https://www.atf.gov/resource-center/doc ... e/download
That's a PDF with all of the information you're looking for. Section D, paragraphs 1 through 3 are particularly relevant. I've made the key parts you're looking for bold.
(d)(1) Any records containing any of the information set forth in paragraph (a)(1) pertaining to a potential buyer or transferee who is not found to be prohibited from receipt or possession of a firearm by reason of § 1448 of this title or federal law shall be confidential and may only be disclosed by any officer or employee of the SBI to other law enforcement agencies. The SBI and any other law enforcement agencies shall destroy any such records after it communicates the corresponding approval number to the licensee and such records shall be destroyed within 60 days after the day of receipt of the licensee's request.
(2) Notwithstanding contrary provisions of this subsection, the SBI shall maintain a log of dates of requests for criminal history record checks and unique approval numbers corresponding to such dates for a period of not longer than 1 year.
(3) Nothing in this section shall be construed to allow the State to maintain records containing the names of licensees who receive unique approval numbers or to maintain records of firearm transactions, including the names or other identification of licensees and potential buyers or transferees, involving persons not prohibited by § 1448 of this title and federal law from the receipt or possession of firearms. However, the SBI may retain whatever information it receives including, but not limited to, the identifying information of potential buyers or transferees, if the SBI has probable cause to believe the potential buyer or transferee is committing a crime.
Federally, there is the Firearm Owners Protection Act of 1986 which states:
No such rule or regulation prescribed [by the Attorney General] after the date of the enactment of the Firearms Owners Protection Act may require that records required to be maintained under this chapter or any portion of the contents of such records, be recorded at or transferred to a facility owned, managed, or controlled by the United States or any State or any political subdivision thereof, nor that any system of registration of firearms, firearms owners, or firearms transactions or disposition be established. Nothing in this section expands or restricts the Secretary's authority to inquire into the disposition of any firearm in the course of a criminal investigation.
I couldn't find a PDF of the entire act, but here's a link to the Wikipedia page for the law:
https://en.wikipedia.org/wiki/Firearm_O ... ection_Act
And here's a summary from Congress.gov:
https://www.congress.gov/bill/99th-cong ... te-bill/49
The relevant part is the fifth paragraph from the bottom.
I hope all of this helps.