Privacy Policy

Add-in: Travel Desk · Publisher: PurposeBuilt Systems LLC · Effective: August 30, 2026 · Supersedes the version of July 13, 2026

The short version

We collect no data. None. Travel Desk has no servers, no accounts, no analytics and no trackers. Nothing it reads is transmitted anywhere except to Microsoft Graph, using your own signed-in identity, inside your organization's Microsoft 365 tenant. The publisher never sees any of it.

That is not the whole story, though, and the rest of this page is the part that matters: what it reads, when, and what is kept afterwards. "We store nothing" is true and is not the same as "nothing is stored".

What it reads, and when

Every one of these happens only in response to something you click. Travel Desk reads nothing in the background and nothing on a schedule.

When you click…	It reads
Fill from this email	The subject, body and file attachments of the one message you have open. Attachments are decoded in the task pane — PDF, Word, Excel, PowerPoint, calendar invites and plain text — to find the event, dates, destination and costs. They are not uploaded anywhere.
Search my inbox for travel emails	The subject, sender, date and Outlook's short preview (roughly the first 250 characters of the body) of every message in your Inbox from the last 180 days — not only travel ones, because there is no way to tell which are which without looking. This is examined in the task pane, ranked, and discarded when you close it. Nothing from it is written down. Full bodies and attachments are fetched only for the one message you then choose.
Check for booking emails	The same summary fields for recent Inbox mail, to match a booking confirmation to a trip you have already filed.
Find my setup	Only messages whose subject begins with your organization's setup-invitation prefix.
Create travel request	Nothing. It writes: a draft in your own mailbox, and a row in the planner workbook.

The inbox search is the broadest thing this add-in does. If that is more than you want, do not use that button — everything else works without it, and Fill from this email only ever looks at the message in front of you.

Reading your signature block

When filling the form, Travel Desk looks at the signature under a message you have already opened to find your division, bureau and home city, so you do not retype them. It matches on your own name and reads only the lines beneath it.

What is stored, and where

Two places, both inside your Microsoft 365 tenant. The publisher has access to neither.

1. Your own Outlook add-in settings

Held in your mailbox by Outlook (roamingSettings), so they follow you between devices. They contain:

Your name, cost center, division and bureau.
Your organization's settings: the planner link, coordinator and finance addresses, fiscal-year rules, and any custom wording mapped for your travel form.
A history of the travel requests you have filed — up to 25, of which the most recent hold the full form: event, dates, destination, reason for travel, costs, and third-party billing contacts. This exists so you can copy a previous request instead of retyping it. Anyone with access to your mailbox can read it, as they could read your mail.

Removing the add-in removes these.

2. The shared planner workbook

An Excel file your organization owns, on SharePoint or OneDrive. Each request adds a row: traveler, division, bureau, event, destination, dates, costs, funding and status.

A shared planner is a disclosure, by design. Everyone who can open that workbook can see everyone else's travel and costs — that is what makes it a planner. Who can open it is decided by your organization's file permissions, not by this add-in.

Where data can go

The add-in makes network requests to exactly two hosts, both Microsoft's:

graph.microsoft.com — every mail and file operation, as the signed-in user.
login.microsoftonline.com — sign-in only.

There is no publisher server to send anything to. The add-in is static HTML and JavaScript served from GitHub Pages, and the only other outbound requests a browser makes are for Microsoft's own Office.js and two open-source libraries (MSAL and JSZip) loaded from a public CDN as code — no data of yours is included in those requests.

Permissions, and why each is needed

Permission	Why
`Mail.ReadWrite` (delegated)	Read the messages described above; create the authorization draft in your own Drafts. Nothing is ever sent automatically.
`Files.ReadWrite.All` (delegated)	Read and append rows to the planner workbook. Delegated means it reaches only files you can already reach; it grants no new access.
Mailbox requirement set 1.8	Reading the attachments of the message you have open (`getAttachmentContentAsync`).

All permissions are delegated. There are no application permissions, so the add-in can never act on a mailbox or file that you cannot.

No AI, and no profiling

Extraction is deterministic pattern-matching. No content is sent to a language model or any other external service, and nothing is used to build a profile of you or to train anything.

Auditability

Because every operation is a delegated Graph call, each one appears in your organization's Microsoft 365 unified audit log, attributed to this application's ID and to the signed-in user. Your administrators can see exactly what it did, without asking us.

Contact

Questions, or a request to explain any of the above in more detail: Matthew@purposebuilt.systems