Privacy and guest data

Passport numbers

• They are encrypted before they are stored.
• Staff screens never show them, only "Passport on file". You can type a new number, but you can never read an old one back.
• They never appear in logs, the audit log, messages to channels or ordinary exports.
• They appear in exactly one place: the passenger manifest. Only owners and reservations can download it, each download is recorded, and the file is deleted after a day.
• They are erased automatically 90 days after disembarkation (an owner can change the number of days). Dates of birth are erased at the same time. Names stay, for the accounts.

Other companies cannot see your data

Each cruise company's data is separated inside the database itself. Even a mistake in the application could not show your bookings to another company. Automated tests try to break this on every table, every time Riverdesk changes.

A guest asks for their data, or asks you to delete it

Owners can do both from the booking page, on the guest's line:

• Export data downloads a file with everything held about that guest: name, nationality, date of birth, passport, and the booking.
• Erase replaces the name with "Erased Guest" and removes the nationality, date of birth and passport. This cannot be undone. The guest's place on the booking stays, so the cabin's occupancy and the booking's accounts still add up.

Both actions are recorded in the audit log, without the personal data itself.