Privacy Policy — Botach PD Buyback

Version 2026-10-18.2 · Effective 2026-10-18

Who we are

Botach, Inc. ("Botach", "we", "us") runs the PD Buyback portal at buyback.botach.com. When a police department retires the firearms its officers carry on duty, those officers can buy them through this portal. An officer finds the firearm the department listed for them, confirms it, enters their details, chooses or accepts the licensed firearms dealer (FFL) that will receive it, and pays by card. Botach then ships the firearm to that dealer, who completes the transfer.

This policy covers the portal only. It does not cover Botach's online store at botach.com.

Botach, Inc. · 4855 W Harmon Ave, Las Vegas, NV 89103 · United States · buyback@botach.com

Summary

• We use your information to let you buy the firearm your department listed for you, ship it to a licensed dealer, and keep the records the sale needs.
• We don't sell your information, and we don't use it for targeted advertising (ads chosen from your activity on other websites). The portal runs no advertising or analytics scripts. We do email you invitations and reminders about your department's buyback. Those emails are promotional, and you can unsubscribe at any time.
• You type your card into Authorize.net's payment form. Your card number never reaches Botach's servers.
• Officers' names, serial numbers, email addresses, phone numbers, billing addresses and IP addresses are encrypted in our database and deleted from it on the schedule under How long we keep it. If you buy, your order in Botach's online store is kept as Botach's record of the sale, and our service providers keep their own copies. What our software does not encrypt is listed under How we protect it.

Notice at collection

This section sums up what we collect from officers, why, and how long we keep it. The details follow below. We don't sell any of it or share it for advertising.

We don't collect characteristics of protected classes, biometric information or inferences about you. We use sensitive personal information only to process your payment, one of the purposes California law allows (Cal. Code Regs. tit. 11, § 7027(m)), so there is nothing to limit. For staff accounts, see Information about Botach staff.

Where your information comes from

• From your department. The department gives Botach its trade-in list: each firearm's serial number and the officer it is assigned to, with the officer's name and, where the department has them, email address and phone number.
• From you. The serial number and last name you enter to find your firearm; your full legal name, email, phone and billing address; the FFL you choose; and your acceptance of the Terms of Sale.
• Automatically. Your IP address and browser details when you use the portal, the cookies described under Cookies, and the result of an automatic bot check.
• From our service providers. Whether your payment was approved and whether the billing address and card code matched (Authorize.net); your order number, tax, and the carrier and tracking number of the shipment (Botach's store); and whether an email to you bounced or was marked as spam (our email provider).
• Public records. FFL names, addresses, phone numbers and license numbers come from the ATF's public list of licensed dealers.

What we collect and why

The tables in this section are generated from our data inventory: the list of every database column and of the other places where the portal handles personal data. Our software checks the database part of that list every time it is built, so a column that is missing from it stops the build.

Information about officers

These are the details that identify you: your name, your firearm's serial number, your email address, phone number and billing address, and the IP address and browser you used. Before our software saves them in its own database it encrypts each one (AES-256-GCM), and the encryption keys are kept outside the database. Copies held by our service providers, such as your order in Botach's online store, the payment at Authorize.net and the emails Resend sends, are not encrypted by our software. The table also lists details you type that we use for one request and never store as you typed them: the serial number and last name on the lookup form, and the ZIP code you type to search for a dealer.

Search keys derived from officer information

To find a record without decrypting it, we store keyed digests (HMAC-SHA256) of serial numbers, surnames, full names and email addresses, and of the details a checkout was built from. Rate limiting on lookups uses the same kind of digest of your IP address. When an address unsubscribes, marks an email as spam or bounces, we keep a digest of it on our suppression list so we never send it reminders again, in any later buyback. The unsubscribe link in our emails carries a signed token built from a digest of your address, never the address itself. The digests are made with a secret key that is kept outside the database, so the database alone does not give anyone the original names, serial numbers or addresses.

Email delivery status

We record whether email to an officer's address bounced, was marked as spam, or whether the officer unsubscribed from reminders, so that we stop emailing that address. Our email provider reports bounces and complaints to us.

Information about Botach staff

Botach staff sign in to the staff area with emailed sign-in links or passkeys. We keep each staff member's work email and name, the label they give each passkey, the IP address and browser of their sessions, and an audit trail of what they did in the portal. We also hold the owner's email address in our hosting configuration, because every critical alert email goes to it. Our software does not encrypt any of this. When anyone asks for a staff sign-in link, the request is counted for 10 to 60 seconds under a keyed digest of its IP address, never the raw address, to limit repeated requests. The audit log records the raw IP address of such a request only when the email address asked for is not a staff address.

Department contacts

Staff may note a contact person at the department, such as a name, phone number or email address, to reach the department about its buyback. Our software does not encrypt this note.

Names that can appear in staff files and labels

Some free text isn't meant to hold personal data but can: the name of a spreadsheet a department sent (for example "Smith_John_P365.xlsx"), a gun-model label, or the name staff give a saved column layout. We treat it as personal data. It is not encrypted, it stays with the trade's records (saved layouts until a delete feature exists), and only a masked form of a file name ever reaches the AI service described under How we use it.

Security records

These records keep the portal secure: staff session tokens and sign-in link tokens (a sign-in link's token and an officer's claim session token are stored only as hashes), passkey public keys, rate-limit counters, bot-check results, staff alerts, browser security reports (the page, the rule and the blocked source only), our hosting provider's request logs and our database provider's short recovery history.

Records about trades, firearms and payments

These records run each buyback: the trade and its settings, gun models and prices, whether a firearm is available, reserved or paid, the steps of each claim, the receiving dealer's name, address and phone (public ATF data, so a sole proprietor's own name can appear), payment and order numbers, totals and tax, the result letters Authorize.net returns for the address and card-code checks (never the card details), what you accepted at checkout and when, the email log, and the state of scheduled jobs. None of them is an officer's name or contact detail. Some are linked to an officer's record and are deleted with it.

What we do not collect

• Your date of birth, driver's license or Social Security number. The FFL checks your identity and eligibility when it completes the transfer with you.
• Your card number, expiration date or card security code on Botach's systems. You type them into the payment form of Authorize.net, our payment processor, which collects them for us only to process your payment. Botach's servers never receive them.
• Your precise location. The FFL search uses only a ZIP code you type.

How we use it

• To find your firearm when you enter its serial number and last name, and to stop anyone else from guessing. We use automatic bot checks and limits on repeated attempts, and we log lookups with a coded digest, never your serial number or name as typed. These checks can refuse a lookup automatically; they decide nothing else about you.
• To hold the firearm for you while you complete your claim.
• To calculate tax and create your order in Botach's online store, and to take your card payment through Authorize.net. Authorize.net screens each card payment with its own fraud filters, which use your IP address.
• To ship the firearm to the FFL that will transfer it to you, after checking that the FFL's license is active.
• To call or email you about your order and its transfer, if we need to. We never use your phone number for marketing calls or texts, and we don't send text messages.
• To email you about this buyback: an invitation, reminders until you claim or the buyback closes (each with a link to unsubscribe), your order confirmation and, when Botach's store doesn't send one, a shipping notice. Unsubscribing stops invitations and reminders; it doesn't stop the order confirmation or shipping notice.
• To email Botach staff: sign-in links, and the notifications each staff member chooses (claims, a daily summary, milestones and alerts).
• To keep the records a card dispute or a legal obligation may need (see How long we keep it).
• To help staff import a department's spreadsheet. When our software can't match the columns by itself, it sends the sheet's column headings, the shape of the values in each column (for example "99A999999" in place of a serial number) and a masked file name to an AI service, which suggests which column holds what. A heading is sent as written only when it is made of ordinary header words such as "Serial number". Every other heading, every value and the file name are replaced by their shape, so names, serial numbers, emails and phone numbers are never sent.
• To protect the portal and its users, including alerts to Botach staff about unusual lookup activity, payment mismatches and problems with the FFL database.

We don't sell your information or use it for targeted advertising. Apart from the buyback invitations and reminders described above, we don't use it to market other products to you.

Who we share it with

• Our service providers, listed in the next section, who process it for us to run the portal.
• The receiving FFL (a third party, not our service provider). The firearm ships to the FFL you choose or accept, and that FFL completes the transfer with you under federal law. It keeps its own records, including ATF Form 4473, and has its own privacy practices. Botach's store records your email address on the shipment to the FFL, so the store's fulfilment services can see it.
• Your department. We don't send your department a list of the officers who bought their firearms.
• When the law requires it, for example under a subpoena or court order, or when the ATF inspects Botach's records.
• If Botach's business is sold or merged, the records may pass to the new owner under this policy.

We do not sell your personal information or share it for cross-context behavioral advertising.

Officers' home addresses

Your billing address is often your home address. We use it to verify your card and to record your order, and we never publish it. It goes only to the service providers that need it to complete your purchase: Botach's store (BigCommerce) and, through the store, its tax, fulfilment and FFL-webhook services, and Authorize.net.

Some laws let law-enforcement officers, judges, prosecutors and their families ask a business to stop disclosing their home address or personal phone number. One example is New Jersey's Daniel's Law (N.J.S.A. 56:8-166.1). You, or someone you authorize, can make that request by emailing buyback@botach.com with the subject "Address non-disclosure request", or by writing to us at the address under Contact us. Within 10 business days of receiving it, we stop disclosing your home address and personal phone number, and we confirm that in writing. If you have an order in progress, we contact you first, because we can't complete a card purchase without sending your billing address to our payment and store providers.

Service providers

These companies process information on Botach's behalf to run the portal. Under each name is the information it receives, generated from our data inventory. Vercel runs the portal and Neon holds its database, so they handle every record; their lists count the records in each category. Vercel, Neon and Upstash keep the portal's data in the United States, in the US East (Virginia) region.

Vercel

Vercel hosts the portal and runs its code. Every request to the portal passes through Vercel, which keeps request logs: the time, path, status, IP address and browser, and any query string in the address, including the token in an unsubscribe link. Vercel keeps these logs for 1 day, and no log drain copies them elsewhere. Vercel BotID, a Vercel service, checks lookup requests for bots. A small script, served from this site, runs in your browser and works out a challenge answer from technical details of your browser. The answer is sent with your lookup and checked by Vercel. BotID sets no cookies, loads nothing from other websites and uses no embedded frame. We use only its basic check; its optional deeper analysis, which Vercel's partner Kasada provides, is turned off.

Neon

Neon hosts the portal's Postgres database and encrypts stored data at rest. Officer details are encrypted by our software before they reach Neon. Neon keeps a short point-in-time history of the database so it can be restored after an accident (see How long we keep it).

Resend

Resend sends the portal's emails: invitations, reminders, order confirmations and shipping notices for officers, and sign-in links and notifications for staff. Each email reaches Resend with its recipient address, subject and body. For officers that is the department name, the gun model, the deadline and, for orders, the order number, the total, the dealer's name, city and state, the last 4 characters of the serial number and, in a shipping notice, the carrier and tracking number. Emails to officers do not carry your name. Resend tells us when an email bounces or is marked as spam, and keeps its own copy of each email for 30 days.

Upstash

Upstash stores the counters that slow down repeated lookups, sign-in requests and browser security reports. Counters are keyed by keyed digests of the requester's IP address and of the serial number, by a random device id and by the trade, never by a raw IP address, serial number or name. Counters expire on their own, the longest within about two days.

BigCommerce

BigCommerce runs Botach's online store, where your order is created. BigCommerce receives your name, email, phone and billing address, the receiving dealer's address, the firearm model and serial number (in the item name, a staff note and the order's extra data fields), the amounts and the Authorize.net transaction number. When your order ships, BigCommerce also gives us the carrier and tracking number for your shipping notice. The store passes the order on to the three services below, which work for Botach's store, not for the portal.

TaxJar, through Botach's store

TaxJar (via BigCommerce) is the store's tax service: it calculates and reports the sales tax on your order. The portal never sends it anything directly.

Veeqo, through Botach's store

Veeqo (via BigCommerce) is the system Botach uses to fulfil store orders. It receives the order from the store, including the firearm's serial number in the item name, so the right firearm is packed and shipped to the FFL.

The FFL transfer webhook, through Botach's store

FFL transfer webhook (via BigCommerce): the store sends each firearm order, by webhook, to the receiver Botach uses for FFL orders.

Authorize.net

Authorize.net, a wholly owned subsidiary of Visa, processes card payments. You type your card into Authorize.net's payment form inside our page, so the card number never reaches Botach's servers. Authorize.net also receives your name, billing address, email and phone, the receiving dealer's address, the amount and the order number. Your browser sends Authorize.net your IP address, which it stores with the transaction and uses in its own fraud filters. It tells us whether the payment was approved and whether the address and card code matched.

Vercel AI Gateway

Vercel AI Gateway passes the staff spreadsheet-import requests described under How we use it to an AI model provider (our software currently asks for Anthropic's Claude models) and asks it to use only providers with a verified zero-data-retention agreement. Vercel AI Gateway receives only column headings made of ordinary header words, masked value shapes and masked file names. It never receives names, serial numbers, emails or phone numbers.

Cookies

The portal itself uses only the cookies it needs to work. There are no advertising or analytics cookies, and the bot check sets none. Staff who sign in also get a session cookie for the staff area.

Tracking across websites. Neither Botach nor Vercel collects information about your activity over time and across other websites through the portal. Because we don't track you across websites, sell your information or share it for advertising, we treat a browser's "Do Not Track" or Global Privacy Control signal the same as no signal: there is nothing for it to switch off. If that ever changes, we'll honor Global Privacy Control as a request to opt out.

How long we keep it

• Officer information from your department is deleted 30 days after the buyback closes. If you bought your firearm, the records of your purchase (your claim, the firearm, your officer record, your order confirmation and shipping notice records, and the payment records) are kept until 18 months after the last recorded step on the order (such as payment, refund, shipment, order hold or a later update), so we can answer a card dispute. Then they are deleted. If a buyback is set up but never opens, or has no deadline, its officer data is kept until Botach closes it, and for no more than 12 months.
• Claims that never reached payment are deleted 30 days after the buyback closes. A claim whose payment is still being settled at that point is deleted once it settles.
• Our email log records each email we send (which email, when, whether it was delivered, and a digest of the address, never the address itself) and is kept for 1 year; the rows for order confirmations and shipping notices are kept with the purchase records above. The rendered email is stored, encrypted, only while it is being sent (normally minutes; about 24 hours, longer if our scheduled jobs are down).
• Our unsubscribe list. If you unsubscribe, mark an email as spam, or an email to you bounces, we keep a digest of your address, never the address, for as long as Botach sends buyback email, so you never get reminders again. It is not deleted with your other information.
• Uploaded spreadsheets are never stored as files. Their contents are kept encrypted only while staff review an import, and are deleted when the import finishes or within about a day of upload. A spreadsheet's file name, which can contain a name, is kept with the trade's records, as are gun-model labels.
• Security and audit logs are kept for 1 year, and staff alerts for 1 year after they are resolved. They never hold officer names or serial numbers in readable form (lookups are logged with keyed digests). They do record which staff member acted, staff email addresses when staff accounts change, and the IP address of anyone who asks for a staff sign-in link with an address that isn't a staff address.
• Staff accounts are kept after a staff member is removed; removal ends their sign-in sessions.
• Your order in Botach's online store is Botach's business record of the sale and is not deleted by the portal. It is kept as Botach's business and tax records for as long as the law requires.
• Backups. After we delete information, it stays in our database provider's recovery history for up to 7 days, and then it is gone. If we ever restore the database, the provider also keeps a backup branch holding the database as it was before the restore. We delete that backup branch the same day. Where the provider doesn't allow a backup branch to be deleted, we drop its data the same day instead.
• Request logs. Our hosting provider keeps request logs (time, path, status, IP address, browser and any query string, including the token in an unsubscribe link) for 1 day. No log drain copies them elsewhere.
• Legal holds. If the law requires us to keep records, for example for a dispute or a court order, we may pause the deletion described here.
• Our other service providers keep their own copies under their own retention rules: Authorize.net's transaction records, the store's order (and the copies kept by the store's tax, fulfilment and FFL webhook services), and Resend's copy of each email (30 days).

Every hour our software checks these rules and deletes what is due. The full list, generated from our data inventory:

How we protect it

• Officers' names, serial numbers, contact details, billing addresses and IP addresses are encrypted in our database (AES-256-GCM) with keys kept outside it. Staff names, emails and session details, the department contact note, and file names and labels staff enter are not encrypted by our software.
• Lookups compare keyed digests. They never compare stored names or serial numbers in readable form.
• The portal is served only over HTTPS with HSTS, under a strict content security policy, and runs no third-party scripts on officer pages.
• Lookups are protected by bot checks and limits on repeated attempts, and every miss gets the same answer, whatever the reason.
• Only invited Botach staff can sign in to the staff area, with emailed sign-in links or passkeys, and their actions are logged.
• Card details are entered only into Authorize.net's payment form.

No system is perfectly secure, and we can't promise that information will never be lost or misused.

Your choices and rights

Wherever you live, you can ask us to:

• tell you whether we hold information about you, what it is, where it came from, why we use it and who we share it with, and give you a copy;
• correct information that's wrong;
• delete information about you. If you ask while your department's buyback is open and before you've claimed your firearm, you won't be able to claim it through the portal.
• give you a copy of the information you gave us, in a common electronic format.

We may keep what the law lets us keep, even if you ask us to delete it: the records of a purchase until their 18-month dispute period ends, because we may need them to answer a card dispute; records we must keep by law, including firearms records; and the coded entry on our unsubscribe list that makes sure we never email you again.

We don't sell your information, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, so there is nothing to opt out of. We won't deny you anything, charge you differently or treat you worse for using these rights. That includes Botach employees.

• How to ask. Email buyback@botach.com, or write to Botach, Inc., Attn: Privacy, at the address under Contact us. You don't need an account.
• How we confirm it's you. We'll send a code to an email address we already hold for you: the one your department gave us, or the one you used at checkout. We'll also ask for two more details we hold, such as your order number, the last 4 characters of your firearm's serial number, or your billing ZIP code. For a copy of specific information, we'll also ask you to sign a statement, under penalty of perjury, that you are the person the information is about. We won't ask for ID documents, and we use what you give us only to confirm your request, and then delete it.
• Someone acting for you. An authorized agent can make a request for you with your signed permission. We may still ask you to confirm your identity with us directly.
• When we answer. We'll confirm we received your request within 10 business days and answer within 45 days. If we need more time, we'll tell you why within those 45 days and answer within 45 more. Requests are free, at least twice a year.
• Unsubscribing. Every invitation and reminder has an unsubscribe link. Unsubscribing stops invitations and reminders sent to that address, in this buyback and any later one. It doesn't stop the order confirmation or shipping notice for a firearm you buy.
• Your home address. If a law protects your home address because of your work, see Officers' home addresses.

Appeals and state-law details

• Appeals. If we turn down your request, in whole or in part, we'll tell you why. You can appeal by replying to our answer, or by emailing buyback@botach.com with "Appeal" in the subject. We'll answer your appeal in writing within 60 days and explain our decision. If we deny it, you can complain to your state attorney general: in Texas, through the Attorney General's consumer complaint page. In California you can also contact the California Privacy Protection Agency.
• Nevada. We don't sell personal information. You can still send a request not to sell to buyback@botach.com, our designated request address.

Children

The portal is only for adult law-enforcement officers. It isn't directed to anyone under 18, and we don't knowingly collect personal information about anyone under 18. We don't sell or share anyone's personal information, so we have no actual knowledge of selling or sharing the information of anyone under 16.

Changes to this policy

When we change this policy, we publish the new version here with a new version number and its date. We review this policy at least once a year. Each time an officer accepts the Terms of Sale at checkout, we record the versions of the Terms of Sale and of this policy that were in effect.

Contact us

Email buyback@botach.com, or write to Botach, Inc., 4855 W Harmon Ave, Las Vegas, NV 89103, United States. Send privacy requests to that email address, or by post to that postal address.