Client portal

Privacy & data handling

The client portal exists to assemble a federal firearm rights restoration application. That means handling court records, criminal-history reports and, for some clients, medical records. This page says plainly what we collect, why, who can see it, how long we keep it, and how to have it removed.

Last updated October 1, 2026.

What we collect

• Account details: your name and email address, through our sign-in provider, Clerk.
• Your intake form: your full legal name, other names used, date of birth, phone, mailing address, and how and when you prefer to be contacted. We never ask for your Social Security number or ID numbers through the portal.
• Review requests: the name, phone and email you enter in the free eligibility review form on our website, so we can call you back. If you answered the six-question check on the same visit, your answers come with it. If you tell us how you heard about us, we keep that too, along with the website or ad link that first brought you here (the site’s name and our page you landed on, not your browsing history).
• Permission to text: if you tick the box on that form, or tell us on a call, we record that you agreed, when, and the exact wording you agreed to.
• Your situation: which federal prohibition applies to you, the states you have lived in or been arrested in, and a few yes/no answers. These generate your document checklist from the Department of Justice rule.
• Documents you or our staff upload: court records, sentence-completion certificates, state and FBI criminal-history reports, military records, and, where the rule requires it, mental-health commitment or treatment records.
• Reference details: the name, email and relationship of the three character references you name. We do not contact them; DOJ does.
• Payment records: whether your client fee has been paid. Card details never touch our systems; they go to Stripe.
• An activity log: who viewed, uploaded, accepted or deleted each document, and when. This exists so access to your file is accountable.

Text messages

We text you only if you agreed to it, and only about your review request or your case. Agreeing is optional and never a condition of hiring us. Message frequency varies, and message and data rates may apply. Reply STOP at any time to opt out, or HELP for help, or ask us on the phone. We do not sell or share your mobile number or your permission to text with anyone for their marketing.

Why we collect it

One purpose only: to prepare a complete, correct package for your DOJ application and to advise you on it. We do not sell, rent, or share your information for marketing, and we do not use it to train any automated system. Your file is not used for anything you have not asked us to do.

Who can see it

• You, for your own case only. Every request is checked against your sign-in on the server; there is no way to reach another client’s file by guessing an address.
• NFRA staff assigned to review documents. Staff access is a role set by us in our database, never something a visitor can grant themselves.
• Service providers that host the portal: Vercel (hosting and private file storage), Neon (database), Clerk (sign-in), and Stripe (payments). Each holds only what its job needs.
• Nobody else without your direction or a valid legal demand. If we ever receive one, we will tell you unless the law forbids it.

How we protect it

• Documents are stored in a private store under random names and are encrypted in transit and at rest by the storage provider. Nothing in your file has a public link.
• Files can only be retrieved through the portal, which re-checks that you own the case on every request and records the access.
• We accept only PDF and image files, and we verify the file contents match the type. Files are always delivered as downloads, never rendered inside the site.
• Sign-in supports a strong password, one-time email codes, and Google. Compromised passwords are rejected.

How long we keep it

Your documents are kept while your case is open. 180 days after a case is closed, a scheduled job permanently deletes every stored document for that case. Your checklist, case notes and the activity log are kept so we can answer questions about what was done, but the files themselves are gone.

That window is long enough to cover DOJ’s 30-day cure period for an incomplete application and a conversation about reapplying, and short enough that we are not a long-term custodian of records you no longer need us to hold.

Deleting your data sooner

You do not have to wait. From your dashboard you can close your case and have every document deleted immediately. You can also call 866-FFRR-NOW (866-337-7669) and ask; we will confirm the request with you and do it the same business day. Deleting your sign-in account is done through the account menu in the portal.

What we ask of you

Only upload records about yourself, or records you are entitled to provide as part of your own application. Anything not in English needs a certified translation, which DOJ requires in any case.

Questions

Call 866-FFRR-NOW (866-337-7669). This page describes how the portal actually works; it is not legal advice about your application, and it will be updated if the way we handle data changes. See also our terms of service.