Last updated: May 2026
Glidy ("we", "us", "our") provides an AI-powered web application for ServiceNow developers, available at glidy-ai.com. This Privacy Policy describes how Glidy processes personal data in connection with the service, in accordance with the EU General Data Protection Regulation (GDPR), the ePrivacy Directive, and other applicable data protection laws.
The data controller is Glidy, operated as a sole proprietorship. For privacy enquiries, data subject requests, or any matter covered by this policy, contact [email protected].
Glidy has not appointed a Data Protection Officer. The operation does not engage in large-scale processing of special categories of data within the meaning of GDPR Article 37.
When you create an account, Glidy stores your email address, a randomly generated user identifier, and authentication session tokens. If you sign in with Google, Glidy receives the email address associated with the Google account; no other Google profile data is retained.
To use Glidy with your own LLM provider and ServiceNow instance, you enter:
These credentials are encrypted application-side using AES-256-GCM before they are written to storage, and are decrypted ephemerally for the duration of a single request. Plaintext credentials are not written to disk or to application logs. The encryption keys are held by Glidy and are not accessible to the user.
Your chat sessions and the messages within them are stored in a managed cloud-hosted PostgreSQL database operated by a third-party provider. Access is restricted by row-level security so that each account can read and write only its own conversations. The data is encrypted in transit using TLS 1.2 or higher, and at rest using the provider's standard AES-256 disk-level encryption. Glidy does not apply additional application-side encryption to conversation content; this is the same posture taken by comparable hosted AI products. Glidy does not offer end-to-end or zero-knowledge encryption: authorised operators with database access can, in principle, read conversation content, though access is limited to investigating specific incidents or fulfilling user requests.
Conversation content can include text you send, model responses, tool call arguments and outputs, and any ServiceNow data the agent fetches and quotes back into the conversation. You can export or delete individual conversations, or all conversations, from the Settings page at any time. Conversations that have been inactive for more than 24 months are automatically deleted by a scheduled job; this retention period is intended to keep the service useful as a working memory while satisfying the data-minimisation principle under GDPR Art. 5(1)(e).
Glidy records pseudonymous events linked to your user identifier for operational purposes:
These records do not include prompt or response text. You can disable analytics collection from the Settings page.
Our hosting providers log standard request metadata such as IP address, user agent, request path, and response status. This data is used for security monitoring and to diagnose service issues.
Glidy relies on third-party providers to deliver the service. Each subprocessor is bound by a written data processing agreement that reflects the requirements of GDPR Art. 28. At a category level, Glidy uses:
An up-to-date list of the specific providers, the data they receive, and their hosting regions is maintained in our subprocessor register. The current list is available on request from [email protected]. Glidy will give reasonable advance notice of material changes to the subprocessor list so that you can object before the change takes effect.
LLM providers and your prompts:when you send a message, the prompt and the relevant conversation context are transmitted to the LLM provider whose API key you have configured. That provider acts as an independent controller or processor under its own terms; we are not in a position to alter their data handling. Review your chosen provider's privacy notice before submitting sensitive content.
| Data category | Retention period |
|---|---|
| Account data (email, user identifier) | Until you delete your account |
| Encrypted credentials | Until you remove them or delete your account |
| Conversation history | Until you delete the conversation or your account, or 24 months of inactivity, whichever comes first |
| Pseudonymous analytics events | 90 days, then automatically purged |
| Hosting and security logs | Up to 30 days, then rotated |
When you delete your account, account, credential, conversation, and user-linked analytics records are removed from the production database within 30 days. Backups taken before deletion are retained for up to a further 30 days before being overwritten in the normal backup cycle.
If your personal data is processed by Glidy, you have the following rights under the GDPR:
To exercise any right that is not available as a self-service action in Settings, email [email protected]. Glidy will respond within one month of receipt of the request, extendable by a further two months for complex requests in accordance with Art. 12(3). Glidy may ask you to confirm the email address associated with your account before acting on a request.
Glidy and its subprocessors are predominantly located outside the European Economic Area, including in the United States. As a result, personal data processed in connection with the service is transferred to, and processed in, third countries within the meaning of GDPR Chapter V.
Such transfers are protected by one or more of the following safeguards:
The current hosting region of each subprocessor is listed in the subprocessor register referenced in Section 5. A copy of the relevant transfer safeguards is available on request.
Glidy uses only essential authentication cookies and a small number of functional cookies for non-essential UI preferences, which are set only after consent. Tracking and advertising cookies are not used. For a complete list, see the Cookie Policy.
All connections between you, our application, and our subprocessors use TLS 1.2 or higher. User-provided credentials are encrypted with AES-256-GCM before storage. Conversation and account data sit in a managed database with row-level security and provider-managed at-rest encryption. Access to production systems is restricted to authorised maintainers, authenticated with multi-factor authentication.
The service is intended for professional use and is not directed at children under 16. Glidy does not knowingly collect personal data from children. If you believe a child has created an account, contact [email protected] and the account will be removed.
When you submit prompts that include personal data about identifiable third parties (for example, ServiceNow records about employees, customers, or end users), you act as controller of that data and are responsible for ensuring that you have a lawful basis to process it. Glidy processes such data only as your processor to deliver the response.
Glidy may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be notified to registered users by email or through an in-app notice with reasonable advance notice before they take effect.
For privacy enquiries, data subject requests, or any other matter relating to this policy, contact [email protected].