Privacy Policy

Last updated: July 22, 2026

Introduction

Innova-Apps ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we handle your information when you use our Email to ServiceNow add-in for Microsoft Outlook ("Service"). The Service is completely free — there is no Innova-Apps account, no sign-up, no subscription, and no paid tier. Your identity is simply your own ServiceNow account.

Information We Process

When you use Email to ServiceNow, the Service processes:

• The email you select: The subject (used to pre-fill the record's Short description), the body (used to pre-fill the Description), the original email saved as an .eml file, and the email's own file attachments — all read from the open message via Office.js only when you choose to create a record. This content can include personal data of third parties, such as the names and email addresses of senders and recipients.
• The sender's email address: Read from the open message and used to match the corresponding ServiceNow caller. You can override the matched caller manually.
• Your ServiceNow connection details: The instance URL and the OAuth Client ID (and Client Secret, if your instance requires one), or — when Basic auth is used as a fallback — the username and password of a dedicated integration user. You enter these yourself and they are stored only on your device.
• Your ServiceNow OAuth tokens: Held so the Service can act on your behalf against your instance. They are stored only in your own Outlook client (browser localStorage on the add-in origin) and are never stored on our servers.

Information We Do NOT Collect

• Email content and attachments are never retained on our servers — record data is sent from your browser directly to your ServiceNow instance and does not pass through Innova-Apps servers.
• No Innova-Apps or publisher account and no sign-up — your identity is your own ServiceNow account.
• No analytics or telemetry of your email content, and no usage tracking for advertising.
• No AI processing of any kind — your email is not sent to any AI service.
• No payment or billing information — the add-in is completely free, with no subscription, trial, or in-app purchase.
• With OAuth we never see your ServiceNow password (authentication uses OAuth 2.0 with PKCE).

How We Use Your Information

• Turn an Outlook email you select into a ServiceNow record — an incident by default, or another table your ServiceNow admin has configured (for example a Customer Service case or a custom table) — on the instance you connect.
• Pre-fill the record's Short description from the email subject and its Description from the body, match the sender to the ServiceNow caller, and let you set urgency, impact, category, assignment group, and assignee before creating the record.
• Attach the original email (.eml) and the email's own file attachments to the record.
• Keep a short local list of up to 25 recently created records so you can find them again.

We do not build user profiles, do not track usage for advertising, and do not use your data to train AI models.

Where Data Is Stored

• Record data — the subject, body, .eml, and attachments — goes from your browser directly to your own ServiceNow instance via its REST Table and Attachment APIs. It does not pass through Innova-Apps servers and is not retained by us.
• Our only backend is a stateless OAuth token broker (Firebase Functions). It relays the OAuth authorization-code and refresh-token exchange to your instance's /oauth_token.do endpoint — needed only because that ServiceNow endpoint does not send CORS headers. The broker persists nothing and logs no tokens, secrets, or authorization codes.
• Connection settings, OAuth tokens, and the local list of up to 25 recently created records (each entry is just the record number plus a short description derived from the email subject) are stored only in the task pane's browser localStorage on the add-in origin (email-to-servicenow.web.app).
• The add-in pages and the OAuth broker are hosted on Google Firebase.

Sharing, Transfer, and Disclosure of User Data

We are transparent about the service providers ("subprocessors") that make the Service work:

• Your ServiceNow instance: The destination for record data. When you create a record, the record fields, the original email (.eml), and its attachments are transferred from your browser directly to your instance. This transfer only occurs when you explicitly create a record.
• Microsoft: The add-in runs inside Outlook / Microsoft 365 and uses the Office.js host platform.
• Google Firebase: Hosts the add-in pages and the stateless OAuth token broker described above.

We do NOT share, sell, rent, or disclose your data to:

• Advertisers or ad networks
• Data brokers
• Information resellers
• Any AI provider
• Any other third parties for their own marketing purposes

Third-Party Services

Our Service relies on:

• Microsoft Office 365: For Outlook integration and the Office.js host platform. Microsoft Privacy Policy
• Google Firebase: Hosts the add-in pages and the stateless OAuth token broker. Firebase Privacy
• Your ServiceNow instance: The destination for record data, operated by your own organization. ServiceNow Privacy Statement

Data Security

• All traffic uses TLS; the add-in pages and the OAuth broker are served over HTTPS from Google Firebase.
• Authentication uses OAuth 2.0 with PKCE against your own ServiceNow instance, so your organization's SSO and MFA apply and we never see your ServiceNow password. A dedicated "Web service access only" integration user with Basic auth is available as a fallback.
• Your access and refresh tokens live only on your own device (browser localStorage), never server-side; the OAuth broker is stateless and holds no per-user data.
• Record data is sent from your browser directly to your instance's REST APIs. This requires your ServiceNow admin to add CORS rules that allow the add-in domain.
• Minimum access: the connecting user (or integration user) needs only write access to the target table and permission to create attachments — no account-wide or destructive privileges.

Data Retention and Deletion

Because nothing is stored on Innova-Apps servers, there is nothing for us to retain or delete after use — record data lives only in your ServiceNow instance, and your tokens and settings stay on your device. Tokens are cleared when you sign out or disconnect within the add-in. Your connection settings and the local recent-records list are cleared when you change the instance or clear your browser data. Record data stored in ServiceNow is governed by your organization's own ServiceNow retention and deletion policies; to remove it, contact your ServiceNow administrator.

Your Rights

• Access the personal data we hold about you — note that we hold none on our servers
• For records and any data in ServiceNow, request access, correction, or deletion through your organization's ServiceNow administrator
• Disconnect your ServiceNow account at any time from within the add-in, which clears the stored tokens from your device
• Contact us with any questions about this policy

Contact Us

For questions about this Privacy Policy:

• Email: support@innovaapps.ai
• Support: Support page