Appearance
Hiding guests' personal details from staff
Your guest list holds personal details: names, email addresses, phone numbers and whatever your sign-up forms ask for. Not everyone who signs in to Kiwire needs to see them. Mask personal data partly hides those details on admin screens for everyone except the roles you choose.
Masking changes what people see. It never changes what is stored: switching it off shows everything again straight away.
Turning it on
- Go to Admin → System → Settings → Consent & Privacy.
- Under Personal data on admin screens, switch on Mask personal data.
- Click Save. The Consent & Privacy card shows Masked while it is on.
It is off until you switch it on, and it applies to your whole site.
Who still sees everything
Masking follows the View personal data (unmasked) permission, listed under Consent & Privacy on Admin → System → Roles.
| Mask personal data | Role has "View personal data (unmasked)" | What they see |
|---|---|---|
| Off | Either | Everything |
| On | Yes | Everything |
| On | No | Masked details |
- The Admin role has the permission. Manager and Viewer do not.
- To let someone see full details without making them an administrator — a compliance officer, for example — create a role with the pages they need plus View personal data (unmasked).
- The permission only unmasks. It does not open any page by itself; which pages a role can open is still set by its other permissions.
What is masked
| Detail | Shown as |
|---|---|
| Name | J*** T*** |
| Email address | j***@gmail.com |
| Phone number | +60 1*-*** **89 — the first and last digits stay |
| IC or passport number | only the last four characters |
| Username that is an email address or phone number | masked the same way |
| Other usernames (room numbers, codes, nicknames) | not masked |
| Custom sign-up fields | masked by what they hold — email, phone, name or ID number — and hidden (•••) otherwise |
| Gender, age, location and birthday from social sign-in | hidden |
| Device name (for example Johns-iPhone) | the name part is masked: J***-iPhone |
| Survey answers | answers people chose from a list stay readable; typed answers are masked by what they hold |
Always visible: MAC addresses, IP addresses, room numbers and the remarks your team writes on an account.
Where it applies
- Accounts → Users — the list, the account details and its tabs, and the export.
- Search at the top of the console. Searching by a full email address or phone number still finds the guest.
- Reports that list guests — login records, active sessions, top accounts, bandwidth, registrations, social sign-in data, survey responses, payments and the PMS log — and the dashboard widgets.
- CSV exports of all of those, and scheduled reports: a scheduled report follows the role of the person who created it.
- The Audit Trail: changes to guest accounts show masked old and new values.
- API keys: results follow the role of the administrator the key belongs to.
Accounts can still be managed while masking is on: masked fields are read-only in the edit form, and everything else — profile, status, expiry, zones — can be changed as usual. Change profile on active sessions works too.
Logs
The Captive Portal Log, PMS Log and Portal Session Debugger show each event exactly as it was recorded, guests' details included, so they can't be partly hidden. While masking is on, roles without View personal data (unmasked) see a short notice instead of these pages.
Exports are recorded
While masking is on, every export that includes full personal details — made by someone whose role can see them — is recorded in the Audit Trail, with who downloaded it and when.
Pages that always show full details
Masking does not change these pages: ISP subscribers, the consent ledger, approved devices, vouchers, buy-panel users and top-up codes. Limit who can open them with role permissions.