As a hotel operator, I want guest PII (name, handle, phone, reservation #) masked by default in the inbox with role-gated click-to-reveal, so that contact data isn't exposed on shared screens or to staff without a business reason to see it — keeping us defensible under GDPR and letting us screenshot the inbox without hand-scrubbing every image.