hayaHaya: Privacy Policy
Last updated: 2 November 2026
Haya ("we", "the app") turns the travel booking emails in your Gmail into an organized itinerary. Haya is run by Lamine Bendib (MLB TechSolutions), who is responsible for your data. Contact: lamine.bendib@mlb-techsolutions.com.
This policy explains what Haya reads, what it keeps, who helps us run it and how you stay in control. It is written to match how the app actually works; if the two ever differ, tell us and we will fix the app.
1. What Haya reads in your Gmail
When you sign in with Google, you give Haya read-only access to Gmail (gmail.readonly) plus your name, email address and profile picture. Haya cannot send, delete or change emails.
- Haya first looks only at the sender and subject of your messages to find likely travel emails (airlines, hotels, booking sites, trains, restaurants, events…).
- Haya downloads the full content only of those candidate emails. Other emails are never opened.
- From each candidate email, Haya extracts the booking details: type, dates and times, places, confirmation code, travelers, price, provider.
2. What Haya keeps
| Data | Why | How long |
|---|---|---|
| Booking details extracted from emails, and the trips built from them | The core of the app | Until you delete them or your account |
| The Gmail message ID, sender, subject, date and a short snippet of each travel email | To link a booking to its email ("View original email") and avoid importing it twice | Until you delete your account |
| The full raw content of a candidate email | Only to process it (and retry if processing fails) | Deleted within 24 hours |
| Ticket attachments of a booking email (PDF tickets, ticket images, wallet passes) | So your tickets are in the app and work offline | Until you delete the booking or your account |
| Your notes, ideas, places and edits | You created them | Until you delete them or your account |
| Your profile: name, email, home city, currency, time zone | Grouping trips and showing times and prices | Until you delete your account |
| Your Google refresh token | To keep reading new travel emails | Encrypted; deleted when you disconnect Gmail or delete your account |
| Feedback you send from the app | To improve Haya | Until you delete your account |
On your phone, Haya keeps a copy of your trips so they work offline. Signing out removes it.
Haya does not use your data for advertising, does not sell it, and does not use it to train AI models.
3. How emails are read (AI)
Emails that simple rules can't read are sent to an AI model to extract the booking details. This goes through OpenRouter, configured so that providers do not store the content (zero data retention) and do not train on it. Only the minimum needed is sent: the text of that one travel email and its attachments, never your whole inbox.
4. Who helps us run Haya
| Service | What it does | Where |
|---|---|---|
| Supabase | Database and sign-in | European Union (Frankfurt) |
| Google Cloud (Cloud Run) | Runs the server that reads travel emails | European Union (Frankfurt) |
| Google (Gmail API) | Gives Haya read access to your Gmail | |
| OpenRouter and the AI provider it routes to (currently OpenAI; Google as backup) | Reads booking details from emails that rules can't parse, without storing them | See their policies |
| Unsplash | Destination cover photos. Haya sends only a city name, never your data | — |
| Mapbox | Map tiles shown in the app, and walking routes between public places in city guides. Your phone requests the map area you look at; no booking data is sent | — |
| OpenStreetMap, Wikidata, Wikivoyage, Wikimedia Commons | Open data for city guides. Haya sends only a city name, never your data | — |
| Expo (when notifications are enabled) | Delivers "new booking" notifications | — |
These providers process data only to provide their service to Haya.
5. Google API Services User Data Policy
Haya's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, Gmail data is used only to provide and improve Haya's user-facing features (building your itinerary), is not used for ads, is not sold, is not read by humans (except with your explicit consent for a specific email, for security reasons or as required by law) and is not used to train general AI models.
6. Your controls and rights
- Disconnect Gmail (Profile → Privacy): revokes Haya's access immediately and stops all syncing. Your trips stay until you delete them.
- Delete my data (Profile → Privacy): deletes your account and everything listed above within 24 hours, and revokes Gmail access.
- You can also revoke access any time at myaccount.google.com/permissions.
- Under the GDPR you have the right to access, correct, export and delete your data, and to object or complain to your data protection authority (in Italy, the Garante per la protezione dei dati personali). Contact us at lamine.bendib@mlb-techsolutions.com.
Legal basis: providing the service you asked for (contract). Optional features rely on your consent, which you can withdraw at any time.
7. Security
Data is encrypted in transit (HTTPS) and at rest; Google tokens get an extra layer of application-level encryption. Every database table enforces access rules, so a user can see only their own data and trips shared with them.
8. Children
Haya is not intended for children under 16.
9. Changes
We will update this page and the "Last updated" date when the policy changes, and tell you in the app if a change is significant.