Disclosures, AI Policy
& Privacy Notice
AndBeyond is committed to transparency about how artificial intelligence operates within our platform, how your personal data is handled, and how you can exercise your rights. This document governs all AndBeyond products and services.
AI Use & Interaction Disclosure
The AndBeyond platform uses AI systems, including large language models (LLMs), to generate travel recommendations, respond to questions, summarize trip information, and assist with itinerary planning. You are interacting with AI — not a human travel agent — when using the AI Advisor, AI Trip Recommender, or the floating chat assistant unless a human agent is explicitly identified by name and confirmed as available.
Which features use AI? The following platform features are fully or partially AI-powered:
- AI Trip Recommender — Generates personalized Disney World recommendations using your stored trip profile (family composition, dates, dietary restrictions, interests). Powered by Anthropic's Claude API.
- AI Advisor (mobile chatbot) — Responds to natural-language questions about your trip in real time. Powered by Anthropic's Claude API.
- Floating Chat Assistant — Available platform-wide; same AI capability as above.
- Trip Cost Builder — Pricing calculations use static 2026 Disney pricing data; no AI inference is applied to financial outputs.
- Itinerary, Dining, and Park content — Static content authored by human travel agents; not AI-generated.
AI system used: Our AI features are powered by the Anthropic Claude API (claude-sonnet-4-20250514 or equivalent current model). Anthropic is a third-party AI provider. Their privacy policy and terms of service govern the processing of inputs you send through their API. See anthropic.com/privacy.
AI outputs are not guaranteed. AI-generated recommendations are produced by a statistical language model and may contain inaccuracies, outdated information, or hallucinations — plausible-sounding statements that are factually incorrect. Always verify safety-critical information (allergy warnings, height requirements, reservation confirmations) directly with Walt Disney World before relying on it.
Human oversight. Your assigned AndBeyond travel agent reviews your full trip profile and can be reached directly for any concern where you prefer human judgment over AI assistance.
EU AI Act transparency (Article 50). In accordance with EU AI Act Article 50 transparency obligations (applicable as of August 2, 2026 for consumer-facing AI systems), users interacting with AI-generated content through the AndBeyond platform are hereby informed that responses may be generated by an AI system.
AI Ethics & Anti-Bias Policy
AndBeyond is committed to operating AI systems that treat all users with equal dignity, without discrimination based on any protected characteristic. This section describes our specific commitments and the concrete steps we take to prevent algorithmic bias and unfair treatment.
Our AI systems are designed and operated to provide substantively equivalent service quality, recommendation quality, and access to information to all users regardless of race, color, national origin, sex, gender identity, sexual orientation, age, disability, religion, familial status, source of income, veteran status, or any other characteristic protected under federal law (including the Fair Housing Act, Equal Credit Opportunity Act, and Civil Rights Act of 1964) or applicable state law.
No commission-driven recommendations. AndBeyond may earn compensation through travel bookings and agent fees. However, our AI systems do not sort, rank, filter, or weight hotel, resort, dining, or attraction recommendations based on commission rates, affiliate relationships, or revenue potential to AndBeyond. Recommendations are generated solely based on fit with your stated preferences, travel dates, family composition, budget, and special needs. See Section 3 for full commercial disclosure.
No discriminatory profiling. We do not use your demographic profile — including race, ethnicity, nationality, disability status, family structure, age, or zip code as a proxy for protected characteristics — to provide you with lower-quality recommendations, fewer options, higher-priced suggestions, or reduced service quality compared to other users.
System prompt governance. All AI system prompts used in AndBeyond products are reviewed by human staff before deployment. Prompts explicitly prohibit the AI from making discriminatory distinctions among users or from prioritizing commercial outcomes over user welfare.
Compliance with applicable anti-discrimination law. Our AI operations are subject to, and we comply with:
- FTC Act Section 5 — prohibiting unfair or deceptive AI practices
- Colorado AI Act (SB 205) — effective June 30, 2026, requiring reasonable care to avoid algorithmic discrimination in consequential decision-making systems
- Illinois AI Video Interview Act — not directly applicable (we do not conduct AI video interviews), included for completeness
- California Civil Rights Department AI Regulations — effective October 2025, prohibiting discriminatory use of AI in consumer-facing decisions
- FHA, ECOA, and Title VII — to the extent our systems interact with travel decisions that may intersect with housing, credit, or employment (e.g., timeshare recommendations)
If you are a Colorado resident, you have the right to receive notice when a high-risk AI system makes or substantially assists a consequential decision affecting you, to know the nature and extent of the data used, to access the AI system's decision rationale, and to request human review. To the extent AndBeyond's AI features qualify as high-risk under Colorado SB 205, you may exercise these rights by contacting us at the address in Section 10. We will respond within 30 days. We conduct and maintain impact assessments for our AI systems as required by applicable law.
Feedback and bias reporting. If you believe you have received discriminatory AI outputs — including recommendations you believe were influenced by your demographic profile rather than your stated preferences — please contact us immediately at ethics@andbeyondtravel.com. We investigate all such reports and will provide a human review of your experience within 5 business days.
Commercial Disclosure & Conflicts of Interest
Federal law (FTC regulations 16 CFR Part 255) and multiple state consumer protection statutes require us to clearly disclose any material commercial relationships that could influence the recommendations we provide.
AndBeyond is a travel agency. We may earn commission, referral fees, or agent compensation when you book travel products including hotels, resort packages, theme park tickets, dining reservations, transportation, and ancillary travel services. The existence of these commercial relationships does not influence the content of AI-generated recommendations on this platform. Our AI systems do not have access to commission rate data and cannot sort or filter recommendations based on revenue to AndBeyond.
Walt Disney World relationship. AndBeyond is an authorized Disney travel agency. We are not affiliated with, endorsed by, or employed by The Walt Disney Company. Disney® and Walt Disney World® are registered trademarks of The Walt Disney Company. All park hours, wait time estimates, pricing, and operational information shown in this platform are provided for planning purposes and may not reflect current or accurate information. Always verify with Disney directly at disneyworld.disney.go.com.
Third-party links. This platform contains links to third-party services including MouseDining, MouseWatcher, MouseSeats, My Disney Experience, and others. These are independent services with their own privacy policies and terms. AndBeyond does not receive compensation for listing these services and lists them solely for user benefit.
Pricing accuracy. Pricing shown in the Trip Cost Builder represents general estimates based on publicly available 2026 Disney pricing as of the date this platform was created. Actual prices may vary. No pricing shown on this platform constitutes a binding quote or offer. Obtain current quotes from your travel agent or directly from Disney.
Privacy Policy
This Privacy Policy describes what personal information AndBeyond collects, why we collect it, how we use it, with whom we share it, and your rights to access, correct, delete, and restrict our use of it.
Who this applies to. This policy applies to all individuals who use any AndBeyond platform — including the client web platform, mobile app, landing page, or any other digital product — regardless of U.S. state of residence. Where state law grants additional rights beyond those described here, those rights are described in Section 7.
Personal information we collect. We collect the following categories:
- Trip profile data — guest names, travel dates, resort, number and ages of travelers, preferences, interests, and special needs (e.g., dietary restrictions, mobility requirements)
- Health and sensitivity data — dietary restrictions and allergy information (including, in the example profiles displayed in this platform, tree nut allergy information). This is sensitive personal data under applicable law and is treated with heightened protection.
- AI interaction data — text inputs you send to AI chat features. These inputs are transmitted to Anthropic's API to generate responses. See Section 5 for full detail on AI data processing.
- Usage data — page views, feature interactions, and session data collected via standard web technologies. This platform does not use advertising trackers or third-party analytics at the time of this writing.
- Contact information — if you contact us via email, your name and email address
Legal basis for processing. We process your personal data based on: (a) contract performance — to deliver the travel planning services you have requested; (b) legitimate interests — to operate and improve our platform; and (c) consent — for any processing we conduct on the basis of your explicit consent, which you may withdraw at any time.
How we use your data.
- To provide personalized trip planning recommendations and itineraries
- To power AI features with your trip profile as context (see Section 5)
- To communicate with you about your trip, bookings, and account
- To comply with applicable law, including responding to lawful government requests
- We do not sell your personal data to third parties for advertising purposes
- We do not share your personal data with data brokers
Data sharing. We share personal data only with: (a) Anthropic, Inc. — when you use AI chat features, your inputs are transmitted to Anthropic's API under their privacy policy; (b) your assigned AndBeyond travel agent; (c) Disney and its reservation systems, as necessary to book travel on your behalf with your explicit direction; (d) service providers who assist us in operating this platform, under confidentiality obligations; and (e) law enforcement or regulators when legally required.
International transfers. Anthropic, Inc. is a U.S. company. Your AI chat inputs may be processed on servers located in the United States. By using AI features, you acknowledge this transfer.
AI Training Data & Model Policy
This section provides explicit disclosure about whether and how your personal data may be used to train, fine-tune, or improve AI models. This disclosure is required by multiple U.S. state laws effective in 2025–2026, including Connecticut's July 1, 2026 amendment (first U.S. state to mandate LLM training data disclosure), California's CPRA/CCPA ADMT regulations effective January 1, 2026, and Maryland's MODPA effective October 1, 2025.
AndBeyond does not use your personal data to train AI models. We use the Anthropic Claude API to generate responses. Under our Anthropic API usage agreement, prompts and completions are not used by Anthropic to train their models when accessed via the API (as of April 2026). However, Anthropic's policies are subject to change; please verify current API data usage policies at anthropic.com/privacy and anthropic.com/legal/aup.
What "training" means technically. When a user sends a message to an AI chatbot, that message (a "prompt") is processed by the AI model to generate a response. "Training" refers to a separate process — using data to update the model's internal parameters. In our current architecture:
- Your chat inputs are processed by Claude to generate a response in real time
- Your chat inputs are not retained by AndBeyond beyond the session
- Your chat inputs are transmitted to Anthropic's servers via API
- Whether Anthropic retains or processes API inputs beyond generating the response is governed by Anthropic's privacy policy, not AndBeyond's
Deletion and trained model weights. When you request deletion of your personal data, AndBeyond will delete all data we store about you in our systems within 45 days. However, if any of your data was processed by an AI model (e.g., included in a training dataset by a prior version of our AI vendor), it is technically impossible to "unlearn" that data from a deployed model's weights. This is a known limitation across the AI industry and is the subject of ongoing regulatory and legal development. We disclose this limitation transparently in accordance with FTC guidance and emerging state law requirements. This limitation does not affect AndBeyond's deletion of your data from our own storage systems.
System prompt confidentiality. Our AI system prompts (the instructions that configure AI behavior for your session) are proprietary. However, the general content and purpose of these prompts is summarized in Section 2 (Ethics Policy). You may request disclosure of the general nature of automated processing applied to your data under Section 6.
Connecticut LLM Disclosure (effective July 1, 2026). Connecticut's amended comprehensive privacy law requires controllers to disclose whether personal data is collected, used, or sold for the purpose of training large language models. AndBeyond does not collect, use, or sell your personal data for the purpose of training large language models.
Opt-Out of Automated Decision Making
Multiple U.S. state laws in effect as of 2026 provide consumers with the right to opt out of automated decision making (ADMT) — decisions made fully or substantially by AI or algorithmic systems without human review — particularly when such decisions produce legal or similarly significant effects.
You have the right to opt out of automated processing of your personal data for the purposes described below. Exercising this right will not degrade your access to human-powered features of this platform. Your human travel agent will continue to serve you.
What decisions are "automated" in AndBeyond?
- AI trip recommendations — The AI Advisor and AI Trip Recommender generate suggestions based on your profile without human review of each recommendation before delivery
- Itinerary personalization — Trip content is pre-configured by your agent but AI chat responses are generated without per-response human review
What is NOT automated in AndBeyond?
- Booking confirmations — all reservations require human agent action
- Pricing — all pricing data is static; no dynamic AI-based pricing is applied to your bookings
- Agent recommendations — your assigned travel agent's recommendations are human-generated
You can opt out of automated decision making through any of the following methods. We will process your request within 15 days. Your opt-out will deactivate AI chat features for your account while preserving full access to your itinerary, dining, parks, and other platform content.
Right to explanation and human review. If you believe an AI-generated recommendation has negatively affected you in a material way, you have the right to request: (a) an explanation of the automated processing applied to your data, (b) access to the data used, and (c) human review of the output by a qualified travel agent. Contact privacy@andbeyondtravel.com with subject line "Request for Human Review."
Right to contest profiling decisions (Minnesota, Colorado). Residents of Minnesota and Colorado have the specific right to question results of profiling used for significant decisions, receive rationale, and request re-evaluation. Submit requests to privacy@andbeyondtravel.com with your state of residence.
California ADMT regulations (effective January 1, 2026). Under CPPA's ADMT regulations, California residents have the right to opt out of automated decision-making that substantially replaces human decision-making for significant decisions. The right to appeal applies. California residents may submit requests through the California Privacy Rights Act portal at privacy@andbeyondtravel.com, referencing "CA ADMT Opt-Out."
Your Privacy Rights by State
As of April 2026, over 20 U.S. states have comprehensive privacy laws in effect. The following rights are available to residents of those states. Where a right is listed, AndBeyond will honor requests from residents of any covered state within the timeframe stated, regardless of our entity size or whether we formally meet all statutory thresholds. We honor these rights as a matter of policy.
| Right | Description | Response Time |
|---|---|---|
| Access | Obtain a copy of personal data we hold about you, including categories, sources, and purposes of processing | 45 days |
| Correction | Correct inaccurate personal data | 45 days |
| Deletion | Request deletion of your personal data from our systems (subject to legal retention obligations). Includes data held by service providers acting on our behalf. | 45 days |
| Portability | Receive your personal data in a structured, machine-readable format | 45 days |
| Opt-Out of Sale/Sharing | Opt out of the sale or sharing of your personal data for targeted advertising. (We do not currently sell or share personal data for advertising.) | 15 days |
| Opt-Out of ADMT | Opt out of automated decision making technology (see Section 6 for full details and exercise instructions) | 15 days |
| Opt-Out of Profiling | Opt out of profiling for purposes producing legal or similarly significant effects | 15 days |
| Non-Discrimination | You may not be discriminated against for exercising any privacy right — we will not deny service, charge higher prices, or provide lower quality service | Immediate |
| Appeal | If we deny a rights request, you may appeal our decision. We will respond to appeals within 60 days. You may also contact your state attorney general. | 60 days |
States with comprehensive privacy laws in effect (April 2026):
Residents of states not listed above retain rights under other applicable federal and state law. AndBeyond honors deletion and access requests from all U.S. residents regardless of state.
Data Retention & Deletion
Trip profile data is retained for the duration of your active trip planning engagement with AndBeyond and for up to 3 years thereafter to support follow-up bookings, dispute resolution, and legal compliance. You may request earlier deletion.
AI chat session data is not retained by AndBeyond beyond your active session. Chat history is stored only in your browser session memory and is not persisted to our servers.
Allergy and health data is retained only as long as necessary to support your active trip planning. It is deleted upon trip completion or upon your request, unless retention is required by law.
Deletion requests. Submit deletion requests to privacy@andbeyondtravel.com. We will confirm receipt within 5 business days and complete deletion within 45 days. We will provide written confirmation of deletion. We will instruct service providers who hold copies of your data to delete their copies within the same window.
If you previously used AI chat features, your chat inputs were transmitted to Anthropic's API. Deletion requests to AndBeyond apply to data in our possession. We cannot guarantee deletion from Anthropic's infrastructure; that is governed by Anthropic's privacy policy and your rights thereunder. This is a known technical limitation of LLM-based services disclosed under California CPRA requirements and the CPO Magazine "permanence of LLMs" guidance (January 2026).
Children's Privacy
This platform is intended for use by adults (18+) on behalf of their family. It is not directed to children.
Trip profiles may include children's information. When you provide trip information about your children (such as ages, dietary restrictions, or interests), that information is used solely to personalize your trip planning experience. We do not use children's personal data for any commercial purpose, advertising, or data sharing beyond direct trip planning.
COPPA compliance. We do not knowingly collect personal information directly from children under 13. All data about minors in trip profiles is provided by the adult account holder. If you believe a minor has provided us data directly, contact privacy@andbeyondtravel.com for immediate deletion.
State children's privacy laws. Nebraska's Age-Appropriate Design Code (LB 504, effective January 1, 2026), Connecticut's APIDCA (July 1, 2026), Colorado's CPA minor amendments, and similar laws require heightened protection for data involving minors. We apply these protections to all users, regardless of state.
AI features and minors. The AI chat features are intended for adult use. We strongly recommend that AI chat features on this platform be used by the adult account holder, not by children. AI chat history is not retained.
Contact, Rights Requests & Complaints
To exercise any right described in this document, or to ask questions about our data practices, please contact us using the information below. All rights requests are processed by our Privacy Officer. We will not retaliate against you for making a rights request.
Right to file a complaint. If you are unsatisfied with our response, you have the right to file a complaint with your state attorney general's office. California residents may also file with the California Privacy Protection Agency (cppa.ca.gov). Colorado residents may contact the Colorado AG (coag.gov). Residents of other covered states may contact their respective AG.
Changes to this policy. We will update this policy as laws change or our practices evolve. We will post the new effective date at the top of this page. For material changes that affect how we process your data, we will notify active account holders by email at least 30 days before the change takes effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
