# Schedule operation privacy

Attendance corrections, desk bookings, waitlist changes and schedule cancellation/restoration retain receipts so retries do not repeat changes or client contact. Verified subject access and erasure preparation now include these records, with staff provenance separated from other clients’ private data. Venue exports omit internal replay and provider credentials.

Erasure stops for review when delivery or collection remains uncertain or cleanup cannot prove identity removal. Configured retention minimizes eligible records while preserving the evidence needed to prevent duplicate work.


Privacy exports include automatic and approved waitlist promotion records, plus the actual pass owner in reviewed first-use activation evidence. Export and cleanup distinguish each attendee and owner. Retired receipts keep retry protection; pending work for other attendees remains available.