Data protection

Phew processes the minimum personal data needed to issue a policy and handle claims, in line with the GDPR.

Roles

• For customers’ policies and claims, Phew is the controller (together with the insurer, for underwriting).
• For data you send that Phew doesn’t need for the policy, we don’t keep it.
• For partners’ merchant data processed on their instructions, Phew acts as a processor under a data processing agreement (DPA). We sign a DPA with every partner before go-live.

What we receive

Data	Why	Required
Customer name and email	Policy documents, claims contact	Yes
Customer locale and country	Language, product rules for the market	Yes
Phone number	Claims contact	No
Order reference, items, prices	Pricing and the insured item	Yes
Payment reference	Matching funds (split settlement only)	No
Postal address	Only when a claim needs collection or delivery, gathered by Phew directly	No

What we never receive

• Card numbers, CVCs, expiry dates or any payment credentials.
• Bank account details of customers (refunds go through the original payment method or the merchant).
• National identity numbers.
• Special category data. Claims never require health data.

Because Phew never stores, processes or transmits cardholder data, PCI DSS doesn’t apply to Phew integrations.

Encryption

• In transit: TLS 1.2 or 1.3 for all traffic, including between our internal services. HSTS on every public hostname.
• At rest: all databases, backups and file storage are encrypted with AES-256 by our infrastructure provider.
• Secrets: stored in a managed secret store, never in source code, and injected only at deploy time. One-time tokens such as setup links are stored only as SHA-256 hashes.

Where data is stored

Phew runs on Cloudflare’s network. Requests are served at the edge closest to the caller; persistent data is stored in databases and object storage.

EU data residency is in progress

We are moving all persistent customer data to EU-jurisdiction storage before general availability. Until then, sandbox and pilot data may be stored outside the EU. Contact us if this matters for your pilot.

Retention

Data	Kept for
Offers that never became a policy	30 days
Policies and claims	Policy term plus the statutory limitation period for insurance claims
Settlement statements	As required by bookkeeping law (currently 5 years in Norway)
API request logs	30 days, then aggregated without personal data

Data subject rights

Customers can ask Phew for access, correction or deletion at privacy@getphew.com. If a customer contacts you about data Phew holds, forward the request and we’ll respond within the statutory deadline.

Sub-processors

We share our current list of sub-processors with partners during onboarding and notify them before adding new ones.