Can I request a copy of my data, or have it deleted?

Under California's CCPA, Virginia's VCDPA, Colorado's CPA, and several other state privacy laws, you have rights to access, correct, delete, and port your personal data. We honor these rights for all users regardless of state. Contact our support team with your request — we'll verify your identity, then export, correct, or delete the relevant data within 30–45 days depending on the request and applicable law. Some records (completed certificates already reported to a state, payment records required for tax compliance) are retained as the law requires, but the personal-identifier portion can still be deleted.

The honor-rights-regardless-of-state policy is more permissive than the strict legal requirement. Some providers extend privacy rights only to drivers in states where the law requires it, treating other drivers as having no rights to access or delete their data. We treat the rights as universal because the operational cost of running two different policies is high and the user expectation is that the rights apply equally. A driver in Wyoming asking for a data export gets the same response as a driver in California, even though Wyoming hasn't passed the equivalent privacy law.

The verification step before fulfilling any request is important because data-rights requests are a known vector for social engineering — an attacker pretending to be the user could otherwise extract or destroy data. Verification typically uses information only the actual driver would know: full name and date of birth combined with a recent enrollment detail, a payment-method last-four, or a course-completion date. The verification adds a few minutes to the request but prevents impostor requests from succeeding. Drivers who can't pass verification (rare, but it happens with very old accounts where contact info has changed multiple times) can use additional methods like notarized identity affidavits.