Privacy Policy

Last updated: July 23, 2026

Introduction

Innova-Apps ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we handle your information when you use our Email to ServiceNow add-in for Microsoft Outlook ("Service"). The Service is completely free — there is no Innova-Apps account, no sign-up, no subscription, and no paid tier. Your identity is simply your own ServiceNow account.

Information We Process

When you use Email to ServiceNow, the Service processes:

• The email you select: The subject (used to pre-fill the record's Short description), the body (used to pre-fill the Description), the original email saved as an .eml file, and the email's own file attachments — all read from the open message via Office.js only when you choose to create a record. This content can include personal data of third parties, such as the names and email addresses of senders and recipients.
• The sender's email address: Read from the open message and used to match the corresponding ServiceNow caller. You can override the matched caller manually.
• Your ServiceNow connection details: The instance URL and the OAuth Client ID (and Client Secret, if your instance requires one), or — when Basic auth is used as a fallback — the username and password of a dedicated integration user. You enter these yourself and they are stored only on your device.
• Your ServiceNow OAuth tokens: Held so the Service can act on your behalf against your instance. They are stored only in your own Outlook client (browser localStorage on the add-in origin) and are never stored on our servers.
• Optional AI processing of the subject and body: If you enable the AI feature, the email subject and body are sent to Google's Gemini (via Firebase AI Logic / Vertex AI in Firebase) to generate a suggested title and summary that you review and edit. This happens only while the feature is turned on; with it off, no email text is sent for summarization.

Information We Do NOT Collect

• Email content and attachments are never retained on our servers — record data is sent from your browser directly to your ServiceNow instance and does not pass through Innova-Apps servers.
• No Innova-Apps or publisher account and no sign-up — your identity is your own ServiceNow account.
• No analytics or telemetry of your email content, and no usage tracking for advertising.
• No AI processing of your email except through the optional AI feature — the AI title-and-summary feature is optional and can be switched off with a single toggle. Only while it is on are the email subject and body sent to Google's Gemini (via Firebase AI Logic) to draft the title and summary; that text is not used to train Google's models, and with AI off nothing is sent to Google for summarization.
• No payment or billing information — the add-in is completely free, with no subscription, trial, or in-app purchase.
• With OAuth we never see your ServiceNow password (authentication uses OAuth 2.0 with PKCE).

How We Use Your Information

• Turn an Outlook email you select into a ServiceNow record — an incident by default, or another table your ServiceNow admin has configured (for example a Customer Service case or a custom table) — on the instance you connect.
• Pre-fill the record's Short description from the email subject and its Description from the body, match the sender to the ServiceNow caller, and let you set urgency, impact, category, assignment group, and assignee before creating the record.
• Attach the original email (.eml) and the email's own file attachments to the record.
• Optionally, when you enable the AI feature, draft a clearer title from the email subject and a short summary with an action-items list from the body, which you review and edit before creating the record.
• Keep a short local list of up to 25 recently created records so you can find them again.

We do not build user profiles, do not track usage for advertising, and do not use your data to train AI models.

Where Data Is Stored

• Record data — the subject, body, .eml, and attachments — goes from your browser directly to your own ServiceNow instance via its REST Table and Attachment APIs. It does not pass through Innova-Apps servers and is not retained by us.
• Optional AI summarization: The AI title-and-summary feature is optional. When it is turned on, the email subject and body are sent from the task pane to Google's Gemini models (gemini-2.5-flash-lite) via Firebase AI Logic (Vertex AI in Firebase) to generate the suggested title and summary; per the Firebase AI Logic / Vertex AI terms, this content is not used to train Google's models. There is no separate Innova-Apps backend for this call, and it is protected by Firebase App Check. When AI is turned off, the subject and body are not sent to Google for summarization.
• Our only backend is a stateless OAuth token broker (Firebase Functions). It relays the OAuth authorization-code and refresh-token exchange to your instance's /oauth_token.do endpoint — needed only because that ServiceNow endpoint does not send CORS headers. The broker persists nothing and logs no tokens, secrets, or authorization codes.
• Connection settings, OAuth tokens, and the local list of up to 25 recently created records (each entry is just the record number plus a short description derived from the email subject) are stored only in the task pane's browser localStorage on the add-in origin (email-to-servicenow.web.app).
• The add-in pages and the OAuth broker are hosted on Google Firebase.

Sharing, Transfer, and Disclosure of User Data

We are transparent about the service providers ("subprocessors") that make the Service work:

• Your ServiceNow instance: The destination for record data. When you create a record, the record fields, the original email (.eml), and its attachments are transferred from your browser directly to your instance. This transfer only occurs when you explicitly create a record.
• Microsoft: The add-in runs inside Outlook / Microsoft 365 and uses the Office.js host platform.
• Google Firebase: Hosts the add-in pages and the stateless OAuth token broker described above.
• Google (Firebase AI Logic / Vertex AI): Only when you enable the optional AI feature, the email subject and body are sent to Google's Gemini models via Firebase AI Logic (Vertex AI in Firebase) to generate the suggested title and summary. Per the Firebase AI Logic / Vertex AI terms, this content is not used to train Google's models. This transfer happens only while the AI feature is turned on.

We do NOT share, sell, rent, or disclose your data to:

• Advertisers or ad networks
• Data brokers
• Information resellers
• AI providers for advertising, profiling, or model training (the optional AI feature sends the subject and body to Google's Gemini only to draft the title and summary, and that text is not used to train Google's models)
• Any other third parties for their own marketing purposes

Third-Party Services

Our Service relies on:

• Microsoft Office 365: For Outlook integration and the Office.js host platform. Microsoft Privacy Policy
• Google Firebase: Hosts the add-in pages and the stateless OAuth token broker. Firebase Privacy
• Google Firebase AI Logic (Vertex AI / Gemini): Used only for the optional AI title-and-summary feature; when it is on, the email subject and body are processed by Google's Gemini models and are not used to train Google's models. Firebase Privacy
• Your ServiceNow instance: The destination for record data, operated by your own organization. ServiceNow Privacy Statement

Data Security

• All traffic uses TLS; the add-in pages and the OAuth broker are served over HTTPS from Google Firebase.
• Authentication uses OAuth 2.0 with PKCE against your own ServiceNow instance, so your organization's SSO and MFA apply and we never see your ServiceNow password. A dedicated "Web service access only" integration user with Basic auth is available as a fallback.
• Your access and refresh tokens live only on your own device (browser localStorage), never server-side; the OAuth broker is stateless and holds no per-user data.
• Record data is sent from your browser directly to your instance's REST APIs. This requires your ServiceNow admin to add CORS rules that allow the add-in domain.
• When the optional AI feature is on, the call to Google's Gemini models (via Firebase AI Logic) is made over HTTPS and protected by Firebase App Check (reCAPTCHA), which guards the AI quota against abuse.
• Minimum access: the connecting user (or integration user) needs only write access to the target table and permission to create attachments — no account-wide or destructive privileges.

Data Retention and Deletion

Because nothing is stored on Innova-Apps servers, there is nothing for us to retain or delete after use — record data lives only in your ServiceNow instance, and your tokens and settings stay on your device. Tokens are cleared when you sign out or disconnect within the add-in. Your connection settings and the local recent-records list are cleared when you change the instance or clear your browser data. Record data stored in ServiceNow is governed by your organization's own ServiceNow retention and deletion policies; to remove it, contact your ServiceNow administrator.

Your Rights

• Access the personal data we hold about you — note that we hold none on our servers
• For records and any data in ServiceNow, request access, correction, or deletion through your organization's ServiceNow administrator
• Disconnect your ServiceNow account at any time from within the add-in, which clears the stored tokens from your device
• Contact us with any questions about this policy

Contact Us

For questions about this Privacy Policy:

• Email: support@innovaapps.ai
• Support: Support page