Bag to lift to landing. Without identifying anyone.

The boutique-hotel cohort — Soho House, the Pig group, the Hoxton chain, the independent Edinburgh and Bath operators — all share a brand promise of discretion. ReID via embeddings honours that promise by construction: we don't identify anyone, we just notice that the bag entering the lift on camera B is the same bag that arrived in the lobby on camera A.

§ NAMED PAINS

What the night manager tells us first.

01

Lost-bag investigations take a shift

Guest in 412 reports a bag stolen from the lobby coat check at 14:00. Today: night manager scrubs through six cameras, three angles, the loading bay and the basement service lift. With ReID, the same investigation is one query and a thumbnail strip.
02

Guest privacy is the brand

Boutique hotels live and die by the discretion guarantee. The Soho House cohort, the Pig group, the Hoxton chain. Facial recognition is brand-killing; embedding-only ReID is the only posture that lets you put 'we never identify you' in the front-of-house script.
03

Night porter is two people, not five

Under-200-key hotels typically run a two-person night shift across reception and concierge. They cover three floors and six cameras. The bandwidth to watch screens does not exist; the bandwidth to investigate after the fact barely does.

Pain 01

Guest in 412 reports a bag stolen from lobby coat check at 14:00.

What we see

The bag entering on the lobby camera at 13:42, the same guest collecting it from coat check at 13:58, and the same body-shape embedding exiting through the service-corridor camera at 14:03. Three thumbnails, three timestamps.

What we don’t see

Whose face was on the body — no face image extracted.
Guest names — the system has no link to the PMS.
Room numbers — the cameras don't read door plates.
Anything outside the hotel's CCTV footprint — the trace ends at the service-corridor door.

What concierge does

Guest in 412 reports the loss to the night manager at 14:25.
Night manager queries by camera + time window and the lobby-to-coat-check embedding surfaces in seconds.
Manager follows the embedding forward through service-corridor cameras to the staff exit.
If the exit timestamp is recent, the manager calls police with a description + the camera ID. Either way, the manager logs the incident for the morning team review.

Data lifecycle

Raw video sits in a 72-hour ring buffer on the on-prem edge appliance, then auto-overwrites — we never copy frames off the site. Embeddings (the abstract vectors the system actually compares) live for 30 days in the UK-resident database. Event records (a timestamp + a camera ID + a similarity score) live for 90 days for investigation continuity, then auto-purge. None of the three layers contain a face image, a name, or an ID document.

Legal posture

Processed under UK GDPR Art 6(1)(f) — legitimate interest in operator safety, balanced against a data subject who is not identified by the system. ICO registration: ZA-class data-controller posture (no biometric-processing escalation; embeddings of body-shape + clothing carry no Schedule 1 special category by construction). DSPT v8 self-assessment shared with the customer's DPO under NDA before contract; written legal opinion on the embeddings-vs-facial-recognition distinction included.

Procurement Q&A

Will police accept the embedding as evidence?: Embeddings are not the evidence — the raw 72-hour ring-buffer footage is. The embedding is the index that points the night manager to the right frame in seconds rather than after a shift of scrubbing. Police receive the frame, the timestamp, and the camera ID.
What if the guest who lost the bag wants the footage?: A Subject Access Request scoped to footage in which the guest appears is fulfillable from the 72-hour ring buffer, with third parties redacted. We document the SAR workflow in the runbook; the night manager doesn't have to make the call alone.
Does this conflict with our discretion guarantee?: The front-of-house script is 'we never identify you' — and the system, on its own, can't. The night manager identifies a guest from context (room number, check-in record, the guest's own report); the camera stack identifies a movement pattern.

Pain 02

'We never identify you' — in writing, in the front-of-house script.

What we see

Body-shape + clothing-colour embeddings, only. The visible 'output' of the system to the night manager is a thumbnail strip and a similarity score, not a face, not a name.

What we don’t see

Faces — we do not extract face features, we do not store face images.
Names — there is no link from the camera stack to the PMS.
Demographics — no age, no gender, no ethnicity inferred or recorded.
Behaviour outside the brief — no dwell-time analytics, no marketing data, no commercial inference.

What concierge does

Night manager queries only when there is an operational reason (a report, an incident, a regulatory request).
The console refuses queries without a written reason logged — the field is mandatory.
The morning team reviews the query log + the reasons + any escalations during shift handover.
Quarterly: the General Manager publishes a transparency note to guests on request — same format as the residents' note in our BTR deployments.

Data lifecycle

Legal posture

Procurement Q&A

How does this read against the Soho House / Pig group brand?: It reads as the only posture that lets you keep 'we never identify you' on the front-of-house card. Facial recognition makes the card a lie; manual screen-watching makes the bandwidth a fiction. Embedding-only ReID is the middle option, and the brand promise survives.
What about VIP guests with privacy clauses in their booking?: Operationally identical — they are not identified by the system. If a VIP's PA wants a specific room excluded from cross-camera matching on a specific date range, that's a configuration the night manager can apply per-stay.
Can the group's group-level analytics team see anything?: Not from this system. The embeddings stay on-prem, the event records stay on-prem, the reports the GM exports to group are aggregate counts (incidents handled, SAR throughput) with no per-guest detail. We don't ship a group-analytics integration and won't without an explicit DPIA.

Pain 03

Two-person night shift. Three floors. Six cameras. One bandwidth.

What we see

The system handles continuous monitoring so the two-person shift can handle continuous hospitality. Alerts surface to the duty manager's console only when a cross-camera pattern matches one of the building's standing rules (guest-vs-non-guest, after-hours back-of-house, lost-property hand-back).

What we don’t see

Routine guest movement — the system doesn't generate noise for legitimate guest patterns.
Staff movement — the back-of-house team's embeddings are explicitly excluded from cross-camera alerting during shift.
Anything outside the configured rules — there is no general-purpose surveillance feed for the night manager to dip into.

What concierge does

Standing rules are configured during onboarding by the General Manager + the Head of Security (typical: three rules).
Alerts surface to the duty-manager console with a 3-thumbnail strip and a one-line description of which rule matched.
Night manager triages — clear (false positive), action (call security, dispatch concierge), or note (log for morning).
False-positive rate is tracked and the rules are tuned monthly in the operator review meeting.

Data lifecycle

Legal posture

Procurement Q&A

How is this different from existing motion-alert CCTV?: Motion alerts fire on every movement — by 11pm on a Friday they're worthless noise. Cross-camera pattern matches fire when the same body moves across the right combination of cameras in the wrong order or the wrong time window. Signal-to-noise on the pilots we've run is 10×.
What's the night manager's training look like?: Two hours during deployment week — console walkthrough, rule explanation, escalation workflow, SAR-fulfilment basics. We provide refresher modules quarterly and the GM's runbook covers all the recurring scenarios.
What happens during a system outage?: The 72-hour ring buffer keeps recording on the appliance regardless; only the cross-camera matching is degraded. The night manager falls back to manual screen-watching until the appliance reconnects — which is what they were doing before, so the baseline is preserved.

§ ICO POSTURE FOR HOTELS

The discretion guarantee. In writing.

The guest-privacy story is the front-of-house pitch, not a footnote in the DPIA. Embedding-only ReID lets the night-manager script remain "we never identify you" because the system, on its own, can't. There is no name. There is no face image. There is a 14-day-lived vector and a cosine-similarity score.

For groups operating across jurisdictions (Hoxton, Soho House, the Pig group with Cornish + Cotswolds sites), the UK-only residency story holds for the UK estate. Sister sites in EU/US run on different stacks — we'd rather be honest about that than over-promise.

Read the rest of the stack.

How it works → The UK posture → Pricing →