Skip to main content

Privacy policy

How we handle the personal data you give us.

Last updated 2026-09-12

  • Privacy Policy - International Automobile Authority Privacy Policy Privacy Policy Last updated: 2026-05-06 This Privacy Policy explains how International Automobile Authority LLC (“IAA,” “we,” “us”) operating internationalautomobileauthority.com collects, uses, shares, retains, and protects the personal data of visitors and customers worldwide. Important: International Automobile Authority LLC is a privately held Limited Liability Company registered in the State of Florida, USA. It is not a government body, regulatory authority, or instrumentality of any government. It does not issue government permits, licenses, or official documents of any kind. Important (short form of our Prominent Risk Disclaimer). Our IAA Driver’s License Translation (IAA-DLT) is a certified translation of your valid domestic driver’s license, formatted in accordance with the 1949 Geneva Convention on Road Traffic and the 1968 Vienna Convention on Road Traffic . It is not an International Driving Permit (IDP) issued by a government or motoring association, and does not replace your original driver’s license. We are not affiliated with AAA (American Automobile Association), CAA (Canadian Automobile Association), ATA (American Translators Association), or any government or motoring organization; similarity in name is coincidental. 1. Controller identity and contact Data controller: International Automobile Authority LLC, a Florida limited liability company, operating internationalautomobileauthority.com .
  • Registered address: 2125 Biscayne Boulevard, Ste 204 #20167, Miami, Florida 33137, USA.
  • Privacy contact: privacy@internationalautomobileauthority.com .
  • General contact: hello@internationalautomobileauthority.com .

1.1 EU / UK representative and Data Protection Officer — current posture

International Automobile Authority has assessed its obligations under GDPR Art. 27 (EU representative) and Art. 37 (Data Protection Officer). Given the current limited scale of processing, IAA has concluded that neither a designated EU/UK representative nor a mandatory DPO is required at this time. IAA will reassess and appoint these roles if the scale, scope, or nature of its processing changes materially. For any data-protection question, contact privacy@internationalautomobileauthority.com .

2. Categories of personal data we collect

  • Identity and contact data: full name, date of birth, sex, country of birth, country of residence, email address, phone number (WhatsApp preferred), shipping address.
  • Identity-verification data: photograph of your domestic driver’s license (front and back); photograph of passport or government ID (where collected); passport-style selfie; electronic signature.
  • Order and transaction data: products purchased, format (digital only or print + digital), validity term, language, vehicle classes, payment method used (card data is processed by Stripe and never stored on our systems).
  • Technical and device data: IP address, device identifiers, browser type, operating system, referral URLs, cookie identifiers.
  • Communications data: email, live-chat, and support-ticket records (including transcripts of interactions with our AI support agent “Sam”).

3. Sources of personal data

  • Directly from you at checkout and during order fulfillment (fields listed in § 2 ).
  • From your device and browser through cookies and similar technologies (see our Cookie Policy ).
  • From payment processor Stripe (transaction-success indicators, fraud signals, chargeback notifications).
  • From shipping carriers (tracking events).

4. Purposes of processing and lawful bases (GDPR Art. 6)

5. Recipients and third-party processors

We share personal data with the following categories of recipients, each of which is subject to written data-processing commitments:

We do not sell personal data for money. Our use of Meta Pixel, Google Ads, and Microsoft UET constitutes “sharing for cross-context behavioral advertising” under the California Consumer Privacy Act / California Privacy Rights Act (see the California section below). California residents can exercise the “Do Not Sell or Share My Personal Information” right described in § 10 .

  • Stripe, Inc. — payment processing (PCI-DSS Level 1). Stripe Radar and OFAC screening operate at the payment layer.
  • Shipping carriers — FedEx (Express), local postal services (Standard), and, for certain routes, DHL and UPS.
  • Google LLC — Google Analytics (analytics), Google Ads (conversion measurement and advertising), Google Tag Manager (tag-container deployment).
  • Meta Platforms, Inc. — Meta Pixel (advertising and conversion measurement).
  • Microsoft Corporation — Microsoft Advertising / Bing Ads UET tag (advertising and conversion measurement).
  • Klaviyo, Inc. — transactional and marketing email platform (marketing only if you opt in).
  • Airtable, Inc. — back-office database used as our order-management and CRM system.
  • Intercom, Inc. — live-chat provider that powers our AI support agent “Sam.” Interactions may be handled initially by Sam and escalated to a human reviewer.
  • Twilio, Inc. — transactional SMS delivery.
  • WhatsApp Business API via Meta Platforms, Inc. — transactional WhatsApp messaging.
  • Translation production — performed in-house by our trained expert reviewers; we do not use external translation subcontractors.
  • Legal, tax, and audit advisors — on a need-to-know basis.

6. International transfers

Personal data is processed in the United States by IAA and by US-based service providers. When data is transferred from the European Economic Area, the United Kingdom, Switzerland, or other jurisdictions with data-export controls, we rely on:

A copy of the relevant transfer mechanism is available on request to privacy@internationalautomobileauthority.com .

  • EU–US Data Privacy Framework for recipients that are certified (Stripe, Google, Meta, Microsoft);
  • Standard Contractual Clauses issued by the European Commission (Commission Implementing Decision (EU) 2021/914) for recipients not certified to the DPF;
  • UK International Data Transfer Addendum for UK transfers;
  • Swiss–US Data Privacy Framework for Swiss data, where applicable.

7. Retention

We retain personal data only for as long as necessary for the purposes for which it was collected and as required by law, in accordance with GDPR Art. 5(1)(e) and LGPD Arts. 15–16. The following schedule applies; it is justified by the Replacement Guarantee, the Rejection Guarantee, fraud prevention, and statutory tax record-keeping.

We note that the lifetime-of-validity retention for identity documents is longer than typical e-commerce retention. We have retained it because shorter retention would defeat the Replacement Guarantee and our fraud-prevention controls. Customers may request earlier deletion under § 10 subject to legal-hold exceptions.

8. Automated decision-making (GDPR Art. 22)

IAA does not make solely-automated decisions that produce legal effects or similarly significantly affect you, except as follows:

You may object to or request human review of any automated decision by contacting privacy@internationalautomobileauthority.com .

  • Sanctions screening at the payment layer. Stripe Radar and OFAC screening may decline a payment based on automated rules. If a transaction is declined, you may contact hello@internationalautomobileauthority.com for a human review.
  • Automated biometric processing described in § 11 is used to assist human reviewers — the final decision on identity verification and order fulfillment is always made by a human reviewer.
  • Analytics and advertising pixels described in § 5 involve profiling for statistical measurement and targeted advertising; these do not produce legal or similarly significant effects and operate subject to your cookie choices.

9. Security measures

We implement technical and organizational measures appropriate to the risk, including encryption in transit (TLS) and at rest, access controls, vendor assessments, incident-response procedures, Stripe’s PCI-DSS tokenization for card data, and Airtable access logging. Access to the Airtable order database is role-limited and audit-logged. Card data is tokenized by Stripe under PCI DSS and never stored by International Automobile Authority. Sub-processors are reviewed for compliance with GDPR Art. 32 and LGPD Art. 46 equivalent controls. No method of transmission or storage is perfectly secure; we commit to notify affected individuals and regulators as required by applicable law in the event of a personal-data breach.

10. Your rights

You have the rights listed below, subject to local law. To exercise any right, contact privacy@internationalautomobileauthority.com . We do not charge for exercising rights and we will not discriminate against you for doing so.

Regardless of where you live, you can ask us what data we hold about you, ask us to correct it, or ask us to delete it. Email privacy@internationalautomobileauthority.com from the address you used at checkout. We will acknowledge within one business day and complete the request within 30 days, unless a law requires us to keep specific records for longer. Regional sections below describe additional rights that may apply to you.

10.1 European Economic Area and United Kingdom (GDPR / UK-GDPR)

  • Access (Art. 15).
  • Rectification (Art. 16).
  • Erasure (Art. 17) — subject to legal-hold exceptions.
  • Restriction (Art. 18).
  • Portability (Art. 20).
  • Objection, including to direct marketing, which you may object to at any time and free of charge (Art. 21).
  • Not to be subject to solely automated decision-making (Art. 22) — see § 8 .
  • Withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
  • Lodge a complaint with your supervisory authority, including the UK Information Commissioner’s Office (ICO) and the competent EU Member-State authority.

10.2 California (CCPA / CPRA)

  • Right to know what personal information we collect, use, disclose, and share.
  • Right to delete personal information, subject to statutory exceptions.
  • Right to correct inaccurate personal information.
  • Right to opt out of sale or sharing of personal information — we honor this via a “Do Not Sell or Share My Personal Information” link available on our website and through Global Privacy Control signals sent by your browser.
  • Right to limit use of sensitive personal information — we honor this via our privacy contact.
  • Right to non-discrimination for exercising any right.
  • Categories of sources, business purposes, and third parties to whom personal information is disclosed or shared are listed in §§ 3 , 4 , and 5 . We use the following categories of personal information for cross-context behavioral advertising: identifiers, internet / network activity, and commercial information — shared with Google LLC, Meta Platforms, Inc., and Microsoft Corporation.

10.3 Brazil (LGPD)

  • Confirmation of processing and access (Art. 18(I)–(II)).
  • Correction, anonymization, blocking, or deletion (Art. 18(III)–(IV)).
  • Portability (Art. 18(V)).
  • Information about sharing (Art. 18(VII)).
  • Revocation of consent (Art. 18(IX)).
  • Our Data Protection Officer / “Encarregado” contact: privacy@internationalautomobileauthority.com .
  • You may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

10.4 Canada (PIPEDA + Quebec Law 25)

  • Access to your personal information and the right to challenge its accuracy (PIPEDA Principles 9 and 10).
  • Quebec residents: portability and automated-decision disclosure rights under Law 25.
  • Complaint path: Office of the Privacy Commissioner of Canada; Commission d’accès à l’information (Quebec).
  • Communications available in English or French on request.

10.5 Australia (Privacy Act 1988)

  • Access and correction rights under APP 12 and APP 13.
  • Complaint path: Office of the Australian Information Commissioner (OAIC).
  • Cross-border-disclosure countries are listed in § 6 .

10.6 United Arab Emirates (PDPL)

  • Access, rectification, erasure, objection, portability, and objection to automated decisions under Arts. 13–17 of Federal Decree-Law No. 45 of 2021.
  • Complaint path: UAE Data Office.

10.7 Kingdom of Saudi Arabia (PDPL)

  • Right to be informed, access, correct, destroy, and limit processing under Art. 4.
  • Complaint path: Saudi Data and Artificial Intelligence Authority (SDAIA).

11. Sensitive and special-category data — automated biometric processing

Automated biometric processing is used to assist human reviewers for fraud prevention and identity verification. Our trained expert reviewers check uploaded documents with the assistance of AI tools to detect fraud and verify identity. The final decision on identity verification is always made by a human reviewer. Full details, including your Illinois BIPA written release, Texas CUBI notice, Washington MHMDA notice, and GDPR Art. 9(2)(a) explicit-consent mechanism, are set out in § 18 below. We have conducted a Data Protection Impact Assessment under GDPR Art. 35.

We do not: run liveness detection; enroll your face in a facial-recognition database; compare your face against external watchlists; share your biometric data with advertising partners.

12. Children

Our service is intended for individuals 18 years of age or older. We do not knowingly collect personal data from minors. If we learn we have collected data from a person under 18, we will delete it. Contact privacy@internationalautomobileauthority.com to report such cases.

13. Cookies and similar technologies

Our use of cookies, pixels, SDKs, and similar technologies is described in our Cookie Policy . We use Google Analytics, Google Ads conversion tags, Google Tag Manager, Meta Pixel, and Microsoft Advertising / Bing Ads UET. We do not currently load TikTok, LinkedIn, Pinterest, or Snap tags.

Our Consent Management Platform (CMP) is Cookiebot, operated by Cybot A/S (Denmark). Cookiebot is being installed on our site. Until the Cookiebot script is live in production, non-essential cookies (analytics and marketing) are not loaded for visitors from the European Union, United Kingdom, and Brazil; essential cookies are always loaded. Once Cookiebot is live, visitors from those regions will see a consent banner and may accept, reject, or customize non-essential cookies.

14. Electronic communications

Transactional emails are sent as part of order fulfillment. Transactional SMS and WhatsApp messages are sent via Twilio and the WhatsApp Business API (via Meta). Marketing emails are sent only after you opt in. We do not send marketing SMS or WhatsApp at this time; if that ever changes, we will update this Policy and obtain appropriate prior express written consent. Full details on SMS and WhatsApp messaging — including opt-out mechanisms, legal frameworks, and platform disclosures — are set out in § 19 .

15. Affiliate program

We operate an affiliate program with a 20 percent commission per sale. Affiliates are required to disclose material connections consistent with the FTC Endorsement Guides (16 CFR Part 255). See our Affiliate Program Terms. Affiliate-tracking cookies collect commercial and identifier data to attribute sales.

16. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified through our website and, where required, by email. The last-updated date at the top of this Policy reflects the current version.

17. Complaint routes and contact

For any question, request, or complaint, contact privacy@internationalautomobileauthority.com . You also have the right to lodge a complaint with your local data-protection authority.

18. Biometric data

International Automobile Authority (“IAA”), operated by International Automobile Authority LLC, uses automated biometric processing to assist human reviewers in verifying identity and preventing fraud. This section satisfies the Illinois BIPA “publicly available written policy” requirement (740 ILCS 14/) and provides notice under other applicable state and international laws.

18.1 What we process and why

  • What we process. Photographs of your domestic driver’s license (front and back) and a passport-style selfie that you upload at checkout. Automated tools derive image features that assist human reviewers in detecting fraud and confirming that the selfie matches the DL image.
  • Why we process. Identity verification and fraud prevention for the fulfillment of your IAA-DLT order.
  • How it works. Our trained expert reviewers check uploaded documents with the assistance of AI tools to detect fraud and verify identity. The final decision on identity verification and order fulfillment is always made by a human reviewer.

18.2 What we do NOT do

  • We do not perform a liveness check.
  • We do not enroll your face in a facial-recognition database, build a persistent face-identity profile, or compare your face against external watchlists.
  • We do not share your biometric data with advertisers or marketing partners.
  • We do not name a vendor publicly at this time; our fraud-prevention controls are administered internally.

18.3 Retention

  • Biometric-related images (DL photos, selfie) are retained for the lifetime of IAA-DLT validity + six (6) months , as documented in § 7 . This duration is justified by the Replacement Guarantee, the Rejection Guarantee, and fraud prevention.
  • Electronic-signature records are retained for the lifetime of IAA-DLT validity plus seven (7) years for audit.
  • You may request earlier deletion under the rights in § 10 , subject to our legal obligations and legitimate interests.

18.4 Consent and notice by jurisdiction

18.4.1 Illinois — BIPA (740 ILCS 14/)

18.4.2 Texas — CUBI (Tex. Bus. & Com. Code § 503.001)

We provide you with informed notice of our biometric processing before collection and obtain your consent at checkout.

18.4.3 Washington — biometric statute (RCW 19.375) and My Health My Data Act (RCW 19.373)

We provide notice and obtain consent before any “enrollment” in a biometric system. For Washington residents, a separate consent line is displayed at checkout.

18.4.4 European Union / EEA and United Kingdom — GDPR Art. 9(2)(a)

Biometric data used to uniquely identify a person is “special category” data under GDPR Art. 9 and UK-GDPR Art. 9. We process this category on the basis of your explicit consent , captured at checkout through a specific, informed, and unambiguous consent mechanism. You may withdraw consent at any time; see § 10 .

18.4.5 Other US states and jurisdictions

Where applicable, we provide notice and honor rights under state privacy laws (California CCPA / CPRA, Colorado, Virginia, Connecticut, Utah, Texas, Oregon, and others). Notice of sensitive-information processing and the California “Limit Use of Sensitive Personal Information” right are available through § 10.2 .

  • Purpose of collection and storage. We capture, store, and use your selfie and DL images to verify your identity and to prevent fraud.
  • Length of time kept. See § 18.3 above.
  • Written release. We obtain your electronic written release at checkout via an unchecked-by-default, specific checkbox. Your electronic signature constitutes a written release under the 2024 amendments to BIPA (Illinois SB 2979).

18.5 Your rights

You may at any time:

To exercise any right, contact privacy@internationalautomobileauthority.com . If you withdraw consent before your order is produced, we may be unable to fulfill the order; in that case, we will refund your purchase.

  • Withdraw consent for biometric processing;
  • Request access to the biometric-related data held about you;
  • Request correction of inaccurate data;
  • Request deletion , subject to legal-hold exceptions;
  • Request information about any disclosures.

18.6 Data Protection Impact Assessment

We have performed a Data Protection Impact Assessment under GDPR Art. 35 for this processing.

18.7 EU representative and DPO posture

IAA has assessed its obligations under GDPR Art. 27 (EU representative) and Art. 37 (Data Protection Officer). As stated in § 1.1 , given the current limited scale of processing, neither a designated EU/UK representative nor a mandatory DPO is required at this time. IAA will reassess and appoint these roles if the scale, scope, or nature of its processing changes materially. For any data-protection question, contact privacy@internationalautomobileauthority.com .

18.8 Disclosures to third parties

  • Biometric-related images are not shared with advertising partners.
  • We may share images with Stripe or law-enforcement authorities only when strictly necessary for fraud investigation or when required by law.
  • Our processors (for example, Airtable as a storage layer) operate under written data-processing terms.

18.9 Security

Technical and organizational safeguards are described in § 9 . Biometric-related images are stored with encryption in transit (TLS) and at rest, and access is restricted on a need-to-know basis.

19. Electronic communications

This section explains the SMS and WhatsApp messages that IAA sends to customers in connection with their orders, how you can opt out, and the legal frameworks that apply.

19.1 Scope — transactional only

  • At launch, IAA sends transactional SMS and WhatsApp messages only . We do not send marketing or promotional SMS or WhatsApp messages at this time.
  • Transactional messages are messages necessary to fulfill and support your order, including: order confirmation; production-status updates; shipping dispatch and tracking updates; identity-verification prompts; and critical service notices.
  • If we ever decide to introduce marketing SMS or WhatsApp messages, we will first obtain a separate, clear, unchecked-by-default, prior-express-written-consent opt-in, update this section, and update this Policy.

19.2 Platforms

Our use of these providers is described in § 5 .

  • SMS delivery: Twilio, Inc.
  • WhatsApp delivery: WhatsApp Business API, operated through Meta Platforms, Inc.

19.3 Consent mechanism

  • When you enter your phone number at checkout, you provide the information necessary for us to send transactional messages related to your order. Providing your phone number constitutes implicit consent to transactional communications to that number, including via WhatsApp where “WhatsApp preferred” is noted.
  • No separate marketing opt-in is collected at this time because no marketing messages are sent.

19.4 Frequency and charges

  • Message frequency depends on your order lifecycle and typically includes a small number of messages per order.
  • Standard message and data rates may apply depending on your mobile plan. IAA does not charge for sending SMS or WhatsApp messages.

19.5 How to opt out

Caveat. If you opt out of transactional messages, we may be unable to send you important order-fulfillment updates. We will still attempt to contact you by email.

  • SMS: reply STOP to any SMS message to stop further messages. Reply HELP for help.
  • WhatsApp: reply STOP to any WhatsApp message, or block our sender number.
  • Alternative channels: email hello@internationalautomobileauthority.com from the address associated with your order with the word “UNSUBSCRIBE” and your phone number.
  • We honor opt-outs through any reasonable method , consistent with the FCC 2024 Opt-Out Rule (effective April 11, 2025). Opt-outs are honored within 10 business days.

19.6 Legal frameworks

19.6.1 United States — TCPA: Transactional messages sent for order fulfillment generally do not require prior express written consent, but we honor opt-outs under the FCC 2024 Opt-Out Rule. No marketing SMS is sent; if we ever enable marketing SMS, TCPA prior-express-written-consent requirements will apply.

19.6.2 Canada — CASL: Transactional messages for ordered goods or services fall within CASL’s transactional-exemption framework. No marketing SMS or WhatsApp is sent to Canadian residents.

19.6.3 European Union / EEA — GDPR + ePrivacy: Transactional messages are sent on the basis of contract performance (GDPR Art. 6(1)(b)) and legitimate interests. No marketing SMS or WhatsApp is sent to EU / EEA residents.

19.6.4 United Kingdom — PECR: UK PECR Reg. 22 applies the same opt-in / soft-opt-in framework. No marketing SMS or WhatsApp is sent to UK residents.

19.6.5 Brazil — LGPD + CDC: No marketing SMS or WhatsApp is sent to Brazilian residents.

19.6.6 Other jurisdictions: We comply with applicable electronic-communications rules in each customer’s jurisdiction. No marketing SMS or WhatsApp is sent.

19.7 WhatsApp-specific notes

  • WhatsApp Business API distinguishes between template messages (pre-approved, transactional) and session messages (free-form within a customer-initiated window).
  • All outbound transactional messages from IAA use approved templates aligned with WhatsApp Business policy.

19.8 Security and privacy

  • Your phone number and message history are processed by Twilio (SMS) and WhatsApp / Meta (WhatsApp) as described in § 5 . International transfers are handled under the mechanisms in § 6 .
  • We retain message logs as part of our support-ticket retention (three (3) years from last contact) under § 7 .

19.9 Contact

  • Support and opt-out assistance: hello@internationalautomobileauthority.com
  • Privacy questions: privacy@internationalautomobileauthority.com

20. Governing law

This Privacy Policy shall be governed by and construed in accordance with the laws of the State of Florida, United States, without regard to its conflict-of-laws rules. This governing-law choice does not deprive you of any mandatory consumer protection afforded by the law of your country of residence.

International Automobile Authority LLC , 2125 Biscayne Boulevard, Ste 204 #20167, Miami, Florida 33137, USA.

Popular Destinations

Planning to drive abroad? Get your International Driving Permit easily and cost-effectively. Drive or rent vehicles in more than 189 countries with our IDP.

Philippines

Thailand

Portugal

Spain

United Kingdom

Turkey

Indonesia

Malaysia

France

Greece

United Arab Emirates

United States of America