Biometric Data Policy
The short version: verifying your identity involves matching a selfie to your driver's license, which can involve processing facial geometry data. This page explains what that means and your rights under state biometric privacy laws.
1. What counts as biometric data here
In connection with Carvia's identity and driver's-license verification (see Creating Your Account and Verification), Carvia and/or our verification vendor may process, derive, or possess biometric data — meaning data like facial geometry derived from a selfie or ID photo, as defined under applicable state law (for example, the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifiers Act (CUBI), and Washington's HB 1493). This does not include ordinary photographs, demographic data, or physical descriptions on their own — only the derived biometric identifier used for matching.
2. Why we collect it
We use biometric matching for one purpose: confirming that the person creating an account or completing verification is the same person as the license/ID they submitted. This is core to trust and safety on a marketplace where people hand over their cars to strangers.
3. Consent
Where required by applicable state law, we obtain your consent before collecting, deriving, or generating biometric data from you — this happens as an explicit step in the verification flow, not buried in general terms.
4. Disclosure
We don't share biometric data with anyone beyond our authorized verification vendor(s), except:
- You (or your legal representative) consent to the disclosure.
- Disclosure is required by law or permitted under applicable biometric privacy law.
- It's necessary to complete a transaction you requested (e.g., a re-verification you initiate).
- It's required by a valid warrant or subpoena.
We do not sell biometric data, and we don't use it for advertising.
5. Retention and deletion
We retain biometric data only as long as necessary for the purposes above. In no case do we retain a user's biometric data beyond 3 years after your last interaction with Carvia, except where a longer period is required by law.
6. Your rights
Depending on your state, you may have rights to access, request deletion of, or receive notice about the biometric data derived from your verification. Contact privacy@carvia.app to exercise these rights.
7. Related policies
This policy supplements our Privacy Policy — read that for the full picture of how we handle your information generally.