Protecting Your Account With Hidden Guest Details

Why We Made This Change

Phishing attacks targeting hotel staff accounts are one of the most common ways guest data gets misused. When a staff login is compromised, an attacker can open your reservation list and copy hundreds of guest email addresses and phone numbers in minutes - then use those details to impersonate your property and send fraudulent messages directly to your guests.
Previously, anyone with access to your reservation or guest lists could read full contact details without opening a single record. That made a stolen login disproportionately damaging: one compromised account could expose your entire guest contact book at a glance.
We've made a change that significantly reduces that risk.

What's New

Guest personal details are now partially masked in your reservation and guest lists. The masking lets your staff recognize any record at a glance, while making bulk data harvesting from a stolen login far less useful.
Each field type appears in a consistent, recognizable format:

• Email - First and last letter shown, full domain kept. Example: T****y@yourdomain.com
• Phone and mobile - Last 4 digits shown. Example: ***-***-5309
• Date of birth - Year visible, month and day masked. Example: 1985-**-**
• ID document number - Last 4 characters shown. Example: ******5678
• Postal code - First 2 characters shown. Example: 94***
• Home address - Hidden in list view

Full details are always one click away - simply open any individual reservation or guest record to see everything.

Where This Applies

• Reservation list - Email, phone, mobile, ID document number, date of birth, home address, and postal code are partially masked.
• Profiles list - Same fields as the reservation list.
• Guest search - Email and phone only. No other fields are affected here.
  The masking applies only to list views. Individual reservation records, guest profiles, booking screens, and check-in screens are not affected - full details are always shown there.

How staff see the full details

1. New reservation list: click any reservation to open it, then go to the Guest tab.
2. Profiles list: click any guest to open the profile, where full details are shown.
3. Customers list: click any customer to open the full profile.

Full details are also shown throughout the booking and check-in screens.

What This Means for Your Team

For most day-to-day tasks - checking in a guest, assigning a room, looking up a reservation - nothing changes. The only difference is that staff who previously copied contact details directly from the list will now need to open the individual record to see the full value. That's one extra click, and a much safer operation.
Your exports are also unaffected. Any export you run continues to include full guest details, as it always has.

Important: Check Your Integrations

If you use a connected app or integration that pulls guest data, the impact depends on which list it reads from:

• Apps reading from the guest profile list are not affected and continue to receive full details.
• Apps reading from the reservation list or guest search will receive partially masked email and phone numbers.

If you rely on an integration that needs full contact details from those sources, we recommend reviewing it before the feature is active on your account.

A Note on Finding Duplicate Guests

The duplicate-matching tool continues to work accurately - it uses full details behind the scenes, so merges remain reliable. If you're scanning for duplicates by eye in the list view, you'll see partial emails. Simply open the individual guest profile to confirm a match before merging.

Your Guest Data Is Safe

This change affects only how information is displayed in list views - nothing is deleted or modified. Your guest records remain completely intact. If you have any questions about how this affects your account or your integrations, please reach out to our support team.