Privacy Policy
Company Details
Company: MOGU GLOBAL, S.L.
Tax ID: B88613401
Address: C/ Jaras, nº 9, 28238, Las Rozas de Madrid (Madrid), Spain
Email: app@moguplatform.com
Sales email: SALES@moguplatform.com
Basic Data Protection Information
Controller: MOGU GLOBAL, S.L.
Purpose: Providing software services for travel agencies, managing customer accounts, support, commercial communications where applicable, optional integrations requested by users, and artificial-intelligence features inside MOGU.
Legal basis: Performance of the customer relationship, user consent for optional integrations and communications, compliance with legal obligations, and legitimate interests where applicable.
Recipients: Providers that deliver technical services, hosting, security, communications, support, analytics and data processing on behalf of MOGU. MOGU requires appropriate agreements to protect data under applicable law.
Rights: Access, rectification, erasure, objection, restriction, portability and withdrawal of consent, as explained below.
Additional Data Protection Information
1. Controller
MOGU GLOBAL, S.L. | Tax ID: B88613401 | C/ Jaras, nº 9, 28238, Las Rozas de Madrid | app@moguplatform.com
2. Purposes of Processing
MOGU processes the data needed to provide the platform to travel agencies: user management, proposals, trips, bookings, payments, CRM, communications, support, security, operational analytics and service improvement.
Users may connect optional integrations, such as Google Gmail, Google Calendar, Google Drive, Microsoft Outlook and Microsoft 365 Calendar. These integrations are activated only when the user expressly connects them and grants the permissions requested by the relevant provider.
Processing may include identification data, contact data, encrypted technical credentials, business information, content created in the platform, traveler data managed by the agency, communications, and documents provided or connected by the user.
MOGU does not make automated decisions with legal or similarly significant effects without human intervention, unless expressly authorized or allowed by applicable law.
3. Legal Basis
The main legal basis is performance of the agreement between MOGU and the customer agency. Third-party integrations, including Google and Microsoft integrations, are based on the consent of the user who connects the account. The user may withdraw that consent by disconnecting the integration in MOGU or revoking access from their Google or Microsoft account.
MOGU may also process data to comply with legal obligations, prevent fraud or abuse, ensure service security, respond to support requests, and defend rights and legitimate interests.
4. Retention
Data is retained while necessary to provide the service, maintain the contractual relationship, comply with legal obligations or address responsibilities arising from use of the platform.
Data obtained through Google or Microsoft integrations is retained only as long as necessary to provide the features requested by the user. When a user disconnects an integration, MOGU stops accessing new data from that account and revokes or removes local authorizations where applicable. For Gmail and Outlook/Microsoft 365 Mail, emails synchronized into the CRM are deleted from MOGU storage when the mail account is disconnected, unless legal retention is required.
Content created by the agency from documents, calendars or emails may remain incorporated into the agency workspace and is retained according to the applicable subscription, configuration and deletion requests.
5. Recipients and Providers
MOGU may use providers for hosting, databases, email, security, observability, analytics, artificial intelligence, document processing, payments and support. These providers may process data only under MOGU's instructions and to provide the relevant services, unless legally required otherwise.
MOGU does not sell personal data or data obtained from Google APIs or Microsoft APIs. MOGU does not transfer Google API or Microsoft API data to advertising platforms, data brokers or third parties that use it for their own purposes.
6. Google and Microsoft Account Data and API Integrations
MOGU offers optional Google and Microsoft integrations so users can work with Gmail, Outlook/Microsoft 365 Mail, Calendar and Drive from the platform.
Gmail. With user consent, MOGU may access Gmail messages, including sender, recipients, subject, body, metadata, conversation identifiers, web links and attachment data. MOGU uses this data to show emails linked to CRM contacts and opportunities, search and read emails when requested by the user, read attachments when requested by the user, create drafts, and send replies or messages from MOGU. Sending actions require explicit user confirmation. MOGU may process and store message content, metadata and attachment data when needed to provide CRM, search, import, document processing, AI assistance or other user-requested workflows.
Google Calendar. With user consent, MOGU may list events from the primary calendar, read event details and, when requested by the user, create, update or delete events. MOGU may process event title, description, location, dates, attendees, meeting links and event status. Create, update and delete actions require explicit user confirmation.
Microsoft Outlook and Microsoft 365 Mail. With user consent, MOGU may access Outlook or Microsoft 365 email messages, including sender, recipients, subject, body, metadata, conversation identifiers, web links and attachment data. MOGU uses this data to show emails linked to CRM contacts and opportunities, search and read emails when requested by the user, read attachments when requested by the user, create drafts, and send replies or messages from MOGU. Sending actions require explicit user confirmation. MOGU may process and store message content, metadata and attachment data when needed to provide CRM, search, import, document processing, AI assistance or other user-requested workflows.
Microsoft Outlook and Microsoft 365 Calendar. With user consent, MOGU may list calendar events, read event details and, when requested by the user, create, update or delete events. MOGU may process event title, description, location, dates, attendees, meeting links and event status. Create, update and delete actions require explicit user confirmation.
Google Drive. With user consent, MOGU may search, list, read metadata, export Google documents and read or download Drive files to respond to user requests, import information, analyze documents or generate content inside MOGU. MOGU may process and store Drive file data when needed for user-requested import, scanning, OCR, document processing, AI assistance or workspace content generation. Actions that modify files in external provider accounts, where available, require the relevant provider permissions and an explicit user request or confirmation.
Tokens and security. Google and Microsoft refresh tokens are stored encrypted. Access tokens are short-lived. Communications use TLS, and MOGU applies authentication, authorization, logging, account isolation and reasonable security measures to protect data.
Google API Limited Use. MOGU's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, MOGU uses Google data only to provide or improve user-facing features that are visible and requested by the user inside MOGU; does not sell this data; does not use it for advertising; does not use it to determine creditworthiness; and does not use it to train generalized or non-personalized artificial-intelligence or machine-learning models. Human access to Google data is limited to cases permitted by that policy, such as user consent, security, abuse prevention, legal compliance, or internal operations on aggregated and anonymized data.
Microsoft API use. MOGU uses information received from Microsoft APIs only to provide the intended user-facing integration features requested by the user. MOGU requests only the data and permissions needed for those features, does not use Microsoft API data for advertising or marketing, and does not resell, redistribute or sublicense Microsoft API data. MOGU's use of Microsoft APIs is subject to the Microsoft APIs Terms of Use.
Users can disconnect integrations from MOGU and may also review or revoke access from their Google Account at https://myaccount.google.com/permissions and from Microsoft account or organization app-consent pages such as https://account.live.com/consent/Manage or https://myapps.microsoft.com.
7. Rights
Users may exercise the rights of access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent.
Exercising Rights
Requests may be sent to app@moguplatform.com or to C/ Jaras, nº 9, 28238, Las Rozas de Madrid.
The request should include sufficient identification of the requester, a description of the request, an address for notifications and, if acting through a representative, proof of representation.
MOGU will respond within the applicable legal deadlines. If users believe their rights have not been properly addressed, they may file a complaint with the Spanish Data Protection Authority: www.aepd.es.
This policy may be updated. MOGU will notify significant changes when required.