Clients ask what we keep. It is a fair question and the honest answer runs longer than they expect, because most of the record an evening leaves behind is not created by us. We hold three files. The evening itself creates six or seven more, in places nobody thinks about until afterwards.
What follows is the whole list. Some of it you control and some of it you do not, and knowing which is which is the difference between feeling private and being private.
The three records we hold
The first is the booking. Date, city, service, companion, your name, your email, your phone number, and whatever you wrote in the requests field. It sits in our system for twenty-four months from the date of the evening and then it is gone.
The second is the email trail: the confirmation, the changes of plan, the replies. Our mailboxes hold twenty-four months to match, and nothing from them is forwarded outside the desk.
The third is the payment record, and this is the one we cannot delete when you ask. Invoices and the ledger behind them are kept for six years because tax law in most of the countries we work in requires it. Ask us to erase your booking file and we will. The accounting entry stays. A company that deletes its invoices on customer request has a larger problem than privacy.
We can delete what we chose to collect. We cannot delete what we are required to keep, and any agency that tells you otherwise is describing a policy it does not follow.
The records the evening creates
Now the ones outside our control, ordered roughly by how often they catch people out.
- The card statement. Your bank prints the merchant name, and the merchant name is whatever the merchant registered. Ask what appears on a statement before you book rather than after.
- The hotel folio. If a second guest is added to a room the folio records it, and folios are printed at checkout and emailed by default unless you say otherwise at the desk.
- The restaurant reservation. Held by the venue, usually on a platform, usually with a note attached. Every member of staff with a login can read that note.
- The car app. Two pickups, two drop-offs, timestamps, on an account that is often part of a family plan.
- Calendar invitations. The most common leak we see. An invite sent from a work account is visible to an assistant, and a free-or-busy block is visible to an entire company.
- Photographs. Event photographers, other guests, and the venue’s own social account, which posts faster than anyone expects.
- Access logs. Residences, some private clubs, and any building where a guest signs in at a desk.
None of that is meant to alarm anyone. It is on the list because clients spend a great deal of attention on the part we handle and almost none on the parts they handle, and the parts they handle are where things actually surface.
Four decisions that do most of the work
Book in the name that pays. Mismatched names at a hotel desk create a conversation, and conversations at desks happen in front of other guests. If the card says one thing and the reservation says another, someone will ask.
Use one channel for the arrangement. Pick email or pick phone, tell us which, and keep the whole thread in one place. Details spread across a work address, a personal address and two messaging apps cannot be found later when you want to delete them.
Keep it off the shared calendar. A dinner at eight is a dinner at eight. It does not need a title, a guest list, or a location field, and it certainly does not need to sit on an account your assistant manages.
Decide the photograph question before the evening rather than during it. Say plainly whether you are happy to be photographed, tell us, and we will tell your companion. Nobody has to improvise a refusal in front of a photographer with a lanyard.
What you can ask us for
You can ask for a copy of everything we hold about you, and we will send it within thirty days, usually a good deal sooner. It arrives as a plain document rather than a database export, because a database export is technically compliant and practically useless.
You can ask us to correct anything wrong in it. You can ask us to delete the booking file, subject to the accounting exception above. You can ask us to stop contacting you entirely, and that instruction is honoured on the same day.
What you cannot ask for is anything about a companion. Their records are theirs. We do not share a companion’s details, notes, or history with a client, and the reverse holds as well: your file is not shown to a companion beyond the briefing they need for the evening.
The record we ask you not to create
There is one we see often enough to name. A client receives a confirmation, screenshots it, and sends the screenshot to a friend for an opinion on the plan. Perfectly natural, and it has now put the whole arrangement into a messaging app that backs up to a cloud account shared with a family device.
A screenshot is a photograph, and photographs go into the camera roll, and camera rolls sync. The confirmation in your email is protected by your email password. The screenshot of it is protected by nothing in particular and is sitting between a picture of a parking space and a photograph of a dog.
If you want a second opinion on a plan, ask us. We will happily discuss a restaurant, a timing, or whether an evening suits the occasion, and that conversation stays in the channel you already chose.
The part that is really about trust
Every retention period above is a number we chose and wrote down. That is the only reason it means anything. A promise of discretion with no schedule attached is a feeling, and feelings do not survive a subject access request or a change of ownership.
If you are comparing agencies, ask each one how long they hold a booking and what happens to it afterwards. The ones who answer with a number are the ones who have thought about it. The ones who answer with an adjective have not.
