Privacy Policy

1. Who We Are

Driver Course Online LLC ("Company," "we," "us," or "our") operates drivercourseonline.com, a New York State pre-licensing course provider operating under the NYS DMV Online Pre-Licensing Course Pilot Program (VTL Article 12-D). Our registered address is 418 Broadway STE N, Albany, NY 12207. You can reach us at info@drivercourseonline.com.

2. Information We Collect

We collect the following categories of personal information:

• Identity data: full name, date of birth, email address, phone number.
• Authentication data: email/password credentials (hashed), phone OTP verification records, personal security question answers (hashed with bcrypt).
• Course progress data: module start/completion timestamps, section time spent, quiz answers and scores, OTP checkpoint timestamps.
• Payment data: transaction ID, last four digits of card, billing address. Full card numbers are never stored by us — payment processing is handled by Braintree (a PayPal service).
• Behavioral data: keystroke dynamics collected during identity verification checkpoints. This data is used solely to verify that the same person is completing the course and is deleted within 30 days of course completion.
• Technical data: IP address, browser type, device type, and session logs collected automatically via our hosting infrastructure.

3. How We Use Your Information

• To enroll you in and administer the NY 5-hour pre-licensing course.
• To verify your identity at required checkpoints as mandated by NY CRR 15 Part 10.
• To issue your completion certificate and report your completion to the NYS DMV within 48 hours as required by law.
• To process your payment for the course.
• To send transactional communications (email verification, OTP codes, receipt, certificate).
• To comply with our legal obligations under NY CRR 15 Part 10, the NY SHIELD Act, and other applicable law.
• To detect and prevent fraud or unauthorized use.

We do not use your personal information for advertising, marketing to third parties, or any purpose unrelated to course administration and legal compliance.

4. Legal Basis for Processing

We process your personal information on the following bases:

• Contract performance: to deliver the course you purchased.
• Legal obligation: NY CRR 15 Part 10 requires us to collect identity, progress, and completion data and report it to the DMV.
• Legitimate interest: fraud prevention and system security.

5. How We Share Your Information

We share your information only as follows:

• NYS Department of Motor Vehicles: we are legally required to report course completions within 48 hours. Data transmitted includes your name, date of birth, and completion timestamp.
• Service providers (subprocessors):
  • Amazon Web Services (AWS): application hosting (App Runner, us-east-1), audit logging (CloudTrail), and tamper-proof completion record retention (S3 Object Lock).
  • Google Firebase (Alphabet Inc.): authentication services (email/password, phone OTP) and primary database (Firestore, nam5/us-central).
  • Braintree (PayPal): payment processing. Braintree is PCI-DSS Level 1 certified.
• Independent third-party monitor: as required by §10.7 of NY CRR 15 Part 10, an independent monitor has access to audit our records for DMV compliance.
• Law enforcement / legal process: when required by law, court order, or to protect the rights and safety of users.

We do not sell your personal information. Ever.

5a. Driver's Privacy Protection Act (DPPA) Notice

Information you enter from your NYS learner's permit (including your motorist ID number, permit number, permit class, and expiration date) may constitute personal information from a motor vehicle record subject to the federal Driver's Privacy Protection Act (18 U.S.C. §2721). We collect this information solely for the following permissible purposes: (1) identity verification as required by the NYS DMV pre-licensing course pilot program, and (2) reporting your course completion to the NYS Department of Motor Vehicles as required by VTL §502 and 15 NYCRR Part 10. We do not sell, share, or use this information for any other purpose. We do not disclose permit data to any third party except the NYS DMV as required by law.

6. Data Retention

• Course completion records: retained for a minimum of 5 years as required by NY CRR 15 Part 10 §10.11(e). These records are stored in tamper-proof S3 Object Lock (COMPLIANCE mode).
• Keystroke/biometric data: deleted within 30 days of course completion.
• Payment records: retained for 7 years for tax and accounting purposes.
• Account data: retained while your account is active and for 3 years after your last activity, unless a longer period is required by law.

7. Security

We implement the following safeguards to protect your information:

• All data transmitted between your browser and our servers is encrypted via TLS 1.2+.
• Data at rest is encrypted using AES-256.
• Security question answers are hashed using bcrypt before storage.
• Access to student data is controlled via least-privilege IAM roles. No employee has unrestricted access to production data.
• Audit logs of all data access are retained in AWS CloudTrail.
• Threat detection is monitored via AWS GuardDuty.
• We maintain a written security plan as required by the NY SHIELD Act and NY CRR 15 Part 10 §10.12.

Despite these measures, no system is 100% secure. If you believe your account has been compromised, contact us immediately at info@drivercourseonline.com.

8. Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify you within 30 days of discovering the breach, consistent with NY General Business Law §899-aa (NY SHIELD Act, as amended December 2024). We will simultaneously notify the NY Attorney General, the NY Department of State, and the NY Division of State Police via the NYSAG data-breach-reporting portal. If more than 5,000 NY residents are affected, we will also notify major consumer reporting agencies.

9. Your Rights

You have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: request correction of inaccurate information (note: completion records submitted to the DMV cannot be altered after submission).
• Deletion: request deletion of your account and personal data, subject to our legal retention obligations (we cannot delete DMV-required records during the mandatory retention period).
• Portability: request a machine-readable export of your course data.

To exercise any of these rights, email info@drivercourseonline.com. We will respond within 30 days.

10. Children's Privacy

This service is not directed to children under 13 years of age. A valid NYS learner's permit is required to enroll, and the minimum age for a NY Class D learner's permit is 16. We do not knowingly collect personal information from children under 13. If we discover or are notified that a user is under 13, we will immediately suspend the account and permanently delete all associated personal information. If you believe a child under 13 has created an account, contact us at info@drivercourseonline.com and we will act within 48 hours.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with an updated effective date and, where required by law, by email. Your continued use of the course after any change constitutes your acceptance of the new policy.

12. Contact Us

Driver Course Online LLC
418 Broadway STE N, Albany, NY 12207
Email: info@drivercourseonline.com
Phone: [TOLL-FREE NUMBER — ADD WHEN OBTAINED]