Privacy Policy for Andavo Travel AI Connectors

How Andavo processes information when a traveler connects ChatGPT or Claude to an Andavo traveler account.

This policy explains how Christopherson Andavo Travel, LP, doing business as Andavo (“Andavo,” “we,” “us,” or “our”), processes information when a traveler uses the Andavo Travel connector with ChatGPT or Claude. It supplements the general Christopherson privacy policy at https://www.cbtravel.com/privacy-policy and any privacy terms that apply to the traveler's employer-sponsored Andavo travel program.

This policy applies to the Andavo Travel connector made available through OpenAI services, including ChatGPT, and Anthropic services, including Claude. It does not replace the privacy policies of OpenAI or Anthropic. The AI platform you choose processes conversation content and connector results under its own terms, privacy policy, account settings, and enterprise agreement, if any.

Depending on your request and travel program, the connector can process:

• Authentication information: OAuth access tokens and an account identifier used to authenticate a request and resolve the signed-in traveler.

• Profile and contact information: Information needed to identify you, display relevant profile context, or apply a supported self-service change.

• Travel preferences and loyalty information: Relevant air, hotel, car, and loyalty preferences used to improve a search or booking request.

• Trip and itinerary information: Current, upcoming, and recent trip and segment details.

• Search and offer information: Routes, dates, locations, preferences, prices, availability, and selected flight, hotel, or rental-car offers.

• Booking information: Information needed to create a reservation that you explicitly confirm through a supported connector action.

• Technical and security information: Request timing, security events, error information, and limited diagnostic data needed to operate, secure, and support the connector.

The information comes from you, your authenticated Andavo account, your employer-sponsored travel program, Andavo systems, and applicable travel suppliers.

We use connector information to:

• authenticate you and limit access to your own traveler account;

• retrieve and summarize relevant traveler, trip, and itinerary information;

• search live travel inventory and compare offers;

• review a selected offer;

• create an eligible reservation after explicit confirmation;

• review and apply supported self-service profile changes after confirmation;

• enforce client travel policy, permissions, and approval rules;

• prevent abuse, investigate errors, maintain security, and support users; and

• comply with legal, accounting, supplier, and travel-industry obligations.

We do not use an OAuth token as model-visible content. We limit connector responses to information needed for the request and omit internal database, cache, trace, and authentication identifiers.

The connector is designed not to return or accept the following in normal model-visible content:

• raw payment-card numbers, CVV or CVC values, track data, or payment credentials;

• full passport or other travel-document numbers;

• full Known Traveler Number or redress identifiers;

• OAuth access tokens or authentication subjects;

• internal user, client, database, cache, request, or trace identifiers;

• stack traces or raw provider diagnostic payloads; or

• profile, trip, or booking data for a person other than the signed-in traveler.

Limited travel-document status, document type, issuing country, or expiration information can be shown when relevant. Protected identifiers remain masked and read-only.

We can disclose information needed for the requested service to:

• Your selected AI platform. Connector results are returned to OpenAI when you use ChatGPT and to Anthropic when you use Claude. Those providers process the information under their own privacy terms, account settings, and any enterprise agreement that applies to you.

• Travel suppliers and booking systems. Airlines, hotels, rental-car providers, global distribution systems, and related travel providers receive information required to search, price, reserve, service, or fulfill travel.

• Your employer or travel-program sponsor. Information can be available as permitted by your organization's travel program, policy, reporting, safety, and duty-of-care rules.

• Andavo service providers. Hosting, identity, security, logging, support, and other providers can process information for Andavo under applicable contractual controls.

• Authorities or other parties when required. We can disclose information when required by law or when reasonably necessary to protect users, the service, or the rights and safety of others.

• Connector session and temporary offer-selection data normally expire after approximately one hour.

• Pending OAuth state and local authorization codes normally expire after approximately five minutes and are consumed once.

• Durable traveler-profile, trip, reservation, accounting, and supplier records follow the retention rules that apply to the underlying Andavo travel service, client program, supplier, and legal obligations.

• Disconnecting ChatGPT or Claude prevents new authenticated connector requests from that connection. It does not automatically delete your Andavo account, trip history, reservations, or records that must be retained.

OpenAI or Anthropic can retain information under its own terms and account settings. Contact the applicable AI platform for requests concerning data that it controls.

The connector uses OAuth 2.0 authorization with PKCE to connect an AI platform to the signed-in traveler. We use access controls, encryption in transit, server-side input validation, scoped tools, confirmation steps for supported write actions, and logging or monitoring controls intended to protect the service. No security method can guarantee absolute security.

You can:

• choose whether to connect ChatGPT or Claude to Andavo;

• decline a booking or profile-change confirmation;

• disconnect the connector in the AI platform's settings;

• update eligible profile information through supported Andavo channels; and

• request access, correction, deletion, or other privacy rights available under applicable law.

Some travel, reservation, accounting, security, or legal records cannot be deleted immediately. We will explain applicable limits when we respond to a verified request.

To submit a privacy request, email webmaster@cbtravel.com. Include enough information to identify your Andavo account and the request, but do not send a password, payment-card number, passport number, Known Traveler Number, redress number, or access token by email.

The connector is intended for authorized business travelers and is not designed or marketed for children under 13.

We can update this policy as the connector, law, or our practices change. We will post the current version and its effective date on this page. We will give additional notice when required by law.

Christopherson Andavo Travel, LP
5588 South Green Street, Suite 300
Salt Lake City, UT 84123
Privacy: webmaster@cbtravel.com
Connector support: feedback@andavo.com