Privacy & Data Processing Agreement

The data processed on our systems is extremely limited. Our browser extension runs entirely on your local device, within your browser, using your existing ServiceNow session and permissions.

For clarity, the following categories of data never leave your device, under any plan or configuration:

• ServiceNow scripts, code, or business logic
• ServiceNow record data or field values
• ServiceNow credentials, session tokens, or authentication cookies
• Ticket content, attachments, or other business data
• Individual action timestamps (daily aggregates only, and only where usage analytics are enabled)

The data that we process (and which might include your personal data) is processed only to the limited extent and purposes described in Section 2.

2.1 Pro Plan (Self-Service)

Our personal data processing is limited to what is strictly necessary for operating the service. Payment is processed entirely by our third-party payment provider and subject to their terms.

License checks occur at most once per day and concern the following data:

2.2 Enterprise (Store App)

License data is held on your own ServiceNow instance. The Store App communicates with SN Utils servers for validation without transmitting any user-level personal data or instance information. SN Utils receives no personal data in this configuration as part of the standard validation flow.

2.3 Fully Autonomous Operation

For organisations with strict regulatory or security requirements, a fully disconnected setup is available. In this configuration, SN Utils operates entirely on your ServiceNow instance without any backend communication — no external calls are made and no personal data is transmitted to SN Utils. Contact support@snutils.com for more information.

2.4 Optional Features

We process additional data only to the extent that you actively choose to enable optional features, and only for the purpose of providing them:

We use the following third-party sub-processors in connection with the Service:

We may engage new sub-processors from time to time as the Service evolves. Where we intend to add a new sub-processor, we will provide reasonable advance notice by email or through a notice on our website. If you have a legitimate objection to the new sub-processor on data protection grounds, you may raise it by contacting support@snutils.com within 14 days of the notice. We will work with you in good faith to address any reasonable concern. If no resolution can be reached, you may terminate your subscription in accordance with the Service Terms, and we will issue a pro-rata refund for any unused prepaid period.

All our sub-processors are bound by data processing agreements compliant with applicable privacy laws. Where data is transferred outside the EU/EEA, appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required under GDPR.

4.1 Security Measures. To the extent we process your data on our systems, we commit to securing them by implementing technical and organisational measures consistent with applicable industry standards, including but not limited to:

• Encryption: All data in transit uses TLS 1.3. License keys are cryptographically signed. Data stored by SN Utils, including optional cloud sync data, is encrypted at rest.
• Access Control: Access to personal data is restricted to authorised personnel on a least-privilege basis. Multi-factor authentication is required for internal systems access.
• Transparency and Review: The extension's source code is accessible for independent security review. We maintain clear documentation of our data collection practices and respond to security inquiries promptly.

For more information on our security setup, please see our Security page.

4.2 Personal Data Breaches. Should we be impacted by a data breach affecting your personal data, we will notify you without undue delay.

4.3 Security Inquiries. Security inquiries and vulnerability reports can be directed to security@snutils.com.

The rights available to individuals in connection with personal data processed through the Service depend on the nature of the relationship between us.

Your Rights Under GDPR

If you are an EU/EEA resident, your rights include:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing for direct marketing
• Restriction: Request restricted processing under certain conditions

Your Rights Under CCPA

If you are a California resident, your rights include:

• Know: Request disclosure of data collected
• Delete: Request deletion of personal information
• Opt-Out: We do not sell personal information
• Non-Discrimination: We will not discriminate for exercising your rights

SN Utils B.V. is based in the Netherlands. Some of our sub-processors may process data outside the EU/EEA. Where data is transferred outside the EU/EEA, appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required under GDPR. See Section 3 for the full list of sub-processors and their processing regions.

SN Utils is designed for professional use by adults in corporate environments. We do not knowingly collect information from children under 16.

We may update this Privacy & Data Processing Agreement from time to time. We will notify you of material changes by email or through a notice on our website and by updating the "Last Updated" date. Your continued use of the Service after changes take effect constitutes acceptance of the updated agreement.

For privacy-related inquiries, data subject requests, or to report a concern:

SN Utils B.V.
Email: support@snutils.com
Security: security@snutils.com

If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.