TAS Legal

Your Privacy Choices

Last updated August 9, 2026

This page sets out the privacy rights US state law gives you over the personal information TAS holds, and exactly how to exercise each of them with us.

Phase 1 note: this document is a structurally complete template. It has not yet been reviewed by counsel and must be before any real sale is made.

1. Who this page is for

A growing number of US states have comprehensive privacy laws that give residents rights over their personal information. California came first with the CCPA as amended by the CPRA; Virginia, Colorado, Connecticut and Utah followed; Texas, Oregon and Montana joined them; and more states bring their own statutes into force each year. Several other states have narrower laws covering health information, genetic data or the sale of data specifically.

The statutes differ in their thresholds, their definitions and their deadlines, but they converge on the same set of rights, which is why this page is organised by right rather than by state. Rather than maintain a table of who gets what — which would be out of date within months and would invite us to give one resident less than another — TAS extends the rights in section 4 to every customer in the United States, whatever state you live in.

Where your state’s law gives you something this page does not mention, you have that too. Nothing here limits a right you hold under law. What personal information we collect in the first place, and why, is on the Privacy Policy; what we store in your browser is on the Cookie & Local Storage Policy.

2. We do not sell or share your information

TAS does not sell personal information, and does not share personal information for cross-context behavioural advertising. Not for money, and not for the “other valuable consideration” that state law also counts as a sale. There is no data broker relationship, no advertising co-operative, no audience-matching or list-rental arrangement, and no advertising pixel on this site passing your activity to a third party.

That is why you will not find a “Do Not Sell or Share My Personal Information” toggle here. A control that switches off something that does not happen would be decoration. The commitment is the substance, and it is checkable: the Cookie & Local Storage Policy lists every storage key and every third-party script on this site by name, and there is no advertising technology among them.

We do use service providers — payment processing, fraud screening, hosting, shipping carriers, customer support tooling, and the suppliers whose warehouses ship your order. Each receives only what it needs to do its job, under a written contract that forbids using your information for its own purposes. Under state law that is a service provider or processor relationship, not a sale, and it is not something you need to opt out of to be protected.

If this ever changes, it changes in the open: this page and the cookie policy would be updated before any such disclosure began, and an opt-out control would be live on the day it started, not added later.

3. Sensitive information

State privacy law defines a category of “sensitive personal information” that gets stronger protection — government identifiers, precise geolocation, account credentials, and information about health, race, religion, sexual orientation or immigration status among others.

We go further than the statutory list in one specific respect. TAS treats what you buy from us as sensitive, whether or not the statute in your state says it has to be. A record of the calibers you buy, in what quantity, delivered to your home address is not ordinary retail data. It says something about what you own and where you keep it. Accordingly:

Purchase history is used to fulfil your order, to support you afterwards, to handle returns and safety recalls, and to meet legal and tax obligations. It is not used for anything else.
We do not build advertising audiences or interest profiles from it, here or on any other platform, and we do not disclose it to anyone who would.
It is not sold, rented, traded or provided to data brokers, insurers, or firearms-registry aggregators.
Access inside TAS is limited to staff who need it to do their job, and disclosure to law enforcement is dealt with in the Privacy Policy, which sets out when we require legal process.
Government identifiers presented to satisfy an age, permit or licence requirement are used for that check and retained only as long as the law requires us to evidence it.

Because we already confine sensitive information to the permitted purposes, exercising the “limit use” right in section 4 changes nothing about how we handle it. You are welcome to exercise it anyway, and we will confirm in writing what we do.

4. The rights you have

Each of these is available to you by writing to the address in section 6. You do not need to cite a statute, quote a section number, or say which state you live in to make a valid request.

Privacy rights TAS extends to every US customer, and the limits that genuinely apply to each. Where a limit applies, we state it in the response rather than declining without explanation.
Right	What you can ask for	Limits that apply
Know and access	Ask what categories of personal information we have collected about you, where it came from, why we collected it, who we disclosed it to, and receive a copy of the specific pieces we hold.	We will not disclose government identifiers, full payment card numbers, account passwords or answers to security questions in any response, because sending them is a greater risk to you than not having them.
Delete	Ask us to delete the personal information we hold about you, and to instruct our service providers to do the same.	We must retain records of completed transactions for tax, accounting, product safety and anti-fraud purposes, and for as long as any legal obligation requires. We will tell you specifically what was kept and why, and delete the rest.
Correct	Ask us to fix personal information about you that is inaccurate — a misspelled name, an out-of-date address, a wrong phone number.	We may ask for documentation where the correction is material, and we take account of the purpose the information is held for.
Portability	Receive the personal information you gave us in a structured, commonly used, machine-readable format that you can move elsewhere.	Portability covers information you provided to us, not internal analysis or inferences we generated.
Opt out of sale or sharing	Direct us not to sell your personal information and not to share it for cross-context behavioural advertising.	There is nothing to opt out of today — see section 2. The right stands regardless, and honouring it is unconditional if that ever changes.
Opt out of targeted advertising	Direct us not to use your personal information to serve you advertising based on your activity across different sites and services.	We do not run targeted advertising of this kind. Section 2 explains what we would have to do first.
Opt out of profiling	Direct us not to subject you to automated processing that produces legal or similarly significant effects about you.	We do not make automated decisions of this kind. Fraud and compliance screening is reviewed by a person before an order is refused, and a refused order comes with a stated reason and a route to challenge it.
Limit use of sensitive personal information	Direct us to use sensitive personal information only for the purposes the law permits without your consent — completing your order, security, and preventing fraud.	This is already how we operate; see section 3. Exercising it changes nothing about your order.
Non-discrimination	Exercise any of the above without being charged more, given worse service, or refused as a customer.	No limits. See section 12.

You may also opt out of marketing email at any time, through the unsubscribe link in any marketing message or by asking us. That is separate from the rights above and takes effect immediately. We will still send transactional messages about orders you have placed — order confirmations, shipment tracking, compliance holds and recall notices — because those are not marketing and you cannot be left uninformed about an order in flight.

5. Global Privacy Control

TAS honours the Global Privacy Control (GPC) as a valid opt-out preference signal. GPC is a setting in your browser or extension that transmits an opt-out-of-sale-and-sharing request automatically to every site you visit, so you do not have to click through a preference centre on each one.

If your browser sends a GPC signal, we treat it as a request to opt out of the sale of your personal information, the sharing of it for cross-context behavioural advertising, and its use for targeted advertising. We do not require you to create an account, log in, or confirm the signal a second time before it takes effect. We do not second-guess whether the signal was set by you or by your browser vendor, and we do not treat it as an inferior form of opt-out.

Because we do not sell or share personal information at all — section 2 — a GPC signal currently produces no change in how your information is handled. There is nothing for it to switch off. We honour it regardless, and it will be operative from the first day there is anything for it to act on.

A GPC signal is browser-specific and device-specific. It applies to the browser sending it, not to every device you own, and it does not by itself constitute a request to delete or correct anything. Use section 6 for those.

6. How to submit a request

Email privacy@topammosupply.com with “Privacy Request” in the subject line. Tell us:

Which right you are exercising — know, delete, correct, port, opt out, or limit. Plain language is fine. “Please delete everything you have on me” is a valid request.
The email address you used with us, and any order number you have, so we can find the right records.
For a correction, what is wrong and what it should say instead.
Whether you are acting for yourself or as an authorised agent for someone else — see section 10.

You can also write to us at [Registered entity name], [Registered business address], marked for the attention of the Privacy team. Postal requests are handled on the same timelines as email; the clock starts when it arrives.

TAS operates exclusively online and has a direct relationship with its customers, so email is our designated request channel and no toll-free number is required for privacy requests. If you cannot use email or post because of a disability, call the order line on the Accessibility Statement page and we will take the request by phone and confirm it in writing.

Requests are free. We will only charge, or decline, if a request is manifestly unfounded or repetitive — and if we do, we will say so, say why, and tell you how to appeal under section 9.

7. How we verify who you are

We have to be sure a request comes from you. Handing your order history to someone who merely knows your email address would be a worse privacy failure than any request we could refuse.

Verification is proportionate to the sensitivity of what is being asked for:

Opt-out requests require no verification. Opting out of sale, sharing or targeted advertising carries no risk to you if the requester is not you, so we act on it and do not put obstacles in front of it.
Access, correction, portability and deletion require us to match you to an existing record. We will ask you to confirm the request from the email address on the account, and to confirm details that only the account holder would readily know — an order number and approximate date, the delivery ZIP code, the last items ordered.
Requests for specific pieces of information, as opposed to categories, carry the highest bar. We may ask for a signed declaration under penalty of perjury that you are the person whose information you are asking for.

We ask for the least we can. We will not require you to create an account to make a request. Anything you send purely to verify a request is used only for that purpose and deleted as soon as the request is closed. We will not ask you to email us a photograph of your driver’s licence unless there is no other way to verify a high-risk request, and we will say so explicitly if we do.

If we cannot verify you, we will tell you why and what would satisfy us, rather than closing the request in silence.

8. How long we take

Our response timelines. Where a state law is stricter than what is shown here, the stricter deadline applies to your request.
Stage	Timeline
Acknowledgement of receipt	Within 10 business days
Substantive response	Within 45 calendar days of receipt
Extension, where genuinely needed	One further 45 days, with notice to you before the first period expires, stating the reason
Opt-out requests and GPC signals	Acted on promptly, and in any event within 15 business days
Appeal decision	Within 45 days of the appeal

Verification time counts against these deadlines, so the fastest route is to send the details in section 6 with the first message.

9. If we refuse a request

If we decline a request in whole or in part, our response will say which parts were declined, the specific reason, and what information was retained and under what legal basis. “Denied” on its own is not an answer.

You can appeal any refusal. Reply to our response, or write again to privacy@topammosupply.com with “Appeal” in the subject line, within 60 days. The appeal is reviewed by someone who was not involved in the original decision, and we will respond within 45 days in writing, explaining the reasons for the outcome.

If the appeal is refused as well, we will tell you how to complain to your state Attorney General or the relevant regulator, and provide any reference you need to do it. Several state laws require that, and it is also simply the right thing to include in the letter.

10. Authorised agent requests

You can appoint someone else — a family member, a lawyer, a privacy service — to make a request on your behalf. To act on an agent’s request we need:

Written permission from you, signed and dated, authorising that specific agent to make that request; or a valid power of attorney under your state’s Probate Code, in which case nothing further is needed from you.
Verification of you, the consumer, under section 7 — unless a power of attorney applies.
Confirmation from you directly that you gave the agent permission, which we may ask for by email to the address on the account.

We verify the agent’s own identity too. Where an agent submits requests in volume, we still treat each one as an individual request from an individual consumer, on the timelines in section 8.

A parent or legal guardian may make a request on behalf of a minor child, with proof of that relationship.

11. Minors

This site is not directed to children and TAS does not knowingly collect personal information from anyone under 18. A site-entry age gate asks you to confirm you are 18 or older before you can browse; it stores your answer in your own browser and transmits nothing. Federal law sets the purchase minimum at 18 for rifle and shotgun ammunition and 21 for handgun ammunition, and we check again at checkout and at delivery.

Because we do not knowingly collect information from minors, there is nothing for us to sell or share, and the affirmative consent requirements that several state laws apply to consumers under 16 do not arise. If you believe a minor has given us personal information, email privacy@topammosupply.com and we will delete it.

12. No penalty for asking

Exercising any right on this page costs you nothing and changes nothing about how you are treated as a customer. We will not deny you goods or services, charge you a different price, apply a penalty, give you a lower level of service, or suggest that you will receive any of those, because you made a request.

We do not run a financial incentive programme that trades a discount for your personal information. TAS+ membership is a paid subscription with published benefits; it is not a data-for-discount arrangement and joining or leaving it has no effect on your privacy rights.

There is one honest consequence worth stating, and it is a practical one rather than a penalty: if you ask us to delete your information, we lose your order history, your saved addresses and your saved items, and we cannot look up a past order for you afterwards. We will tell you that before we act, not after.

13. Changes to this page

State privacy law is moving quickly, and this page is reviewed as new statutes take effect and at least annually. The “last updated” date at the top changes when the document does.

The commitment in section 2 — no sale, no sharing for cross-context behavioural advertising — is the one most worth watching. If it ever changes, it will be stated here prominently and in advance, with a working opt-out control live before the practice begins.

14. How to contact us

Privacy requests and questions: privacy@topammosupply.com
Postal: [Registered entity name], [Registered business address], attention Privacy team.
Order support: support@topammosupply.com
Support hours: Monday to Friday, 8am to 6pm Eastern.
Related reading: Privacy Policy, Cookie & Local Storage Policy, and the Terms of Service.