Privacy Policy

Last updated: 12 September 2026

This Privacy Policy describes how Nowisor ("we", "us", "our") collects, uses, and protects your personal data when you use the Nowisor platform ("Service").

1. Data We Collect

Account Data

  • Email address (used for authentication and account communications)
  • Password (hashed with scrypt — we never store plaintext passwords)
  • Account tier and credit balance

Conversation Data

  • Chat messages you send to the AI assistant
  • AI-generated responses
  • Feedback you provide on responses (thumbs up/down, corrections)

Usage Data

  • Daily query counts and credit consumption
  • Session timestamps
  • Knowledge base articles referenced per query
  • Product events: when you sign up, verify your email, connect an instance or a connection attempt fails, run a scan or upload (with its outcome and duration), use code review, code generation or the API, export a report, open a remediation ticket, or your plan or billing changes (with the amount). We also record when an AI request fails or is refused, when a query credit is refunded, and when a message is blocked by our input guard. Each event records your account and user identifier, the time, a short code and any count, duration or amount — never your questions, answers, instance address or credentials.

ServiceNow Instance Data (Optional)

If you connect your ServiceNow instance:

  • Instance URL and OAuth tokens (encrypted with AES-256-GCM at rest)
  • Instance security configuration snapshots (system properties, hardening settings)
  • Instance credentials are stored encrypted with AES-256-GCM. OAuth 2.0 is the recommended method; basic auth is supported and stored the same way.

2. How We Use Your Data

  • Provide the Service: Your queries and connected instance data are used to generate contextual security analysis
  • Improve accuracy: Feedback on AI responses is used to refine future answers for your account
  • Enforce limits: Usage data tracks credit consumption per your subscription plan
  • Security: Account and session data is used to authenticate requests and prevent abuse

3. Third-Party Data Sharing

We share data with third parties only in the following cases:

  • LLM Provider: To generate responses, your queries and the relevant context are sent to our AI provider (Anthropic or OpenAI) via API. For connected instances, that context includes your scan findings and ServiceNow configuration values (for example, hardening property settings) — but never your passwords, API keys, or ServiceNow OAuth tokens. This data is processed under the provider's standard data-processing terms. Connected accounts and above can instead enable Enhanced data protection, which sends those requests to a separate, dedicated Anthropic workspace key rather than the shared one, processed in the US — or EU data residency, which sends them through an EU-hosted gateway (Requesty, Frankfurt) to Claude models pinned to EU cloud regions. When EU data residency is enabled, Requesty acts as a data processor for those AI requests under a GDPR Art. 28 data processing agreement. Prompt and output logging is disabled on our Requesty account as of 14 August 2026, so under that same data processing agreement the gateway keeps no copy of your queries or the model's responses. The model itself is served via AWS Bedrock in the eu-central-1 (Frankfurt) region, whose own terms govern that leg — so EU data residency means EU-resident processing with no gateway-side logging, not end-to-end zero retention. Retention and model-training terms for either non-standard option are governed by our agreements with those providers rather than by settings you control here. In all three cases, if the selected option cannot serve a request we refuse it and refund the query credit — we never re-route it to the standard endpoint.
  • Email Service: Your email address is shared with our email provider (Resend) solely for account verification and password reset emails.

We do not sell your data. We do not use your data for advertising. We do not share your data with any other third parties.

4. Data Storage and Security

  • All data is stored server-side in an SQLite database hosted on EU infrastructure (an EU region)
  • Passwords are hashed using scrypt with unique salts
  • ServiceNow OAuth tokens are encrypted with AES-256-GCM
  • Authentication uses HMAC-signed tokens in httpOnly cookies (not accessible via JavaScript)
  • All connections use HTTPS/TLS encryption in transit

5. Data Retention

  • Account data is retained while your account is active
  • Conversation history is retained while your account is active
  • ServiceNow scan results are kept as scan history while your account is active.
  • Full scan detail is kept for the 3 most recent scans of each instance and for any scan in which an open finding was detected. Older scans keep their summary (score, band and finding counts) and lose the detail.
  • Disconnecting an instance removes the connection and its credentials and keeps that history with your account.
  • If your account ends (a free plan with no subscription and no managed engagement), all instance data is deleted 30 days after that date: connections and their credentials, scan schedules, snapshots and scan history, triage decisions and tickets. The deletion is recorded in our audit log. Your account and login remain, and reconnecting afterwards requires authorising again.
  • Product events are kept for 400 days and then deleted by a daily job.
  • Upon account deletion, all your data is permanently removed within 30 days, except the model-call audit entries described next, which keep your account identifier and expire on their own schedule.
  • Each request we send to an AI model is kept as an audit entry: which account and user made it, which route and model, a hash of the request and, when an answer completed, a hash of the answer, and token counts (the provider's where it reports them, otherwise our estimate). The entry holds no prompt or answer text and is deleted by a daily job once it is 90 days old.

6. Your Rights (GDPR)

If you are located in the European Economic Area, you have the right to:

  • Access: Request a copy of all personal data we hold about you
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your account and all associated data
  • Portability: Receive your data in a machine-readable format
  • Restriction: Request that we limit processing of your data
  • Objection: Object to processing of your data for specific purposes

To exercise any of these rights, contact us at privacy@nowisor.com. We will respond within 30 days.

7. Cookies

We use a single essential cookie (vsme_auth) for authentication. This is an httpOnly, secure cookie that cannot be accessed by client-side JavaScript. We do not use tracking cookies, analytics cookies, or any third-party cookies.

8. Children's Privacy

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email at least 14 days before they take effect.

10. Contact

For privacy-related questions or data requests, contact us at privacy@nowisor.com.

Knowledge BaseBlogCVE CheckAI CheckFAQ