Guest phone numbers are personal data. “Because it’s convenient” is not enough: legal basis, check-in purpose, limited retention.
Good practice: traced opt-in, multi-tenant isolation, no OTA scraping, audit logs on access sends, minimization.
Kyvvio structures consent on the pre-check-in form and isolates data by agency. Not legal advice — validate critical points with counsel if needed.
On wrong-number incidents: bump access generation and invalidate in-flight codes — less leakage, more control.