How do I handle a customer's data request?

Export a customer's data as a file, erase them on request, and record marketing consent — with password confirmation on every step.

When a customer asks for a copy of their data, or asks to be deleted, everything you need is in the … menu at the top of their profile, and their marketing choice shows under What they agreed to. These tools are for Owners and Admins only, appear only in the main dashboard (never the staff portal), and every action asks you to confirm your password — deliberate safety steps, because you're handling personal data. Everything is also recorded in your activity log.

Give a customer a copy of their data

• Open Customers and open the customer's profile.
• Click the … button at the top, then Download their data, and confirm your password.
• A file downloads containing their profile, booking history, any Order & Pay table orders they have placed, their gift cards and payment links, their marketing-consent history and their messages with you (what they wrote, your replies and your team's notes about them — never your team's names) — including their loyalty ledger and promotion history if they're a member. Treat the file itself as personal data — send it to the customer securely and don't leave copies lying around.

Erase a customer on request

• In the … menu, click Delete customer. A confirmation window explains exactly what will happen. If they're a loyalty member it also spells out the cost: "This destroys their loyalty balance" with their exact stamps or points — once deleted, points and stamps cannot be recovered.
• Type DELETE, click Permanently delete, then confirm your password.

Their personal details are removed from every booking (old bookings show as "Deleted customer") and from any Order & Pay table orders they placed, including any note left on an order line. The words of their messages with you (and your replies and notes) are replaced with "removed at the customer's request", and their name and contact details come off each conversation. Their profile is then deleted, along with any loyalty balance and membership. Booking dates, times and statistics are kept for your analytics — with nothing that identifies the person. This cannot be undone.

Record marketing consent

The badge under What they agreed to (in the profile's details) shows Marketing: opted in, Marketing: opted out or Marketing: not asked, and the line under it says how and when the customer chose, in their own terms — for example "Yes — didn't tick "No thanks to offers" when booking online, 2 Apr", "No — said no on the preferences page" or "Not asked". If they said yes but switched texts off, it adds that offers go by email only — or, for a customer with no email address, that no offers go by text or email.

• To opt someone in, click Confirm marketing consent in the … menu. Only do this when the customer has genuinely, explicitly told you they want marketing — in person, on the phone, in writing, on a signed form, or through a loyalty sign-up. Type I CONFIRM CONSENT, optionally add a short note of the context (5–200 characters), and click Mark as opted in. The change is logged with your name and the date — wrongly opting people in breaks UK GDPR and PECR.
• To opt someone out, click Mark as opted out in the … menu, then Confirm opt-out. They'll stop receiving marketing emails immediately; booking emails are unaffected. This works for a customer who was never asked too — for example someone who phones to say they never want your offers — and a no recorded this way sticks: a later online booking with the offers box left alone doesn't turn it back into a yes.

• A guest known only by their mobile number (a Phone only record) is downloaded and deleted from their profile the same way — the download holds every booking made with their number, and deleting blanks them (see phone-only customers).

• When you take a booking or seat a walk-in with an email, Offers by email or text? asks you to put the question to the customer there and then — Yes, No or Didn’t ask. Their answer goes on their record as "said yes (or no) when your team asked while taking their booking", with your name kept as the evidence; a No sticks the same way, and Didn’t ask leaves the record as it is. For a customer who said no to your emails before, a Yes turns on texts only — their emails stay off until they turn them back on themselves (the link in your emails, their preferences page or My account, or confirming a news sign-up) or you use Confirm consent to emails too from their profile. Merging two records never ends a "no" either.

Customers can also help themselves: every marketing email has an unsubscribe link, and the customer portal has a "Delete my data" option.

Related: How do I export my data? · Who receives my campaigns — and who is skipped? · What can customers do in the customer portal?