Snapshot of the source text at fetch time, not a live mirror of the policy page.
Plain-English summary
The policy reveals several areas of concern regarding user data and privacy. Personal information of individuals on the same travel itinerary can be accessed by all others on that itinerary (risk_flags-1). Although facial recognition data is deleted after a trip, linked photos are retained for up to two years (risk_flags-2). Unsubscribing from promotional emails does not halt all communications, as service-related messages may still be sent. Exercising privacy rights, such as data deletion requests, might lead to the company's inability to provide services or engage with the user (risk_flags-4). The company may share data with marketing and business partners to send promotional emails, with opt-in/opt-out options dependent on local laws (risk_flags-5). The company may collect detailed behavioral data, including mouse movements and keystroke activity, using third-party tools (data_use-1). Publicly available information, such as social media posts and public records, may also be collected and used by the company. Furthermore, third-party tools used for limiting tracking might not function as expected, and the company is not responsible for their efficacy. Opt-outs for interest-based advertising are browser- and device-specific, requiring separate actions for each (gotchas-2). Some opt-outs may also be ineffective if browser settings do not accept cookies, or if cookies are deleted or settings are changed (gotchas-3).
89% confidence
Ask Verbaterm
Follow up on findings with grounded answers from this review. Not legal advice.
Risk Flags
4 findings
Critical terms that can significantly harm users or fall far outside user expectations. These often have financial, privacy, or security implications.
medium95% confidence
Personal information of travelers on the same itinerary is accessible by all others on that itinerary
The personal information of each person whose personal information is linked to the same travel itinerary may be accessible by all others included in that same itinerary.
Why it matters: Any individual whose personal information is linked to a travel itinerary may have their information accessed by all other individuals on that same itinerary.
The personal information of each person whose personal information is linked to the same travel itinerary may be accessible by all others included in that same itinerary.
HOW WE COLLECT AND USE YOUR INFORMATION, paragraph 9 · Citation strength: strong
medium90% confidence
Facial recognition data is deleted after the trip but linked photos are kept for up to two years
The policy states that facial recognition data will be deleted after the trip, but linked photos will be kept for up to two years so that users can buy them later.
Why it matters: Your photos, linked via facial recognition during your trip, may be stored for up to two years even after the facial recognition data itself is deleted, allowing the company to retain access to your photos for a significant period.
We delete facial recognition data after the trip, but keep linked photos for up to two years so you can buy them later.
HOW WE COLLECT AND USE YOUR INFORMATION, paragraph 15 · Citation strength: strong
medium85% confidence
Exercise of privacy rights may limit ability to process personal information and provide services
If the exercise of privacy rights limits the company's ability to process personal information, the company may no longer be able to provide its Services or engage with the user.
Why it matters: Exercising your privacy rights, such as requesting deletion of personal information, could result in the company being unable to provide you with services or engage with you.
However, please note that if the exercise of these rights limits our ability to process personal information (such as in the case of a deletion request), we may no longer be able to provide you our Services or engage with you.
ABOUT YOUR INFORMATION, paragraph 18 · Citation strength: strong
medium85% confidence
Company may share data with marketing and business partners for email promotions
The company may share some user data with marketing and business partners who might use this information to send emails about products or services. Users may have the option to opt-in or opt-out depending on local laws.
Why it matters: Your data might be shared with marketing and business partners who could send you promotional emails, with your ability to control this sharing dependent on your local laws.
We may share some of your data with our marketing and business partners. They might use this information to send you emails about products or services you might like. You can choose to opt-in or opt-out of this sharing, depending on the laws where you live.
HOW WE SHARE YOUR INFORMATION, paragraph 8 · Citation strength: strong
Data Use
1 finding
How the company collects, uses, and shares your data, and the implications for your privacy.
medium90% confidence
Behavioral data collection including mouse movements and keystrokes
The company may use third-party tools to collect information about how users use the Service, including recording mouse movements, scrolling, clicks, and keystroke activity on their Sites, as well as browsing behavior.
Why it matters: Your online activity on the company's sites, including how you interact with pages, mouse movements, and keystrokes, may be recorded by third-party tools.
We may also use third-party tools to collect information you provide to us or information about how you use the Service and may record your mouse movements, scrolling, clicks and keystroke activity on our Sites and other browsing behavior. These tools may also record information you enter when you interact with our Service or engage in chat features through our Service.
HOW WE COLLECT AND USE YOUR INFORMATION, paragraph 22 · Citation strength: strong
Cancellation and Renewal
Not clearly stated
Details on how subscriptions or services can be canceled or renewed, including any associated fees or conditions.
?
Not clearly stated
No cited billing terms — wording is unclear
There are no clear statements about cancellation or renewal policies in the provided text.
Gotchas
3 findings
Potentially overlooked clauses that could be unfavorable or unexpected for users.
medium90% confidence
Opt-outs for interest-based advertising are browser and device specific
Opting out of receiving interest-based advertising through online resources will only opt-out a user from receiving interest-based ads on that specific browser or device, requiring the opt-out to be performed on each browser or device used.
Why it matters: To effectively opt out of interest-based advertising, you must repeat the opt-out process on every browser and device you use.
Please note that opting out of receiving interest-based advertising through the NAI’s and DAA’s online resources will only opt-out a user from receiving interest-based ads on that specific browser or device, but the user may still receive interest-based ads on his or her other devices. You must perform the opt-out on each browser or device you use.
ABOUT YOUR INFORMATION, paragraph 51 · Citation strength: strong
medium85% confidence
Opt-outs may not be effective if browser settings do not accept cookies
Some opt-outs may not be effective unless the user's browser is set to accept cookies. If cookies are deleted, browser settings are changed, browsers or computers are switched, or another operating system is used, the user may need to opt-out again.
Why it matters: Your advertising opt-out preferences may not work if your browser doesn't accept cookies, and you might need to re-opt out if you change browsers, devices, or clear cookies.
Note that some of these opt-outs may not be effective unless your browser is set to accept cookies. If you delete cookies, change your browser settings, switch browsers or computers, or use another operating system, you may need to opt-out again.
ABOUT YOUR INFORMATION, paragraph 52 · Citation strength: strong
medium90% confidence
Processing privacy requests for other brands requires contacting them directly
The company can only process privacy rights requests for personal information processed by Carnival. If a user has interacted with another brand in their family of companies or any other third party, they must contact that brand or third party to exercise their privacy rights.
Why it matters: If your personal information is held by other brands within the company's family or by third parties, you will need to contact each entity separately to exercise your privacy rights, rather than through Carnival directly.
Please note that we can only process privacy rights requests for personal information processed by Carnival. If you have interacted with another brand in our family of companies or any other third party, you will have to contact that brand or third party to exercise your privacy rights.
ABOUT YOUR INFORMATION, paragraph 21 · Citation strength: strong
Protections
Not clearly stated
Commitments and features that protect users and are generally consumer-friendly.
?
Not clearly stated
No cited protections — wording is unclear
No explicit protections were identified within the provided text based on the given rules.
Report an issue
Flag a citation problem, stale policy text, or incorrect company match.
Verbaterm boundaries
This public review is informational only and is not legal advice. Verbaterm shows only findings tied to the cited source snapshot above.