Nothing typed into this site's forms is sold, and every ad-platform signal stays denied until you say otherwise.

Who Runs This Site

Oak & Ember Bakery operates oakemberbakery.com from its shop on Kelly Road in Ruffs Dale, Pennsylvania. The office inbox at office@oakemberbakery.com is read by shop staff, not a third-party marketing firm, and the phone number above rings the counter directly during opening hours.

This policy applies to the site itself — the forms, the chat widget, and the tracking tied to paid advertising. It does not apply to a walk-in cash or card sale at the counter, which involves no website data at all.

What We Collect

The inquiry form on the contact page and embedded on the homepage asks for name, phone, email, the address for the order or event, what kind of order it is, sizing or quantity notes, and any free-text notes typed in. Two fields on that form are invisible on purpose — they exist only to catch automated spam and are never shown or labeled to a person filling out the form.

The chat widget in the corner of every page collects whatever is typed into it, plus an optional name, phone or email if given when the thread opens. A browser-generated token keeps that thread tied to your device; it sits in your browser's local storage, not in a server-side account.

Standard web-server logs record IP address, browser type, the page requested and the time of the request — this is routine hosting-level logging, not a marketing dataset, and it is not cross-referenced against form submissions.

How It Gets Used

Form and chat submissions go to the office inbox so a person can quote a wedding tier, schedule a tasting, or confirm a standing bread order. Nothing typed into either channel is used to train a model, resold to a data broker, or shared with a marketing list. There is no email newsletter on this site to be added to.

Analytics traffic — page views, which pages get read before someone calls — is used to see whether the custom-cakes or bakery-cafe pages are doing their job, not to build a profile of any one visitor. That measurement only fires once storage consent is granted, covered in the next two sections.

Advertising & Click IDs

Paid traffic reaches this site through Google Ads and Microsoft Advertising, and at times through Meta Ads. When a visitor clicks one of those ads, the destination link carries a click identifier in the address bar — gclid from Google, msclkid from Microsoft, fbclid from Meta. Those identifiers let each platform's own conversion tools match a later inquiry back to the ad that produced it.

The click ID itself is a string in a URL, not something this site invents. Whether it gets stored in a cookie and used for later matching depends entirely on the storage consent choice described below — before that choice is made, or if it is declined, the identifier is not persisted for advertising purposes.

The full breakdown of what the cookie banner controls, cookie by cookie, is kept on its own page: see Cookies & Consent.

Consent Mode v2

This site loads Google's Consent Mode v2 on every page. Four signals govern what advertising and analytics tags are allowed to do, and all four default to denied the moment a page loads — before the cookie banner is even read.

Choosing Allow storage in the banner sets all four signals to granted for this browser. Choosing Decline, or closing the banner without a choice, leaves them denied — and if you later reopen the banner through the Cookie Settings link in the footer and decline again, every signal is set back to denied, not left in whatever state it was in before. A browser sending a Global Privacy Control signal is read the same way a manual decline is read, automatically, without a click.

Legal Bases For Processing

Different pieces of data get handled under different justifications. This table lays out which basis applies to which activity, in plain terms rather than statute citations.

Your Rights

A visitor covered by the EU or UK General Data Protection Regulation can ask for access to their data, correction of it, deletion of it, a copy in a portable format, or a limit on how it is processed, and can object to processing based on legitimate interest. Any of those requests goes to office@oakemberbakery.com using the same Data Request section below, and if the reply here does not settle the matter, a complaint can be lodged with the relevant supervisory authority in that visitor's home country.

A visitor in a US state with its own privacy law — California, Colorado, Connecticut, Virginia and the others that followed — has the right to know what is held, to correct or delete it, and to opt out of the sale or sharing of personal information and of targeted advertising. Oak & Ember does not sell data to a data broker. Targeted advertising here means the Google, Microsoft and Meta signals covered above, and declining the cookie banner or sending a Global Privacy Control signal is treated as that opt-out, automatically, without a separate email needed.

No visitor is charged a fee, denied service, or given a worse price for using any of these rights. There is no loyalty program or paid tier on this site to be excluded from.

Retention & Sharing

Inquiry-form submissions are kept as long as needed to quote, book and complete the order, and for a reasonable period after in case of a follow-up question about that same order — typically no more than two years past the event date. Chat threads are kept on a shorter cycle and are deleted once a request is resolved unless tied to an active order.

Data is not shared with anyone outside the shop except the hosting provider that keeps the server running and, where consent is granted, the advertising and analytics platforms named above receiving the specific signals described in the Consent Mode v2 section. There is no data broker relationship, and inquiry details are never sold.

The Chat Widget

Opening the chat creates a token stored in your browser's local storage — clearing site data or switching browsers starts a fresh, unlinked thread. While the panel is open, the browser checks for new replies every five seconds; it does not poll in the background when the panel is closed or the tab is hidden.

A name, phone or email typed into the chat intro is optional. Skipping it means the thread exists but nobody can call you back on it — for anything time-sensitive, the phone number or the full inquiry form is the more reliable path.

Accessibility Statement

This site is built with plain HTML controls, visible focus outlines, a skip-to-content link at the top of every page, and text sized with clamp() so it scales with a browser's zoom setting rather than staying fixed. Tap targets across the site — buttons, links, form fields — hold to at least 44 pixels so they work on a phone screen without a magnifying gesture. Motion tied to a mouse pointer, including the magnetic buttons and the hover-follow image preview, does not run on touch devices and turns off entirely when a browser's reduced-motion setting is on.

The aim is to meet WCAG 2.1 at the AA level across the site. Known gaps get fixed as they are found rather than left for a future rebuild — if a page, a form field or a script behaves badly with a screen reader or keyboard-only navigation, that is treated as a defect, not a trade-off.

Found something that does not work — a control a keyboard cannot reach, a contrast ratio that reads poorly, an image whose text alternative is missing or wrong — write to office@oakemberbakery.com with the page and what happened. A shop of seven people cannot promise a same-day fix on every report, but every report gets a reply and gets logged for the next round of edits to the site.

Data Request (DSAR)

To see what is held about you, have it corrected, or have it deleted, send a request to office@oakemberbakery.com or call +1 (847) 555-3288. Identify yourself with the name, phone or email used on the original form or chat thread so the right record can be found — a shop this size does not run a self-service account portal, so a request goes to a real person reading the inbox.

A deletion request tied to an active custom order — a wedding tier already booked, a standing bread account — may need the contact details kept until the order is complete, so the shop can still reach you about it. That limit gets explained at the time of the request, not applied silently.

Changes To This Policy

The effective date at the top of this page moves whenever wording here changes in a way that affects what data is collected or how it is used. Small copy edits — a rephrased sentence, a fixed typo — do not always move the date. Read the terms of service for the rules around deposits, cancellations and the tasting requirement; those sit outside this policy.