Privacy Policy — Direct Booking MVP
Last updated: 18 September 2026
This Privacy Policy describes how Direct Booking MVP, operated by Avispa, accesses, uses, stores, and protects information in connection with its Google Gmail integration.
For questions concerning this application or its use of Google data, contact:
1. Purpose of the application
Direct Booking MVP is an experimental travel planning and accommodation inquiry application.
It helps a user prepare individualized accommodation inquiries and, after review by the user, create separate email drafts in the user’s Gmail account.
The application does not automatically send these emails. Sending remains a manual action performed by the user in Gmail.
2. Google account access
Direct Booking MVP uses Google OAuth 2.0 for authorization.
The current Gmail integration requests only the following Google OAuth scope:
https://www.googleapis.com/auth/gmail.compose
Google describes this permission as allowing an application to manage drafts and send email.
Direct Booking MVP currently uses this permission only for creating Gmail drafts required by the application’s inquiry workflow.
The current application does not use this permission to automatically send email and does not use the Gmail integration to read the user’s existing inbox or existing email messages.
3. Google user data used by the application
When the user explicitly asks Direct Booking MVP to create a Gmail draft, the application may provide Gmail with the information necessary to create that draft, including:
- the recipient email address;
- the email subject;
- the email body.
Google stores the resulting draft in the Gmail account authorized by the user.
The application may also store identifiers associated with a created Gmail draft where required to maintain the application’s inquiry status and audit trail.
4. OAuth credentials and tokens
OAuth authorization tokens used to access Gmail are stored locally on the user’s computer.
They are not stored in the Direct Booking MVP application database and are not committed to the application’s source-code repository.
OAuth credentials and tokens are used solely to provide the Gmail functionality explicitly authorized by the user.
5. Application data
Direct Booking MVP may locally store information required to prepare and manage accommodation inquiries, such as:
- trip information;
- accommodation information;
- accommodation contact information;
- inquiry requirements;
- generated inquiry text;
- recipient information;
- inquiry status;
- Gmail draft identifiers.
This information is used only to provide the functionality of Direct Booking MVP.
6. Sharing and transfer of Google user data
Direct Booking MVP does not sell Google user data.
Google user data obtained through Google Workspace APIs is not:
- sold to data brokers or other third parties;
- used for advertising or personalized advertising;
- used for credit or lending decisions;
- transferred to advertising platforms;
- used to train or improve general-purpose artificial intelligence or machine-learning models.
Google user data obtained through Gmail authorization is not provided to third-party AI services for model training.
Data is transmitted to Google only as necessary to provide the Gmail functionality requested by the user.
7. Limited Use
The use of information received from Google Workspace APIs by Direct Booking MVP complies with the applicable Google Workspace API user data policies, including Google’s Limited Use requirements.
Google user data is used only to provide or improve user-facing functionality that the user has requested and authorized.
8. Data retention and deletion
OAuth authorization information is retained locally only while Gmail access is required.
The user may revoke Direct Booking MVP’s Google account access through their Google Account security and permissions settings.
The locally stored OAuth token can also be deleted by the user.
Gmail drafts created by Direct Booking MVP remain in the user’s Gmail account until the user sends, edits, or deletes them.
Locally stored Direct Booking MVP application data may be deleted from the application’s local data store when it is no longer required.
9. Security
Direct Booking MVP follows a least-privilege approach and requests only the Google permissions required for its currently implemented functionality.
OAuth credential and token files are kept outside the application’s source-code repository and are not stored in its database.
Communication with Google’s OAuth and Gmail services uses secure HTTPS connections.
10. Future functionality and additional Google permissions
Direct Booking MVP may gain additional functionality in the future.
For example, a later version may support processing replies received from accommodation providers. Such functionality could require an additional Google permission allowing read-only access to Gmail messages.
No such additional Gmail permission is currently requested.
This Privacy Policy will be updated before additional Google user data access is enabled.
11. Changes to this Privacy Policy
This Privacy Policy may be updated when the functionality or data-processing practices of Direct Booking MVP change.
The current version will always be published on this page.
12. Contact
Questions about this Privacy Policy or the use of Google user data by Direct Booking MVP can be sent to: