How Claimory handles your data

What Claimory collects and why

Claimory collects what is needed to run a collision claim: shop profile (business name, address, phone), team member accounts (name, email, role), claim records (customer, vehicle, VIN, carrier, claim number, repair milestones, supplements, photos, notes), customer contact information (name, phone, email), and payment information processed by Stripe. Claimory does not store raw card numbers. Stripe handles PCI-DSS compliance. Usage data (which features are used, session length, error events) is collected to improve the product. No claim content is sold to third parties, ever.

Workspace isolation: your data is yours alone

Every Claimory workspace is isolated at the database level using Postgres row-level security. A user on one workspace cannot query, read, or access any data from another workspace. This applies even if two shops share a user email. Claimory support staff can access workspace data only when explicitly requested by the workspace owner for troubleshooting purposes, and this access is logged.

GDPR and CCPA posture

Claimory is CCPA-aligned for California residents. You can request a copy of all personal data, request deletion, and opt out of any sale of personal information (Claimory does not sell personal data). For GDPR purposes, Claimory acts as a data processor for your shop's customer data. You control it. Claimory provides the tools. A data processing agreement is available on request for Enterprise customers.

Data export and cancellation

When you cancel, your data does not disappear immediately. You have 30 days to request a copy of your data, including claims, supplements, photos, customer records, and financial summaries. Email privacy@claimory.io and Claimory will provide it within the timeframe required by applicable law. After 30 days, data is queued for deletion and cannot be recovered.

Five supporting pillars

• What gets collected: claim records, shop info, customer contact details (name, phone, email, vehicle, claim number), payment info via Stripe (Claimory never sees raw card numbers), and session/usage data for product improvement.
• How it is protected: TLS 1.2+ in transit, AES-256 at rest, Postgres row-level security per workspace so one shop cannot see another's data, audit logging, and daily backups via our infrastructure provider.
• AI and your data: Claimory AI processes claim context to generate drafts and audits. AI prompts use claim context only and are never used to train provider models. Your claim data is never used to train external models.

Key capabilities

• TLS 1.2+ in transit, AES-256 at rest
• Postgres row-level security per workspace
• Two-factor authentication (on the roadmap)
• AI prompts use claim context only and are never used to train provider models
• Stripe handles all payment processing, no raw card data on Claimory servers
• CCPA-aligned data handling for California residents
• 30-day post-cancellation window to request a copy of your data

Common questions