This page is an unexecuted working draft written to describe how NexusFFL actually handles data today. It has not been reviewed or approved by an attorney, it has not been adopted by [LEGAL ENTITY NAME], and it creates no rights or obligations for anyone. Do not rely on it. Bracketed blanks marked like [THIS] are unresolved and must be completed before this document is published.
The agreement between NexusFFL and the dealers who use it — including the part most compliance software soft-pedals: your ATF obligations remain yours.
Read section 3 first. No firearms recordkeeping software is, or can be, “ATF-approved,” “ATF-certified” or “ATF-compliant” on its own. Whether you may keep your bound book electronically is a determination ATF makes about you, on your request. NexusFFL is a tool. Compliance stays with the licensee.
These Terms of Service are a contract between [LEGAL ENTITY NAME] (“NexusFFL,” “we”), [REGISTERED BUSINESS ADDRESS], and the business that creates a NexusFFL organization (“you,” “Dealer”). By creating an account, or by using the service, you accept them. If you are accepting on behalf of a company, you represent that you are authorized to bind it.
The following are part of this agreement: our Privacy Policy, our Data Processing Addendum (which governs personal information you put into the service), our Subprocessors page, and any order form or plan page you sign up under.
NexusFFL is hosted, multi-tenant software for federally licensed firearms dealers. It provides acquisition and disposition (A&D) recordkeeping, electronic ATF Form 4473 capture and PDF generation, a searchable Form 4473 vault including scanned paper forms, a tamper-evident hash-chained audit log, inventory and point-of-sale checkout, compliance reminders and reports, and optional integrations (payments, accounting, webhooks and an API).
What it is not: NexusFFL does not contact NICS or submit anything to NICS or ATF on your behalf, does not perform background checks, does not verify a buyer’s identity or physical presence, does not transfer firearms, does not hold customer funds, and does not give legal advice.
You acknowledge and agree that:
The first account created for an organization becomes its owner. The owner adds and removes staff, assigns roles (owner, staff, or read-only inspector), and is responsible for everything done under the organization’s accounts. You agree to keep credentials confidential, to use individual accounts rather than shared logins (the audit log’s value depends on it), to remove access promptly when someone leaves, and to notify us at [SUPPORT EMAIL] as soon as you suspect a compromise. API keys and webhook secrets are credentials and must be treated as such.
You will not: use the service in violation of any federal, state or local firearms, export or privacy law; enter data you have no right to enter; use another dealer’s data or attempt to reach any organization other than your own; probe, scan or attack the service or use it to attack anything else (including by pointing a webhook at an address you do not control); resell or provide the service to third parties without our written agreement; reverse engineer it except to the extent that restriction is unenforceable; or use it to build a competing product. You will not use NexusFFL to compile, assemble or share information about firearm owners for any purpose other than keeping the records federal law requires you to keep.
You own your data. As between us, all records, forms, uploads and other content you put into NexusFFL remain yours. You grant us only the license needed to host, process, transmit, back up, display and return that data to you, and to provide support and the integrations you enable.
Personal information about your customers is handled under the Data Processing Addendum, which makes you the controller and NexusFFL the processor / service provider. We do not sell your data, do not use it for advertising, do not use it to train machine-learning models, and do not use one dealer’s data for another dealer’s benefit.
You can export your bound book as CSV, generate ATF-format PDFs, and download attachments at any time during your subscription. Take your export before you cancel.
Payment processing (NMI through your own gateway account, or Stripe), accounting sync (Intuit QuickBooks Online, Xero), outbound webhooks and the API are optional and off until you switch them on. When you do:
Plans and prices are shown at nexusffl.com/#pricing. [BILLING TERMS TO BE COMPLETED: billing cycle and currency, payment processor, auto-renewal and cancellation mechanics, trial length and what happens at trial end, taxes, late payment and suspension for non-payment, price-change notice period, refund policy, and any add-on module fees.]
Nothing in this section changes section 9: if your subscription lapses, you still need your records, and we will not use access to them as leverage.
This agreement runs until terminated. You may cancel at any time [CANCELLATION MECHANICS AND EFFECT ON THE CURRENT TERM]. We may suspend an organization for non-payment, a security risk to the platform, or a serious breach of section 5 — with notice where practical, and immediately where necessary to protect the service or other customers.
Records access on wind-down. Because the data in NexusFFL is data federal law requires you to keep, on termination or suspension we will give you a reasonable opportunity to export it in a usable form, and will not withhold your own records because of a billing dispute. We retain your data for [POST-TERMINATION RETENTION WINDOW] after termination and then delete it as described in the DPA. If you go out of business, delivering your records to the ATF National Tracing Center is your obligation as the licensee; we will help you produce a complete export for it.
We aim to keep NexusFFL available and to give you reasonable notice of planned maintenance, but the service is provided without a committed uptime guarantee unless a separate written service-level agreement says otherwise. [SUPPORT CHANNELS, HOURS AND TARGET RESPONSE TIMES; WHETHER ANY SLA OR SERVICE CREDIT IS OFFERED ON ANY PLAN.]
Backups are taken and encrypted nightly. Backups are a disaster-recovery measure for the platform, not a substitute for your own export discipline. Keep your own copies.
[NEXUSFFL IS ALSO DESCRIBED PUBLICLY AS AVAILABLE SELF-HOSTED. THE LICENSE TERMS, SUPPORT SCOPE, WARRANTY POSITION AND UPDATE/SECURITY-PATCH EXPECTATIONS FOR A SELF-HOSTED DEPLOYMENT ARE NOT SETTLED AND MUST BE DRAFTED OR THE OFFER WITHDRAWN.] Where a customer runs its own instance, the hosting, security, backup and ATF host-facility notice obligations described in these terms are entirely that customer’s.
NexusFFL, its software, interface, documentation, name and marks are ours (or our licensors’) and are licensed to you, not sold, for the term of your subscription. Feedback you send us we may use freely, without obligation. ATF forms and rulings reproduced in the product are U.S. Government works and are not claimed by us.
Except as expressly stated here, the service is provided “as is” and “as available,” without warranties of any kind, whether express, implied or statutory, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. We do not warrant that the service will be uninterrupted or error free, that its compliance detections will identify every reportable event, or that its use will satisfy any legal or regulatory obligation you have. We do not warrant that any ATF office will accept your variance request.
To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, revenue, goodwill or data, arising out of this agreement, even if advised of the possibility. Our total aggregate liability arising out of or related to this agreement will not exceed [LIABILITY CAP — e.g. fees paid in the 12 months preceding the claim].
[COUNSEL: CONSIDER WHETHER CARVE-OUTS ARE APPROPRIATE (e.g. for our breach of confidentiality or of the DPA’s security obligations, indemnity obligations, or willful misconduct), AND WHETHER THE CAP IS ENFORCEABLE AND COMMERCIALLY DEFENSIBLE GIVEN THE SENSITIVITY OF FORM 4473 DATA.]
You will defend and indemnify us against third-party claims arising from your data, your use of the service in violation of section 5, your failure to obtain a required ATF variance or to send a required notice, and your configuration of integrations or webhooks. [COUNSEL: DECIDE WHETHER NEXUSFFL OFFERS A RECIPROCAL IP-INFRINGEMENT INDEMNITY, AND ADD THE STANDARD PROCEDURE (NOTICE, CONTROL OF DEFENSE, COOPERATION).]
This agreement is governed by the laws of the State of Florida, without regard to its conflict-of-laws rules. [VENUE: NAME THE COUNTY AND COURTS. DECIDE WHETHER TO REQUIRE ARBITRATION AND A CLASS-ACTION WAIVER, AND IF SO ADD THE FULL CLAUSE, THE ARBITRAL FORUM AND RULES, AND ANY SMALL-CLAIMS OR INJUNCTIVE-RELIEF CARVE-OUT.]
We may update these terms; material changes take effect on [NOTICE PERIOD] notice to the email on your account, and your continued use after that constitutes acceptance. You may not assign this agreement without our consent; we may assign it in connection with a merger, acquisition or sale of assets, with notice. If any provision is unenforceable, the rest survives. Neither party is liable for delays caused by events beyond its reasonable control. These terms, with the documents incorporated in section 1, are the entire agreement between us and supersede prior discussions. Notices to us go to [SUPPORT EMAIL] and to [REGISTERED BUSINESS ADDRESS].
[LEGAL ENTITY NAME]
[REGISTERED BUSINESS ADDRESS]
[SUPPORT EMAIL]