeframes the law requires. Use a unique password for your TAS account and tell us immediately at privacy@topammosupply.com if you think it has been compromised.

9. Your rights and choices

Whatever state you live in, you can:

See what we hold about you, and get a portable copy of it.
Correct anything that is wrong.
Delete your account and the data we are not legally required to keep.
Opt out of marketing email, using the unsubscribe link in any marketing message or your account settings. Transactional order messages continue while an order is open.
Close your TAS+ membership without closing your account.

Most of this is self-service from your account area. For anything else, email privacy@topammosupply.com from the address on your account with the words “Privacy request” in the subject line, and tell us what you want.

10. State privacy rights

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana or another state with a comprehensive privacy law, you have specific statutory rights. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) these include:

Right to know — the categories and specific pieces of personal information we collected, the sources, the business purpose, and the categories of third parties we disclosed it to.
Right to delete — subject to the record-keeping exceptions in section 7.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing for cross-context behavioural advertising. As stated in section 5, we do not do either, so there is nothing to opt out of.
Right to limit the use of sensitive personal information. We do not use sensitive personal information for any purpose beyond providing the service.
Right to non-discrimination — exercising any of these rights will never change your pricing, your TAS+ benefits, or the service you receive.

How to make a request

Email privacy@topammosupply.com from the address on your account, stating which right you are exercising.
We verify your identity — usually by confirming control of the account email plus a detail from a recent order. For a deletion request we may ask for a second factor.
We acknowledge within 10 business days and respond substantively within 45 days, extendable once by a further 45 days where the request is complex. We will tell you if we need the extension.

An authorised agent may submit a request on your behalf with written permission signed by you. If we decline a request we will explain why, and you may appeal by replying to our response with the word “Appeal”; appeals are answered within 45 days.

11. Children’s privacy

TAS is not for children. We do not permit anyone under 18 to create an account, place an order, or join TAS+, and we do not knowingly collect personal information from anyone under 18. The service is not directed to anyone under 18, which is why the site asks for an age confirmation before it will open. That prompt collects no information from anyone, minors included — a visitor who answers that they are under 18 is turned away, and nothing about the answer reaches us. If we learn that an account belongs to a minor we close it and delete the associated data other than records we must keep by law. If you believe a child has given us personal information, contact privacy@topammosupply.com and we will remove it.

12. Changes to this policy

We may update this policy as the business or the law changes. The last-updated date at the top of this page always reflects the current version. Where a change materially affects how we use information we already hold, we will give notice on the site or by email before it takes effect.

13. How to contact us

[Registered entity name], trading as Top Ammo Supply
[Registered business address]

Privacy requests and questions: privacy@topammosupply.com
Order support: support@topammosupply.com
Everything else: the Help & Support page.