Privacy Policy

Oak Tree Gun Club LLC, a limited liability company formed in California, United States ("Oak Tree," "we," "us," or "our"), operates the https://www.oaktreegunclub.com website (the "Website"). This Privacy Policy explains what personal information we collect through the Website, how we use it, who we share it with, and the choices and rights you have. It is written to satisfy the California Online Privacy Protection Act (CalOPPA) and, where applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

Your access to or use of the Website is conditional on your acceptance of this Privacy Policy. By accessing or using the Website, you agree to be bound by it. If you disagree with any part of this Privacy Policy, please do not use the Website.

1Information We Collect

We collect personal information in three ways: information you submit directly, information collected automatically, and limited information from service providers we use to operate the club.

Information you submit

Every online submission also carries a random reference generated in your browser, so a retried submission is not recorded twice. The Website has no accounts, no newsletter sign-up, and no membership or youth-registration forms; those are handled on our online store or in person.

Information collected automatically

When you visit, Cloudflare, which hosts the Website, processes your IP address, browser type, and the pages you request in order to serve the site, keep it secure, and produce aggregate, cookieless visit counts. Google receives your IP address and browser details when your browser downloads our web fonts. When you submit a form, Cloudflare Turnstile checks that you are not a bot; we pass it your IP address for that check only and do not store it with your submission. We do not run Google Analytics, advertising trackers, or tracking pixels.

Information from service providers

We receive confirmation from Smartwaiver that a waiver was completed. Our own reservation system records whether a confirmation email was sent. We do not purchase personal information from data brokers, and we do not collect personal information from social networks.

Information we do not collect through the Website

The Website does not process payments and does not sell firearms, ammunition, or merchandise. After you reserve class seats, you pay on our separately operated online store (californiagungirls.com and store.oaktreegunclub.com) or at check-in. Memberships and merchandise are sold on that store too. It runs on the Gearfire platform and has its own privacy policy; the Website links to it and does not send it your information. If you pay for a class through that store, we may use its order confirmation (your name, email address, phone number, order number, and items) to mark your reservation as paid. In-person retail purchases, firearm transfers, and the records required for them under federal and California law are not collected through the Website.

2How We Use Information

We use personal information to:

• Schedule, confirm, and manage reservations, classes, lessons, and events
• Send transactional messages such as booking confirmations, reminders, and schedule changes
• Administer memberships
• Verify age and eligibility where required for participation in a class or program
• Respond to your questions and requests and provide customer service
• Send marketing emails and promotions, which you can opt out of at any time
• Maintain range safety, investigate incidents, and enforce our range rules and Terms of Service
• Detect security incidents and protect against malicious, deceptive, fraudulent, or illegal activity, including automated abuse of our forms
• Count visits in aggregate so we can fix errors and improve the Website (analytics cookies only if you allow them in the cookie banner; see the Cookie Policy)
• Display the typefaces served by Google Fonts
• Resolve disputes and comply with legal obligations

We do not use personal information for targeted advertising, and we do not sell it.

3How We Share Information

We share personal information only with the categories of third parties below, and only for the reasons stated.

Service providers. We use third-party companies to host the Website, store reservation records, send email, and manage waivers. These providers may access personal information only to perform services for us. Categories include hosting providers, content delivery and security providers, customer and reservation management systems, email service vendors, and website development vendors. Current providers include:

• Cloudflare (hosts the Website and runs its reservation API on Cloudflare Pages; provides Turnstile bot protection on forms, for which Cloudflare receives your IP address and the verification token; keeps server logs and cookieless aggregate visit counts)
• Google (Google Sheets and Apps Script in our Google Workspace account store reservations, inquiries, and service requests and send our confirmation and reminder emails; Google Fonts serves our typefaces; our server reads our public Google Calendar to list events, and your browser does not contact Google for this. Google Analytics 4 runs only after you allow analytics in the cookie banner; we do not use Google Tag Manager)
• Gearfire (operates our online store at californiagungirls.com and store.oaktreegunclub.com, where memberships and merchandise are sold; the Website links to it and does not send it your information)
• Smartwaiver (electronic waivers, embedded on our waivers page)

When you send a private booking inquiry or a bow tech request, our staff receive it by email with your email address set as the reply address, so they can answer you directly. We also email you a copy of each reservation, inquiry, and service request, with a short reference code that matches our records. Your cookie choices are stored by the Website itself in your browser's local storage, not by a vendor.

Legal and safety. We disclose personal information when required by law, subpoena, or court order, to detect and resolve security incidents, or when we believe disclosure is necessary to protect the safety of our staff, customers, or the public.

Business transfers. If Oak Tree is involved in a merger, sale, or reorganization, personal information may be transferred as part of that transaction.

With your consent. We may share information for any other purpose you authorize.

4Cookies and Similar Technologies

A cookie is a small piece of data sent from a website and stored on your device by your browser. The Website's own code sets no cookies. It keeps three small values in your browser's local storage: your cookie choice, your confirmation that you are 18 or older (kept for 30 days), and your accessibility settings. Cloudflare may set security cookies, and the embedded Smartwaiver form may set its own. Our separate Cookie Policy lists each cookie we set, its provider, its purpose, how long it lasts, and how to opt out. In summary:

• Essential (Cloudflare security cookies where issued, Turnstile verification on forms, and the local-storage values above) keeps the Website running and cannot be disabled.
• Functional storage remembers your accessibility settings and your age confirmation. We do not embed YouTube videos or Google Maps.
• Analytics: Google Analytics 4, which loads only after you allow analytics in the cookie banner and stops again when you withdraw that choice from "Cookie choices" in the footer. The Cookie Policy lists its cookies.

You can also control cookies and site data through your browser settings. Blocking them means the age confirmation and the cookie banner will reappear on every visit, and the reservation and inquiry forms need Cloudflare Turnstile to load.

Do Not Track. Some browsers send a "Do Not Track" signal. Because there is no common industry standard for responding to these signals, the Website does not currently respond to them. You can enable or disable Do Not Track in your browser's settings.

5Minors

Every visitor is asked to confirm that they are 18 or older before entering the Website, and we store that confirmation on your device for 30 days. We do not knowingly collect personal information from anyone under 18 through the Website. Registrations for youth and junior programs are handled in person by a parent or legal guardian, and we treat the personal information of participants under 16 as sensitive personal information, used only to administer the program and maintain safety. If you believe a child has provided information to us without consent, contact us and we will delete it.

6How We Protect Your Information

We limit the personal information we collect to what is necessary for the purposes above, use SSL/TLS encryption when receiving or sending personal information beyond our internal networks, restrict access to reservation records to staff who need it, and protect public forms with bot detection. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7Information Retention

We retain reservation, contact, and marketing records for three years after your last interaction with us, after which they are deleted or anonymized. Signed waivers are retained for seven years to support safety and liability obligations. We may retain information longer where required by law or to resolve a dispute.

8Your Rights

All visitors and users of the Website have the following rights regarding their personal information:

1. To access the personal information we hold about you
2. To receive that information in a portable and, where feasible, readily usable format
3. To ask us to transmit your personal information to another provider, where technically feasible
4. To request that we correct inaccurate information
5. To withdraw consent to processing
6. To request that we restrict processing
7. To request deletion of some or all of your personal information, subject to legal exceptions
8. To opt out of direct marketing
9. To opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising)
10. To limit the use of sensitive personal information
11. To not be discriminated against for exercising any of these rights
12. To lodge a complaint with us or with a competent authority

Exercising your rights

Submit a request to the contact in Section 11. To verify your identity, we will ask you to provide the email address, phone number, and, if applicable, postal address associated with your records. We may be unable to process a request if we cannot verify your identity. You may designate an authorized agent to make a request on your behalf.

We will respond to most requests within 45 days and will notify you in writing if we need more time. We may deny a request where an exception in the law applies, and if we do, we will explain why. Certain records, such as signed waivers and incident reports, may be retained despite a deletion request where retention is required for legal or safety reasons.

To opt out of marketing emails, use the unsubscribe link in any marketing message or contact us. You will still receive transactional messages such as booking confirmations.

9Location of Data Processing and Third-Party Websites

All data processing takes place in the United States.

The Website contains links to websites operated by parties other than us, including our online store on the Gearfire platform, Smartwaiver for waivers, and Google Maps for directions. We provide these links for your reference only, do not control those websites, and are not responsible for their content or privacy practices. Read their privacy policies before providing personal information.

10Changes to This Privacy Policy

We may amend this Privacy Policy at any time. When we do, we will revise the "Last updated" date at the top of this page and post the updated policy on the Website. For material changes, we will also post a notice on the Website or email members and recent customers. Continued use of the Website after changes take effect means you accept the updated policy.

11Accountability and Contact

The following person is accountable and responsible for our privacy practices and procedures, and receives all privacy requests, questions, and complaints: