Legal

How This Shop Handles Visitor Information

Effective date: 2026-07-01
Last updated: 2026-07-01

This site runs one contact form and consent gated analytics. It collects a name, phone number, optional email address, vehicle type, a description of the work and a source field. Submissions are emailed to the shop. Nothing is sold, and every non essential tag stays off until a visitor allows it.

This notice describes OCRV Center, an in-shop collision, paint and systems repair facility at 23281 La Palma Ave, Yorba Linda, CA 92887, and the website published at https://ocrv.vip. The facility serves owners across Lake Forest and the wider Orange County area, and every repair is performed at the Yorba Linda address. This notice covers the website only; it does not govern what a third party does on its own property once you follow a link away from here.

What the contact form collects

There is exactly one form on this site. It asks for a name, a phone number, an optional email address, a vehicle type chosen from a list, and a short description of what needs doing. It also carries a hidden source field that records the campaign parameters attached to the link that brought the visit in, so the shop can tell whether an inquiry arrived from a search result, a directory listing or a social post.

A second hidden field sits in the form as an anti abuse trap. It is labelled for screen readers and left empty by every real visitor. If it comes back filled, the submission is discarded quietly. Nothing else is gathered at submit time: there is no account, no password, no payment field and no upload.

None of the fields ask for medical, financial, biometric, precise location or government identifier data, and none of them should be used to send that kind of detail. If a repair conversation later needs a claim number or an insurer contact, that exchange happens by phone or by email with the shop, not through this website.

Where a submission goes and how long it stays

Every completed submission is emailed to info@ocrvcenter.com and written to a single structured server log line so that a message is never silently lost if email delivery fails. There is no database behind this site and no customer record is built here. The email and the log line are the only copies this website produces.

The shop inbox is the system of record after that point. Inquiries that turn into repair work are folded into the ordinary business records the shop keeps for a job, which are retained as long as California requires for repair documentation and tax purposes. Inquiries that never become work are cleared from the inbox during routine housekeeping, generally within twenty four months.

Platform level logs held by the hosting provider follow that provider's own retention schedule and are used for security and reliability, not for marketing. Nothing in this pipeline is sold, rented, licensed or traded, and none of it is used to build an advertising profile.

Analytics, tags and consent

Measurement on this site is opt in. Before any tag loads, the page declares Google Consent Mode v2 with every signal set to denied: advertising storage, analytics storage, advertising user data, advertising personalization, functionality storage and personalization storage. Only security storage begins in a granted state, because it is what keeps the abuse screening on the contact form working.

A consent banner appears after a visitor has scrolled a short distance or after a few seconds have passed, deliberately late so it is never the first thing painted and never causes the page to jump. Choosing to allow measurement flips analytics, functionality and personalization storage to granted and leaves all four advertising signals denied. Declining leaves everything as it started.

The choice is stored in browser local storage on the visitor's own device, along with a timestamp and a version marker, so a later change to this notice can be told apart from an older decision. Clearing site data in the browser erases that record and the banner returns.

Cookies and similar technologies

The table below lists every category this site can place, who sets it and what it does. Browser local storage and similar client side storage are treated as cookies here, because the privacy question is what gets stored on your device, not which technical mechanism stores it.

Category	Set by	What it does	Consent
Strictly necessary	This site and its hosting layer	Keeps the site functioning: routing a page request to the right server region, protecting the contact form against automated abuse, and remembering the consent choice recorded in browser storage so the banner is not shown again on every page.	Always active. These cannot be switched off without breaking the site.
Analytics	Google Analytics through Google Tag Manager, Microsoft Clarity	Counts page views, records which pages a session moved through, and captures anonymized interaction patterns such as scroll depth and rage clicking so confusing layouts can be found and rebuilt. It is used to improve the site, not to identify a person.	Off until consent is given. Denied automatically when a browser sends an opt out signal.
Marketing	Not currently deployed on this domain	Would cover advertising storage, ad user data and ad personalization signals used for cross context behavioral advertising. This site declares all four advertising signals as denied and does not load an advertising pixel.	Denied by default and left denied. If this ever changes, this table changes with it.

The third parties involved, named

Naming a vendor category without naming the vendor is not much of a disclosure. These are the five services that can see visitor data, and what each one is actually doing.

Google Analytics via Google Tag Manager / Traffic measurement and tag delivery: Loads only after analytics consent. Google Consent Mode v2 is declared before any tag runs, so the container starts in a denied state rather than firing and asking later.
Microsoft Clarity / Session behavior and heatmapping: Loads only after analytics consent, and lazily, after the page is interactive. It records interaction patterns rather than form field contents.
Resend / Transactional email delivery: Delivers a contact form submission to the shop inbox and sends the acknowledgement message back to a visitor who supplied an email address. It handles the message in transit; it is not used for marketing sends.
Vercel / Hosting and content delivery: Serves the pages and runs the server action behind the contact form. Standard operational logging applies, including request timing and IP address at the edge, retained on the platform's own schedule.
Cloudflare Turnstile / Automated abuse prevention: Screens contact form submissions for bot traffic. It is a challenge rather than a tracker, and it is grouped under strictly necessary because the form would be unusable without something in that slot.

Each of these acts as a service provider under California law, which means they process data on the shop's instructions for the stated purpose and are not permitted to keep it for their own commercial ends. Beyond that list, personal information leaves the shop only where an insurer, a parts supplier or a vehicle manufacturer needs it to move an authorized repair forward, or where law enforcement or a court compels disclosure.

California privacy rights

California residents hold a defined set of rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act. They are listed in full below rather than summarized away, because a right nobody can find is a right nobody uses.

Right to know: Ask what categories of personal information this site has collected about you, where it came from, why it was collected and who it was disclosed to.
Right to access: Ask for a copy of the specific pieces of personal information held about you, which in practice means the contents of any contact form you submitted.
Right to delete: Ask for deletion of what was collected, subject to the narrow exemptions the statute allows, such as records the shop must keep to document repair work already performed.
Right to correct: Ask for inaccurate personal information to be fixed. A misspelled name or a wrong callback number is the common case.
Right to opt out of sale or sharing: Direct that personal information not be sold or shared for cross context behavioral advertising. See the dedicated page for the mechanism.
Right to limit sensitive information use: Restrict the use of sensitive personal information. This site does not solicit any, so there is nothing to limit, and the right is listed for completeness.
Right against retaliation: Exercise any of the above without being refused service, charged a different price or given a lower standard of work.

Global Privacy Control is honored

If your browser or an extension sends a Global Privacy Control signal, this site reads it before the consent banner would otherwise appear. The signal is treated as a valid opt out request: analytics stays denied, the banner is suppressed, and the decision is recorded locally with a flag noting that it came from the browser rather than from a click. You do not have to do anything else.

That behavior is automatic and applies on every page. It is worth saying plainly because the alternative, showing a banner to someone whose browser already answered the question, is a pattern this site deliberately does not use.

How to make a privacy request

Requests are accepted two ways: by phone on (949) 799-3387 during posted business hours, or by email to info@ocrvcenter.com with the words privacy request in the subject line. Say which right you are exercising and give enough detail to find the record, which usually means the phone number or email address used on the original submission and roughly when it was sent.

Requests are acknowledged within ten business days and answered within forty five calendar days. If a request is genuinely complex, that window can be extended once by a further forty five days, and you will be told before the first window closes rather than after. Identity is verified by matching the details you supply against the record already held; no new identity document is requested for this purpose. An authorized agent may act on your behalf with written permission, and the details are on the do not sell page.

If a request is denied, the reason is given in writing along with the exemption relied on. Exercising a right never changes the price of a repair, the scheduling of a repair or the standard of work performed.

Children

This is a commercial vehicle repair site aimed at owners and fleet operators. It is not directed at children, it carries nothing designed to appeal to a child, and it does not knowingly collect personal information from anyone under sixteen. Personal information is never sold or shared, so the affirmative opt in the statute requires for minors under sixteen has nothing to attach to. If a parent or guardian believes a child has submitted the contact form, call or email the shop and the record will be removed.

Changes to this notice

This notice is reviewed at least once a year and whenever a tool, a form field or a processor changes. When it changes, the effective date and last updated line at the top of the page changes with it, and the consent record carries a version marker so an older decision can be told apart from a newer one. Material changes to how information is used are announced through the consent banner rather than published quietly. Nothing here is applied retroactively to information already collected under a previous version.

Questions about anything on this page go to the same place the rest of the shop correspondence goes. Call (949) 799-3387 during business hours, or write to info@ocrvcenter.com and mark the subject line privacy. The mailing address is OCRV Center, 23281 La Palma Ave, Yorba Linda, CA 92887. A written reply is sent for every written request. Related pages: opting out of sale and sharing, terms of use and business disclosures.