How travel and eCommerce companies enforce DOT refund rules, PCI DSS, the FTC rules and privacy law while the work runs
A cancelled flight, a baggage claim, a missing parcel, a chargeback, a tax exemption certificate or a deletion request each carries a rule and a deadline, from the DOT's seven business days for a card refund to the CCPA's forty-five days for a response, and today each is checked after the fact, if at all. Callvu enforces those rules while the work runs: six evaluators check every request and every step against the regulation and your own policy, the Completion Orchestrator decides, a step that breaks a rule does not run, and the Decision Trace and the Audit Trace are the record.
The problem today
Most compliance is checked after the fact.By then, the damage is done.
Flight disruption handling
The flight was cancelled at nine in the evening; the hotel charged a no-show at midnight; the car sat at the counter until noon.
Delayed, damaged or lost baggage claim
The passenger emailed receipts to three addresses over three weeks; the claim was time-barred on the day the last one arrived.
Loyalty account takeover and fraud review
The member learned of the takeover from the hotel confirmation for a stay in a city they had never visited, and the points were long gone.
How Callvu runs it
Twelve travel and eCommerce processes,from the request to the system of record.
Twelve travel and eCommerce processes where the rules are enforced while the work runs. Each page names the regulations, the policies, the controls, the clocks and the documents, and what the Decision Trace and the Audit Trace record.
Flight disruption handling
Starts when the airline schedule change or cancellation arrives; every connected hotel, car and transfer booking is rebooked or unwound and written to the booking system.
Enforces: US DOT refund rules and the significant change definitions · Carrier contract of carriage and the reaccommodation and irregular operations commitments · Supplier and fare rules
Complex: multi-party handoffsDelayed, damaged or lost baggage claim
Starts with a baggage report; receipts and photos are collected, the claim is assessed against liability limits, and settlement is recorded.
Enforces: Montreal Convention · US DOT baggage rules and the carrier's contract of carriage for domestic carriage · Carrier baggage policy and the fraud controls
Complex: multi-party handoffsLoyalty account takeover and fraud review
Starts when suspicious redemptions are flagged; the member is verified, the case is decided, points restored or blocked, and the record kept.
Enforces: Program terms · Consumer protection and data security · Partner agreements and the card network rules for any cash component
SimpleFinal balance collection before departure
Starts before the final payment date; the traveler is reminded, pays on a secure screen, and unpaid bookings follow the cancellation rule.
Enforces: PCI DSS · Booking terms · Supplier payment terms and the consumer protection rules on cancellation charges
Complex: multi-party handoffsB2B account and credit terms application
Starts with a business buyer's application; documents, references and tax exemption certificates are collected and checked, and credit terms decided.
Enforces: Sales tax exemption rules · Commercial credit and fair credit rules · Business verification and anti-money-laundering expectations
Complex: multi-party handoffsMissing or late delivery claim
Starts with a where-is-my-order request; carrier data is checked, a trace or reshipment decided by rule, and the order updated.
Enforces: FTC Mail Order Rule · Card network rules on proof of delivery and 'item not received' disputes · Carrier terms and claims and the state consumer protection acts
Complex: multi-party handoffsOrder modification across channels
Starts in any channel; one policy applies to store, web and phone changes, and the result is written to order management.
Enforces: FTC · State consumer protection · Payment and tax rules on modified orders
Complex: multi-party handoffsChargeback and fraud dispute
Starts with a fraud claim or chargeback; order, delivery and device evidence are assembled, the response decided, and the outcome recorded.
Enforces: Card network rules · PCI DSS · Reg E and Reg Z error resolution
SimpleSales tax exemption certificate collection
Starts when a buyer claims exemption; the certificate is collected, checked for state and expiry, and stored before tax is removed.
Enforces: State sales tax rules · Uniform certificate rules · Government and nonprofit exemption documentation
Complex: multi-party handoffsDrop-ship vendor setup
Starts with a new vendor; catalog, shipping terms and compliance documents are collected and approved, and the vendor is enabled in order management.
Enforces: Product safety and labeling rules by category · FTC Mail Order Rule and the state consumer protection statutes · Vendor agreement, business verification and payment rules
SimpleMarketing consent capture and change
Starts at signup or a change request; consent is captured with its wording and time and written to the marketing system.
Enforces: TCPA · CAN-SPAM · GDPR
Complex: multi-party handoffsPrivacy access and deletion request
Starts with a data access or deletion request; identity is verified, the request runs across systems, and the response is sent on the clock.
Enforces: GDPR · CCPA · Other state privacy laws and the children's privacy rules
The rules and the clocks
What is enforcedacross these processes.
The regulations below are preloaded in Callvu Studio as policies and applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant. Each one links to the process pages that enforce it.
By role
What changesfor each team.
Compliance
The DOT refund rules, the Montreal Convention, the FTC Mail Order Rule, the card network rules, PCI DSS, Reg E and Reg Z error resolution, ECOA and Reg B for business credit, the state sales tax rules, the TCPA, CAN-SPAM, GDPR and the CCPA are loaded as policies and applied as steps that run. A refund that is due goes out on the rule's clock, tax stays on an order until a valid certificate passes the check, and a deletion runs across every system on the legal deadline. The Decision Trace shows what the evaluators judged and what the Orchestrator decided; the Audit Trace shows every step, consent and payment with its time.
- DOT refunds within seven business days for cards and twenty days otherwise, from the case.
- Montreal Convention notice windows and liability limits applied to every baggage claim.
- GDPR's one month and the CCPA's forty-five days on every access and deletion request, from receipt.
Operations
Disruptions, claims, delivery problems, disputes and certificates arrive in every channel and are classified once, with the supplier cutoffs, the refund clocks, the carrier claim periods and the network deadlines on the case from the start. Clear cases run by rule; only the exceptions reach a person. A claim above the limit, a disputed proof of delivery, a weak chargeback case, a questionable certificate or a locked loyalty account goes to the right desk in the Decision Desk with only the allowed choices.
- Dependent hotel, car and transfer bookings listed with their cutoffs the moment a flight changes.
- Chargeback evidence assembled from the record and submitted inside the network's window.
- One order modification policy applied the same way in the store, online and on the phone.
IT
Callvu reads from and writes to the booking system, the order management system, the loyalty platform, the tax engine and the marketing system by API and webhook, and reaches carriers and verification vendors from the process. Payments stay on process-controlled screens inside the PCI DSS scope you already have. Nothing in the stack is replaced, and your own AI agent can start any of these processes over MCP under the same enforcement.
- Reissued tickets, refunds, reshipments and credits written back to the booking and order systems.
- Card data on a secure screen, tokenized by the processor, never in a chat or an email.
- Every run pushed to your GRC and BI tools through the Analytics API.
Customer experience
The traveler, the shopper or the business buyer sees the options, the fees and the refund under the rules on one screen and finishes in one session. A rebooking is priced before it is confirmed, a missing parcel is traced or reshipped by rule, a certificate is accepted on the spot, and a refund reaches the original payment method on time without a second call.
- Rebooking options priced against fare rules and policy before the traveler confirms.
- Receipts, photos and serial numbers asked for once, from the order the process already holds.
- An opt-out captured in any channel and honored in every channel, with the confirmation sent immediately.
Questions
What travel and eCommerce buyers ask,answered plainly.
When does a schedule change or cancellation entitle a passenger to a refund under the DOT rules?
Under the US DOT refund rules (14 CFR 260), a cancellation or a significant change, such as a departure or arrival moved by more than three hours domestic or six hours international, a change of airport or an added connection, entitles the passenger to a refund if they decline the alternative. The refund is due within seven business days for card payments and twenty days otherwise. Callvu classifies the change by rule, lists every dependent hotel, car and transfer booking with its cutoff, offers the allowed options and issues the refund on that clock.
How do we keep the Montreal Convention deadlines on baggage claims?
The Convention gives seven days from receipt of the bag for a damage complaint, twenty-one days from delivery for a delay complaint, and treats a bag as lost after twenty-one days without arrival. Callvu opens the right claim type on the right clock, collects the receipts and photos once, assesses the claim against the liability limit, and sends only exceptions to the claims handler.
What does the FTC Mail Order Rule require when a shipment is late or goes missing?
A notice with the revised date and the customer's consent to wait, or a cancellation with the refund within seven working days for a card order. Callvu starts a carrier trace when there is no scan for the policy's days after the last one, reships or refunds by rule below the value threshold on an account in good standing, and files the carrier claim inside its period. A disputed proof of delivery or a claim-rate pattern goes to the order desk in the Decision Desk with the evidence.
How do we build chargeback evidence before the card network's deadline?
The evidence comes from the records the order already kept: the device and session data, the address and authentication results, the delivery scan and signature from the carrier, the account's history and prior undisputed orders. Callvu assembles that package, tracks the network's response window from the chargeback date, and tells the customer the Reg E or Reg Z periods for reporting to their bank. The fraud desk decides in the Decision Desk with only refund, fight, accept, or refer to law enforcement.
When can sales tax come off a business buyer's order?
Only once a valid exemption certificate is accepted: the form the delivery state accepts, the buyer's name and identifiers against the state's registration, the basis against the goods, the signature, the date and the expiry. Callvu keeps the tax on until those checks pass, chases renewals before expiry, and keeps the certificate for the state's statute of limitations from the sale. An unusual basis or an unaccepted form goes to the tax team in the Decision Desk with only accept, accept for specified goods, request a corrected certificate, or decline and tax.
How Callvu runs it: Sales tax exemption certificate collection
What are the deadlines on a GDPR or CCPA access and deletion request?
One month from receipt under GDPR, extendable by two months with notice; forty-five days under the CCPA and most state laws, extendable once, with the receipt confirmed within ten business days. Callvu verifies the requester at the level the request requires, runs the request across every system in the data map, reads each system's confirmation, and sends the response on the clock. A deletion against a legal hold or an unverifiable requester goes to the privacy office in the Decision Desk.
Enforcement runs through the whole travel and eCommerce handoff
From the request to the system of record, with nobody re-keying.
Bring the process your auditors worry about most
We build it against your policies and the travel and eCommerce systems you already run, train your team and stay with you through launch. You are live in weeks.