Gun Laws of Colorado

The Colorado Federal Firearms Licensees Association (“CFFLA,” “we,” “us”) is a Colorado trade association for federal firearms licensees and the firearms industry in Colorado, including manufacturers of accessories, non-FFL ranges, instructors, and compliance agents. We operate cffla.org, including the public tools (the gun-law search, GunLawBot, the FFL member map, and our news and litigation pages) and the members-only Trade Portal. The platform technology is built and operated with Umbrella. Questions about this policy: info@cffla.org.

This site serves two populations, and we treat their data differently:

• Public users — visitors using the free tools, GunLawBot users, supporters, and donors.
• Industry members — FFL dealers and industry members using the Trade Portal compliance suite.

Member compliance data is the member’s own business information. It is kept in its own access-controlled storage, is not used to profile members, and is not part of any public or civic-facing dataset.

Visitors (no account):

• Anonymous product analytics — page views and feature-usage events with no name, email, or account identity attached. Our analytics do not use tracking cookies and do not record what you type into the law search or chat.
• Operational server logs — technical events needed to run and secure the service. Where a connection address appears in analytics events, it is stored as a salted hash, not a raw IP address.
• Bot-protection signals — our sign-in and sign-up forms use Cloudflare Turnstile, which processes connection data to distinguish humans from bots.

GunLawBot users:

• Your email address (GunLawBot accounts are email-only), session identifiers, and your chat conversations (stored so your conversation history works).
• Subscription and payment status, processed by Stripe (see §5).

Industry members (Trade Portal):

• Account and profile information — name, email, phone, business name, FFL number and type, business address, and the Colorado legislative districts derived from that address.
• Compliance-chat conversations with the member AI tools.
• Form-generator data — the information you enter to fill official forms is personally identifying by nature and is stored in private, access-controlled storage. Generated documents are never publicly accessible.
• Billing status and history, processed by Stripe.
• Support tickets, feedback, and bug reports you submit.

Donors:

• Donation amount, optional name and email for your receipt, and the fund designation you choose (general support or the litigation fund). Payment is processed by Stripe — card numbers never touch our systems.

If you sign in with Google:

• When you choose “Sign in with Google” to create or access an account, Google shares your basic Google profile with us — your name, email address, and profile picture. We use this only to create and authenticate your account and populate your account profile; we do not use your Google information for any other purpose, and we do not sell or share it. You can revoke our access at any time from your Google Account’s third-party connections settings.

We use the data above to operate the service, provide the features you use, keep the service secure, support you, and improve the product. The standing access rule:

Development-team members may access platform data to operate, support, and improve the system. Data is never sold or released in any individual capacity. Aggregate information may be published at the discretion of the Board.

Access is purpose-bounded: we look at data to fix, build, secure, and support — not to browse. Published aggregates are subject to minimum group sizes so no individual member or user can be re-identified from a statistic.

We rely on established third-party providers to run the service. Each receives only the data its function requires, and only to perform that function for us. We identify them by role rather than by name, because the specific vendors may change as we improve the service:

• Sign in with Google (optional) — if you choose it, Google shares your basic profile (name, email, and profile picture) to create and authenticate your account, as described in §3.
• Authentication & storage — account sign-in and the secure database that holds your data.
• Payments — a PCI-compliant payment processor handles all dues, subscriptions, and donations. Card numbers never touch our systems.
• AI processing — to answer your questions, your question text is processed by one or more third-party AI providers, which may include leading commercial AI APIs. The specific provider(s) may change; in every case your question is used only to generate a response.
• AI-quality monitoring — your questions and how the system answered them are recorded by a monitoring provider so we can find and fix wrong or unhelpful answers. Like the AI providers, this involves your question text — so keep personal details out of chat (§7).
• Email delivery — account emails (sign-in links, password resets) are sent through an email provider.
• Operator notifications — an internal communication tool alerts CFFLA staff to key account events (such as a new member joining, a member signing in, or a new supporter) so we can welcome, onboard, and support you. These alerts may include your account and contact details so we can reach and assist you. They are used only for that purpose — never for advertising, and never sold or shared for any other purpose.
• Infrastructure — hosting, caching, content delivery, bot protection, operational logging, and anonymous analytics keep the service running, fast, and secure. Where a connection address appears in logs or analytics, it is stored as a salted hash, never a raw IP address.
• Geocoding — converts a member’s business address into legislative districts.

• We never sell your data.
• We never release data about an identifiable individual or business, except as required by law.
• We never share member, user, or consumer information with state regulatory agencies for monitoring or enforcement — we are not a reporting channel for any regulator. We would disclose data only if compelled by a valid, legally binding demand, as noted above.
• Member compliance data (profiles, form data, compliance conversations) is never used for advertising, public profiling, or any civic-facing dataset.
• Our analytics never capture the text of your legal questions.

The commitments above cover your account and platform data. Information you voluntarily submit through a public reporting or evidence form (for example, our issue-reporting campaigns) is different: it is collected for that form’s stated purpose and may be shared with the legal team or allied counsel conducting the related effort.

GunLawBot and the member compliance tools are AI systems. Your questions are processed by the AI providers in §5 to generate answers, and conversations are stored so your history works. Don’t put information in a chat that you wouldn’t want processed this way — the tools need your legal question, not your personal details.

Accounts are protected by row-level access controls — you can read your own data, and backend writes happen through controlled service paths. Generated form documents live in private storage reachable only through authenticated, expiring links. Draft forms are retained for roughly 90 days; completed documents are retained for the life of your account. Payment security is handled by Stripe under their PCI compliance.

You can request access to, export of, correction of, or deletion of your data at any time by emailing info@cffla.org. Deleting your account removes your profile and stored documents, subject to records we must keep for legal, billing, or dispute purposes.

This service is not directed to anyone under 18, and we do not knowingly collect data from minors.

When we change this policy, we’ll post the updated version here with a new effective date. Material changes affecting members will be announced through the portal. As new features launch, this document is updated to describe them before they apply to you.

CFFLA · 12470 York St #41, Eastlake, CO 80614 · info@cffla.org