Contacts and Guest History

Managers and administrators use /contacts within their authorized team/location scope. Trusted source workflows may capture Contacts without granting directory access. Coupons, contact cards, messages, incidents, and eligible surveys share Contact identity; a Contact record is not evidence of marketing permission.

How a coupon saves a customerCopy Anchor Link

Coupon activation uses the entered email and optional phone through the shared identity resolver. It may link an existing confirmed customer or create one in the same transaction as the accepted reservation. A name alone is not a customer identifier. Ambiguous matches stay Needs review; do not create a duplicate or pick a different identity to bypass coupon eligibility.

A unique issuance can be addressed to a confirmed existing Contact. That recipient association does not reveal the private token in the directory or allow a second redemption. If a Contact was merged while an operation was pending, the server resolves the canonical record and safely retries or rejects the whole operation.

Profiles and activityCopy Anchor Link

A profile can show authorized coupon claims, terminal status, feedback, contact-card interactions, messages, incidents, and other available sources. Coupon entries retain the actual restaurant and accepted offer reference. Their redeemed status alone does not prove a Toast discount was applied. Guest confirmation, staff confirmation, physical-card entry, and POS evidence are distinct facts.

Merged IDs resolve to the surviving profile with a merge explanation. Source failures appear as unavailable; an unavailable coupon or survey source does not mean the customer has no history. The profile is a bounded operational view, not a complete raw export.

Personal informationCopy Anchor Link

The Contact Information section starts masked. An eligible operator can use Reveal Details with an operational reason and recent authentication reverification; the reveal is audited. Coupon history and reports continue to return masked Contact values for every role. Raw coupon exports use a separate administrative authorization and audit.

If a redemption points to the wrong Contact, use the dedicated authorized repair form with a reason and an eligible confirmed target. Repair changes the association without rewriting the offer snapshot, fulfillment evidence, or guest history. Administrators own identity review and merges; do not edit customer identifiers or delete history as a substitute.

The current Reveal Details action applies its restaurant check to managers but exempts the administrator role, including location-scoped administrators. This residual scope difference is recorded in the Contact source audit. Do not treat reverification/audit as proof that this boundary matches ordinary read/edit scope. The same source audit records the separate retention-prune gap; this guide does not certify a comprehensive safe purge or guest retention policy.

Consent and anonymous feedbackCopy Anchor Link

Coupon terms authorize that offer's acceptance. They do not authorize email/SMS marketing or operational callbacks. Those purposes have separate explicit consent records. A merge preserves original consent history; the latest effective decision for each purpose/channel applies, including revocations. It does not manufacture a new grant or turn a revocation into permission.

The current anonymous NPS mode stores no Contact, callback or marketing data. An anonymous response cannot be linked to a customer for follow-up, and a low score does not create a contactable recovery case.

Paper-card Quick Entry at /contact-cards is a separate capture flow. Its Birthday Coupon/Other Coupon acquisition categories describe the source of that card; recording one does not activate or redeem a digital coupon or verify a Toast discount.

SupportCopy Anchor Link

Use safe record IDs, restaurant, timestamp, and the displayed outcome/category for support. Do not share raw email, phone, notes, private issuance URLs, cookies, or staff proof in tickets or screenshots.

See Coupons, the Contact management contract, and the CRM/guest pilot readiness runbook for authorized workflows and evidence gates.