Privacy policy
Last updated: 10 October 2026
HolySN is a browser extension for people who build on ServiceNow, and holysn.com is the website where you create an account, manage a plan and read the documentation. This policy explains what both store, what leaves your browser, who else sees it, and what they never touch.
Controllers: Alessio Bonassisa and Edoardo Garabagiu, who run HolySN together and are joint controllers of your personal data under Article 26 of the GDPR. You can exercise your rights with either of them, through the contact below. The essence of their arrangement is available on request.
Contact: support@holysn.com
There is no Data Protection Officer. The service does not meet the Article 37 thresholds that would require one.
In one screen
| Where it lives | What |
|---|---|
| Stays on your machine | The records you inspect, the update sets you browse, your ServiceNow session cookie, dark mode, and everything the extension merely displays |
| Syncs to our backend | Your account, scripts, snippets, themes, chats, recorded tests, encrypted vault entries, your plan and command counts |
| Goes to a third party | What you ask the AI assistant, dictated audio and any file you attach (to the AI gateway); your card details (to Stripe, never to us); account emails (to the email provider) |
What HolySN is, in privacy terms
Most of HolySN runs inside your browser, against the ServiceNow instance you are already signed in to. A few things leave it: your account and workspace, which sync between your machines; what you ask the AI assistant, which goes to a model provider; a payment, which Stripe handles; and what you choose to share, with a colleague or on the public shelf. Everything else stays local.
Data we collect
Account and identity
| What | Why |
|---|---|
| Email address and password hash | Sign-in and account recovery. Handled by Supabase Auth; we never see the password itself |
| A passkey, if you add one | Sign-in. Only the public key is stored; the private key never leaves your device |
| Your Google, Microsoft or GitHub identity, if you sign in with one | Sign-in. We receive your email address and the name on that account, nothing else |
| A public handle | How other users find you, and how you are shown to them |
| A profile picture, if you set one | Shown next to your name |
Your email is used for sign-in, account email and support. It is not used for marketing.
A profile picture is redrawn onto a 256x256 canvas in your browser before upload, so EXIF metadata (including the GPS coordinates a phone photo carries) is discarded and never reaches us.
Signed-in sessions
Each time you sign in, Supabase records the session with its IP address and the browser's user agent, so that Account, Security can list where you are signed in and let you sign a session out. The place shown next to a session (a city and a country) is worked out on our own server from a local copy of the DB-IP City Lite database; the address is not sent to anyone to look it up.
Your plan and payments
If you buy Pro or extra assistant usage, the payment is made on a form served by Stripe. Your card number, expiry date and security code go to Stripe and never reach us. What we keep is the reference Stripe gives us: a customer id, the subscription and its status, the plan and the date it runs until. Invoices and receipts are issued and kept by Stripe.
Stripe also runs fraud checks on the payment form, which is why it sets the cookies listed on the cookies page.
If you redeem a trial code, we record which code, when the trial started and ends, and what the account had spent on the assistant that month when it started, so the trial's allowance is counted from zero. The record is what stops a second trial on the same account.
Pro on your devices
Pro works on up to three browsers. To count them, the extension gives each browser a random identifier, and we store it with a label for the browser, when it was last seen, and which ones hold a seat right now. You can see and remove them under Account, Security.
Your workspace
Profiles, saved scripts, snippets, script packages, themes and preferences are stored so they follow you between machines. This is content you write yourself. Every row is bound to your account and readable only by it, enforced by database policies rather than by the interface.
Saved scripts are stored as you wrote them. If you paste a record's data or a hardcoded value into a script, that is what gets stored.
Messages between connections
If you add a colleague and use the built-in chat, those messages are stored so they can be delivered, along with who sent what and when it was read. They are readable by you and by the person you sent them to.
Instance credentials (optional)
If you use the credential vault, the instance password and TOTP secret are encrypted inside your browser with a passphrase that never leaves your device. What we store is ciphertext. We cannot decrypt it, and neither can anyone who obtains the stored data. Forgetting the passphrase means the entry is unrecoverable.
Stored readable. Alongside the ciphertext we store, in the clear: the customer or company label you typed, the environment name, the instance hostname, and the instance username. None of those is a secret and the interface lists them, but together they say which customer you work for. If that matters, use a label that does not name them.
The AI assistant
If you use the assistant, we store your conversations in full so a chat survives closing the tab, and the trace of an agentic run: the steps the model took, the tools it called, and any update-set XML it produced.
We also keep, per account and per month, how many tokens the assistant used and what they cost, so the monthly allowance can be applied. The browser is only ever told a percentage.
The assistant has no memory across conversations: nothing you tell it is kept to be recalled in a later chat.
Voice input (optional)
If you dictate instead of typing, your browser records audio and sends it once to be transcribed. The audio is not stored, not by us and not by the transcription provider we forward it to. It is forwarded, transcribed and discarded with the request. What survives is the text, placed in the input box for you to correct before you send it.
Recording only happens while you hold the dictation control. Your browser will ask for microphone permission the first time.
Recorded UI tests (optional)
If you record a test to replay later, the recording is stored so it follows your profile between machines.
Real instance data, unfiltered. A recording contains table and field names, the values typed
into forms, and the sys_ids of the records that were open. This is not filtered the way a question
to the assistant is.
Fields the platform marks as secret are excluded by the recorder and replaced with a placeholder that is asked for at replay time. Everything else is stored as recorded. Do not record a flow over production data you would not want stored.
Activity
We count which commands you run and on which day: the command name and the date, tied to your account, so the activity view is the same on every machine you use.
The argument is never counted. /sysid 9c57… is stored as one run of sysid and nothing else,
because the argument is the part that would say which customer you were working for. The instance
is not stored either. The table is shaped so that it cannot hold those facts, which is stronger
than promising not to write them.
Visits to the website
The server that runs holysn.com writes an access log: for each request, the page, the time, the browser's user agent, the page you came from, and the response. Your IP address goes into it with its last part zeroed before it is written (the last of the four numbers of an IPv4 address, all but the first 48 bits of an IPv6 one), so the log never holds the full address. Cookies and sign-in credentials are kept out of it.
We read that log on our own server to count visits and to spot errors and abuse. It sets no cookie, it involves no analytics or tracking service, and it is not shared with anyone. The log is deleted after 30 days.
The public shelf
If you publish a snippet or script to the shelf, it becomes readable by every signed-in HolySN account, together with the author name you chose. That is the point of publishing, and it is not reversible for anyone who already copied it. Withdrawing a published item removes it from the shelf, not from the machines of people who took it.
Data we do not collect
- No browsing history, page contents, clicks or keystrokes from anywhere outside the ServiceNow instances you use the extension on.
- No third-party analytics, advertising or tracking SDKs, in the extension or on the website.
- No crash reporting.
- No card numbers: payments are entered on Stripe's form and handled by Stripe.
- No location beyond the approximate place of a sign-in session described above, and no health data.
- No data used for advertising, for profiling, or for credit or lending decisions.
- No sale of data to anyone, under any definition of sale.
Why we are allowed to hold it
| Purpose | Legal basis |
|---|---|
| Creating your account, syncing your workspace, delivering chat, running the assistant, providing a plan you bought | Performance of a contract, Art. 6(1)(b) |
| Keeping records of payments | Legal obligation, Art. 6(1)(c) |
| Keeping the service secure, listing your sessions, preventing abuse and payment fraud, diagnosing failures | Legitimate interests, Art. 6(1)(f) |
| Counting command usage so the activity view works across your machines | Legitimate interests, Art. 6(1)(f) |
| Counting visits to the website and spotting errors and abuse, from its access log | Legitimate interests, Art. 6(1)(f) |
| Microphone access for dictation | Consent, Art. 6(1)(a) |
| Sending an attachment to the model, publishing to the shelf | Consent, Art. 6(1)(a) |
Where the basis is consent, you give it by performing the action and you can withdraw it by stopping. Withdrawal does not undo what was already sent.
Your ServiceNow instance
HolySN reads your ServiceNow session cookie so that the requests it makes on your behalf (reading the active update set, running a background script you asked for, fetching a record you are looking at) are authenticated as you. That cookie is used only against the instance it came from. It is never sent to our servers or to any third party.
The background scripts the extension runs for its own checks are removed from the instance's system log and Script Execution History after they run, so those records keep only what you ran yourself.
Data about other people
A ServiceNow instance is full of records about people who are not you: callers, assignees, requesters, approvers. Three features carry that data off your machine: the assistant, when it needs to read records to answer; recorded UI tests; and attachments.
For that data you or your employer are the controller and we act as a processor on your instructions. Using those features means you consider yourself entitled to send that data through this service. If you need a data processing agreement under Article 28 before you can, write to the contact address and ask for one.
Record data that HolySN merely displays (the records you inspect, the update sets you browse) stays in your browser and is not uploaded.
Attachments the model cannot read safely
You can attach files to a message to the assistant. Text files are scrubbed like everything else before they are sent.
Sent unfiltered, on purpose. Images and PDFs cannot be scrubbed, and are sent as they are. A screenshot of an incident carries every name, address and number that the scrubber strips out of the message beside it.
The interface says so next to the button. It is repeated here because it is the one place in HolySN where personal data leaves your machine unfiltered and by design.
Who else sees your data
| Recipient | What it receives | Role |
|---|---|---|
| Supabase: AWS eu-north-1, Stockholm, Sweden; Supabase Inc. is US-based | Database, authentication, file storage, realtime delivery, and the functions the assistant runs on. Its staff may access data for support | Processor |
| Vercel, AI Gateway: Vercel Inc., US; served from an EU edge | Your message to the assistant, the conversation so far, the page context and any record fields or rows it needed, all scrubbed of personal data first; attachments, including unscrubbed images and PDFs; dictated audio, for transcription; the content of agentic runs. The model providers behind the gateway are its sub-processors | Processor |
| Stripe: Stripe Payments Europe, Ireland; Stripe, Inc., US | Your payment details, email address and billing country, to take a payment and prevent fraud | Independent controller for payment processing and fraud prevention |
| netcup GmbH: Vienna, Austria | Hosting for this website, our compiler and our run service, which receives the source files the assistant generates | Processor |
| Resend: Resend, Inc., US | Your email address and the content of account emails: confirmation, sign-in links, password resets | Processor |
| Cloudflare: EU edge | Traffic in front of Supabase | Sub-processor |
| Google, Microsoft, GitHub | Only if you sign in with one of them: the fact that you are signing in to HolySN | Independent controllers |
| jsDelivr: third-party CDN | The name of an editor colour theme you picked, and your IP address, at the moment you pick it. The editor itself is downloaded when the package is built, not when you use it | Not a processor |
| esm.sh: third-party CDN | The name of an open-source editor library being fetched, and your IP address, only if a bundled file is missing. No account data, no page data | Not a processor |
| Google Fonts: Google, US | Your IP address, when the code editor or the payment form loads its typeface | Not a processor |
The ServiceNow instance you use is not a recipient in this sense: it is yours, and HolySN talks to it as you.
We do not sell your data, transfer it for advertising, or use it to assess creditworthiness.
Transfers outside the EEA
Your account data and everything in the database is stored in Sweden and does not leave the EEA at rest.
Transfers do happen for the AI features, for payments, for account emails and for support access, to the recipients marked US above. They rely on the European Commission's Standard Contractual Clauses, in the data processing agreements we hold with those providers, or on the EU-US Data Privacy Framework where the recipient is certified under it.
If you do not want your data leaving the EEA at all, do not use the AI assistant, dictation or agentic runs. Everything else works without them, apart from payments and account emails.
How long we keep it
| What | Kept for |
|---|---|
| Dictated audio | Not kept |
| Update-set XML produced by an agentic run | 7 days |
| The step-by-step trace of a finished run | 30 days |
| The website's access log, with IP addresses masked | 30 days |
| Command usage counts | 400 days |
| Sign-in sessions | Until you sign out, sign the session out from Account, Security, or it expires |
| Invoices and payment records, held by Stripe | As long as tax and accounting law requires |
| Account, workspace, scripts, chats, vault, themes, recorded tests, plan, trial record, devices | Until you delete the account |
Deleting an item in the extension deletes it here.
How it is protected
- Everything travels over TLS.
- Every row in the database is bound to an account and readable only by it, enforced by database policies rather than by the interface. A bug in the interface cannot serve you someone else's row.
- Vault secrets are encrypted in your browser with a key derived from a passphrase we never receive.
- What you send the assistant passes two independent filters, one in your browser and one on the server, before it reaches the model provider.
- The keys that talk to the model providers and to Stripe exist only on the server and are never present in the extension or in the website's pages.
No system is perfect. If we discover a breach affecting your personal data, we will notify the competent supervisory authority within 72 hours as required by Article 33, and notify you directly where Article 34 requires it.
Your rights
Under the GDPR you have the right to access the data we hold about you and receive a copy; rectify anything inaccurate; erase your data; restrict processing while a dispute is resolved; port your data in a structured, machine-readable format; object to processing based on our legitimate interests, including the usage counts; and withdraw consent at any time where consent is the basis.
Write to support@holysn.com. We will answer within 30 days.
You also have the right to lodge a complaint with a supervisory authority: in Italy, the Garante per la protezione dei dati personali.
Deleting your account
Account, Security on holysn.com has a Delete account button. It removes the account and everything attached to it: profiles, scripts, snippets, chats, vault entries, themes, recorded tests, usage history, your plan, trial and device records, your profile picture, the messages you sent, and anything you published to the shelf. If you prefer, write to the contact address and we will do it within 30 days.
While a subscription would still renew, the button asks you to cancel it first, so that nothing is charged to an account that no longer exists. Invoices stay with Stripe, as payment records must.
Messages you sent to another user are deleted with your account, which means they also disappear from that person's copy of the conversation.
Automated decision-making
The assistant proposes changes to your instance. It does not make them. Every change is applied by you, deliberately, after seeing what it would do.
There is no automated decision-making producing legal or similarly significant effects, within the meaning of Article 22.
Children
HolySN is a tool for professional ServiceNow developers. It is not directed at children and we do not knowingly create accounts for anyone under 16.
Changes
If this policy changes materially, the date at the top changes and the new version is published at this same address before the change takes effect.