If anyone on your staff connected Gmail to Odessia, remove that access this week: the AI travel agent has closed, and no public statement says what happens to the data it built from those inboxes. Founder Francis Davidson announced on November 10, 2026 that OpenAI had acquired the startup, and Odessia's site now says "the Odessia service is no longer available." That came 27 days after Odessia opened to the public on October 14.
Odessia sold to consumers, and its launch post describes no corporate offering. Your exposure is staff who tried a free travel agent and pointed it at a mailbox full of work trips. No public figure says how many did, so you have to count your own.
OpenAI Has Confirmed the Hire, and Odessia Has Confirmed the Sale
OpenAI's on-record statement covers Davidson's hire, and the acquisition itself rests on Davidson's announcement and Odessia's own site. An OpenAI spokesperson told TechCrunch, "We're thrilled to welcome Francis to OpenAI." The spokesperson had nothing further on travel products beyond noting that trip planning is among the things people ask ChatGPT about. Odessia's site says plainly, "OpenAI has acquired Odessia."
Terms are undisclosed, and TechCrunch's read is that "this looks like an acqui-hire." Davidson's X post could not be opened for this article, so his statements here come through TechCrunch, Skift and Unite.AI.
The company was small. Skift reported in June a team of eight in San Francisco, a commission-based revenue model and a product built on GPT-5.5. TechCrunch puts the funding at $6 million led by Sequoia. Davidson previously founded Sonder, resigned as its CEO in June 2025, and saw it go bankrupt afterward when a Marriott partnership fell through, according to TechCrunch.
On usage, Davidson said tens of thousands of early adopters used Odessia over summer 2026 and planned travel at a rate above $60 million a year, as relayed by Unite.AI. That figure measures trips planned, and it is the founder's own number. It tells you neither revenue nor how many of those users were on work accounts.
Odessia Called Its Gmail Access Read-Only, and the Exact Scope Is Unknown
Odessia described its Gmail connection as read-only, and no page we could open names the exact permission. The launch post says the product works by "finding years of booking confirmations in your Gmail and building detailed preferences from them." It does not describe the connection method, the permission requested, or retention. TechPilot's review, which checked Odessia's site and terms on October 16, says connecting Gmail and Calendar was optional and that Odessia "asks for read-only access to spot upcoming trips and events, and says it never sends email as you."
An OAuth grant is the standing permission a Google user gives a third-party app to call Google's APIs on their behalf, and it generally stays in force until someone removes it. Odessia's privacy policy describes an integration with Google Workspace APIs, so a grant is the likely mechanism, and the permission requested sets the ceiling on what it could read. Google's Workspace admin documentation classes read-only Gmail access (gmail.readonly) as a high-risk scope. Odessia's "read-only" could mean that scope or something narrower, and years of itineraries show where your executives travel and when, whichever scope it was.
The full written terms are hard to check now. Requests to odessia.com/privacy and odessia.com/terms returned HTTP 410 Gone on November 11, 2026, and the holding page mentions no data handling. No archived copy could be retrieved for this article. Excerpts of the privacy policy still appear in search results on that date. They say Workspace-derived data "will never be used to develop, improve, or train generalized AI and/or Machine Learning models" and will follow Google's Limited Use requirements. The excerpts do not show what the policy said about a sale of the company, and TechCrunch, Skift and Unite.AI report no plan for customer data.
Removing the grant closes only part of the exposure. Google's own help page says a revoked app can no longer access the account, and adds, "You may need to contact the developer of the app to request that they delete the data they already have." Gmail may also be only part of what staff handed over: TechPilot says Odessia needed payment cards and, optionally, account logins, which it describes as credentials stored in a vault.
Google's Policy Requires Consent Before a Merger Transfer
If Odessia reached Gmail through Google's sensitive or restricted scopes, Google's rules bar moving that data to OpenAI without each user's explicit agreement. The Google API Services User Data Policy allows a transfer "as part of a merger, acquisition, or sale of assets of the developer after obtaining explicit prior consent from the user." The same limits cover data "aggregated, anonymized, or derived from" Google user data, which is the category a preference profile would plausibly fall into. The indexed excerpts of Odessia's privacy policy say its Workspace data handling would follow those Limited Use requirements.
US regulators have taken a similar line on acquisitions. In the 2014 Facebook and WhatsApp deal, FTC staff wrote that "absent affirmative express consent by a consumer, a company cannot use data in a manner that is materially inconsistent with promises made at the time the data was collected." That is a staff position from a different deal, and it depends on knowing what was promised. Odessia's full promises are on the pages returning 410.
The strongest case for doing nothing is a fair one. TechCrunch reads this as an acqui-hire, buyers of eight-person teams usually want the people, the product is off, and nothing suggests OpenAI has received or wants a table of hotel preferences. All of that may be true. It still leaves you with an open permission on a mailbox and a closed vendor whose data plan you cannot read, and removing the permission takes minutes.
Existing Bookings Now Run Through One Support Inbox
Travelers with live Odessia bookings have a single published route: the site says that for "changes or modifications to existing bookings or to access existing travel plans," they should write to support@odessia.com. No response time or end date for that inbox is posted.
Who holds each booking is unclear. The launch post says Odessia checked live prices and took users to checkout. Mind-Verse's review of the site says bookings went either directly with the provider, with extras, or at the cheapest rate online. Neither says who the merchant of record was, and that determines whom a traveler calls when a flight moves.
Perks are the softer spot. Odessia advertised breakfast, a $100 credit, upgrades and late checkout at about 2,000 hotels, tied to its accreditation as a travel agent. A stay booked on those terms before the shutdown should be confirmed with the hotel in writing.
These trips also sat outside your travel management company, so your duty-of-care tools may have no record of a traveler who booked through Odessia. The inbox confirmation may be the only copy you can get.
Skift Says OpenAI Bought Agency Credentials and a Travel Operator
The deal's value to OpenAI, on Skift's reading, is what its Booking.com and Expedia partnerships do not provide. Skift's Dennis Schaal lists an end-to-end booking agent, IATA accreditation, hotel content and a founder with lodging experience. Skift says the accreditation comes to OpenAI with the deal, but does not explain how it would transfer. Davidson says he will work on "the future of travel," adding, "We'll have more to share on the shape of the future soon."
The history here cuts against assuming a booking product arrives soon. In March, Reuters relayed a report from The Information that OpenAI was "scaling back plans to integrate direct bookings into ChatGPT" because users researched in the chatbot and did not complete purchases there. Checkout was moving to third-party apps inside ChatGPT. Eight months later OpenAI has hired someone to work on travel, and its spokesperson told TechCrunch that "1.2 billion people turn to ChatGPT each week," trip planning included.
If a booking feature ships, your travel program will meet it the way it met Odessia: an employee will try it first with a personal account. Our coverage of Claude Duet's personal-account connectors walks through that same pattern on the productivity side.
What to Do Before Your Next Travel Cycle
This Week:
- Have your Workspace admin open Security > Access and data control > API controls > Manage App Access, then View list under Accessed apps and search for Odessia. The list shows each app's user count and requested services.
- If it appears, set the app to Blocked, which Google defines as "can't access any Google data." Google's page does not say that blocking one app revokes its existing tokens, so also revoke the tokens by user and by app for everyone listed.
- Pull OAuth log events under Reporting > Audit and investigation, filter on the application name, and widen the search past the default seven days back to June 2026. Save the grant history for your vendor file.
- Send staff a two-line note asking anyone who used Odessia to check their Google linked apps page, choose Remove access, and tell you. Include personal Gmail in the request, since your admin console cannot see those accounts and work confirmations often land there. Anyone who stored an airline or hotel login with Odessia should change that password, and anyone who stored a corporate card should tell your card program.
This Month:
- Email support@odessia.com on behalf of affected employees and ask for three things in writing: the legal entity now holding user data, whether any Gmail-derived data moved to OpenAI, and a deletion date. Keep the reply, or the silence, with the audit record.
- Have your travel manager collect confirmations for any open Odessia booking and get the airline or hotel's own reference number, so changes no longer depend on that support inbox.
- Decide whether high-risk Gmail scopes should stay open to unreviewed apps. Google lets you restrict them for Gmail, and warns that restricting a service means untrusted apps "stop working, and tokens are revoked." Test it on one organizational unit first. Our agent authorization guide covers the wider standing-access question.
Before You Approve Any OpenAI Travel Feature:
- Get the data terms in writing, including whether anything collected by Odessia feeds the product.
- Require any new booking agent to feed your travel management company's record, so a traveler stays visible to your duty-of-care team.
The Bottom Line
Consumer AI tools get shut down on acquisition faster than enterprise offboarding processes run, and the access they were granted outlives them. We saw it with Adobe's Rilo deal and its Slack token, and with Fetcher's October 16 shutdown after Juicebox bought its assets.
Odessia ran for at most 27 days in public. Run the Accessed apps search today and put the result, even a zero, in your vendor file.