Collect and review deliberate feedback

Ask a useful question and preserve its original meaning#

Surveys & Feedback supports ordinary voluntary business feedback. Prepare a questionnaire, review its actual identity and privacy decisions, publish an immutable revision and deliberately open a bounded public share link. Responses retain the exact original questions, notice and participation decision.

A survey answer is feedback. It does not create a customer, staff identity, marketing subscription, health assessment, ticket, payment or government approval.

1. Configure access, collection readiness and operating limits.
2. Create a survey and save useful questions.
3. Review the actual notice, identity mode and audience.
4. Preview and publish the exact questionnaire.
5. Open a reviewed share link and share its actual URL.
6. Read permitted results and protect retained content.

Install one standalone app deliberately#

Use a corporate workspace with ready shared business onboarding, an installed Surveys app and its current allowance or licence. Surveys does not require CRM, Customer Success, Events, Email Marketing or a financial app. No dependency is silently installed.

Current membership, role and workspace always govern access. Switching workspace, removing the app, expiry or revocation invalidates stale authoring decisions.

Choose practical operating defaults#

An owner or administrator chooses who may prepare drafts, whether granted staff may see survey designs and whether separately granted people may read raw responses. These are ceilings: a broad setup option does not create a survey grant.

Enable public collection deliberately after actual readiness is available. Review default retention, working timezone and bounded retained-response/content limits. Lowering a limit below actual usage stops new admissions; it does not delete records.

Build understandable questions without code#

Use short text, longer text, choose one, choose several, integer rating and yes/no controls. Provide clear labels, relevant help, necessary required status and bounded answer lengths or selection counts. Required No and rating zero are real answers.

An initial draft is deliberately incomplete. Save zero to forty draft questions while preparing; publication needs one to forty valid questions. Changing saved questions clears the prior privacy review. Stable question keys preserve meaning after a label edit; file references are available without requiring devtools.

Choose unlinked or self-declared identity honestly#

Unlinked feedback asks for no name or email and does not link its response to a workspace user, browser/session or hidden device field. Free text can still identify someone, and actual infrastructure security logging remains as disclosed. This is not an absolute anonymity guarantee.

Identified feedback records only the name and email the respondent supplies. They are self-declared and unverified. No email similarity joins a CRM person; no response grants marketing consent.

Review the actual public notice before publication#

Record the public organisation name, privacy contact, purpose, reviewed basis, recipients, retention, exceptions and rights/withdrawal instructions. Choose the notice language explicitly. A visible language fallback is not an automatic legal translation.

Security logging and identity disclosure fragments come from actual platform-controlled localized defaults. Owners review those facts; they cannot turn an unavailable deployment into ready collection by claiming that logs do not exist. Every saved notice/mode change needs a fresh publication review.

Review actual business, audience and applicability#

The business country comes from shared reviewed business facts. Audience countries, relevant state/province/free-zone/sector scope, recipients and overseas processing are explicit owner decisions. EU/EEA is an applicability region, not a fabricated country code. IP, currency and interface language do not establish residence or law.

This scope supports ordinary voluntary feedback with local privacy controls. Sensitive, child, specialist or regulated research remains unavailable; a reviewed-country flag is an operator decision, not statutory certification.

Official references: Reviewed country and privacy principles ↗ · New Zealand privacy principles ↗

Review GB and EU/EEA purposes and identifiability#

Distinguish unlinked, self-declared and potentially identifying answer text. Review the actual purpose, basis, notice, recipient and retention facts applicable to the audience. Do not treat a pseudonymous technical reference as a guarantee that nobody can be identified.

Surveys does not determine a person’s legal status or supply a blanket research exemption. Its suppression and access controls are product safeguards, not a universal legal anonymity standard.

Official references: ICO anonymisation guidance ↗ · EDPB basic principles ↗

Review US and Canadian actual scope#

Relevant US state/sector and Canadian province/sector facts can differ. Record actual applicability and a proportionate ordinary-feedback purpose; keep participation, feedback follow-up and marketing permission distinct.

This first workflow does not provide children’s or specialist research onboarding, verified respondent identity or a general certification. Review the appropriate actual audience and notice before collection.

Official references: California privacy rights and applicability ↗ · FTC COPPA guidance ↗ · Canadian privacy business guidance ↗

Review SA, AE, QA, KW and PK facts precisely#

Record actual statutory, free-zone or sector scope, recipients, overseas processing and rights for Saudi Arabia, the UAE and Qatar. Kuwait and Pakistan also require current applicability/status review; a catalogue country label is not evidence of a current comprehensive approval.

Do not present a draft bill, repealed broad rule, local validation or ordinary questionnaire as a government-certified service. This app supplies reviewed ordinary-feedback controls and records the operator’s actual notice decisions.

Official references: SDAIA implementing regulation ↗ · UAE data protection overview ↗ · Qatar privacy-notice guidance ↗ · CITRA current regulation register ↗ · Pakistan legislation register ↗

Preview and publish the exact saved revision#

Public preview renders the same questionnaire and notice without an admission context or submit action. It never inserts feedback. Check labels, required questions, mode, language, gate and completion text before confirming the current expiring publication review.

Published questions, mode and notice are immutable. A stale or invalidated review requires a deliberate current read/review; do not replace an uncertain original request with a new UUID.

Change future questionnaires through a new revision#

Clone an actual predecessor into the single editable draft, then save/review/publish it. Earlier responses keep their own original questionnaire. An existing editable draft is opened rather than silently replaced.

A new revision never changes a live collector. Retire only when its dependent collectors permit it; archive the survey family only after its collectors are permanently closed. Retained history remains.

Prepare a bounded public collection#

Choose the exact published revision, give its share link a useful internal label, and set actual opening/closing instants, a display/retention timezone and a finite total admitted-response cap. The opening review shows those facts and current readiness.

Only an owner/admin opens or resumes a reviewed collector. After opening, its questionnaire, schedule and capacity stay frozen; prepare another collector for a different collection. Share only the actual current URL returned by the service.

Understand scheduled, open, paused, full and ended#

Scheduled means the opening time is still future. Ended means its interval has ended. Full means the admitted total has reached its original cap. Unavailable means a current hosting, setup, licence, allowance, app or expiry boundary prevents fresh admission.

Admitted total includes content later removed. Removal does not reset admission capacity. A technical request replay prevents duplicate acceptance of that original request; an unlinked shared link does not enforce one-person-one-response.

Pause, permanently close or replace a share link#

Pause stops fresh collection temporarily; resuming needs current owner review. Permanent close is terminal and cannot reset capacity. Replacing an open/paused share link changes its current handle and generation without rewriting questions or counts.

Old handles/contexts cannot admit fresh answers after replacement. A genuine already-accepted original request can still recover its own generic acknowledgment through the fixed submit boundary. None of these collection controls creates a privacy retention hold or delays receipt-based erasure.

Participate in the actual public questionnaire#

Read the exact notice and participation choice. Declining creates no response. Supply only necessary answers and, in identified mode, the self-declared name/email requested. Optional feedback-specific reply preference is separate from marketing.

The public page has no staff navigation or private workspace props. Answers are kept in memory until submission and are not stored in browser history/local storage. Closing or reloading an unresolved page can lose that in-memory request; keep it open while deliberately checking the original.

Keep the body-only withdrawal receipt#

After actual acceptance the page may display an unguessable withdrawal receipt. Copy or download it deliberately and keep it private. It never appears in a public management URL, staff history, export or survey identity field.

An exact accepted replay returns the original acknowledgment authority without adding a response. A missing receipt in that acknowledgment does not itself prove deletion. Lost unlinked receipts cannot be recovered by identifying someone through email.

Request removal without a secret URL#

Use the fixed withdrawal form and enter the receipt in its body. Confirm the actual removal request. Removed, already removed and pending retention review are distinct server outcomes. The form does not provide an answer-reading endpoint.

Only an actual active separately reviewed retention hold can cause immediate restriction with pending review instead of erasure. Collection pause, closure, disablement or reinstall alone never blocks removal. Do not interpret a pending result as a completed deletion.

Delegate each survey responsibility deliberately#

Every grant belongs to an exact survey, current member and current app installation. Viewing design, editing drafts, closing collection, aggregate analysis, individual-response read and response export are separate. Require design view with every grant. Aggregate export needs analysis and explicit export permission; raw response CSV additionally needs individual read. Export never silently grants raw access.

Viewers can deliberately receive read, aggregate or export responsibilities, but cannot edit/close. Revocation, offboarding or reinstall deny stale access immediately; no name, email or title confers authority.

Read permitted reports without creating a privacy oracle#

Unlinked reports are final-only after permanent close. Whole affected distributions and denominators are suppressed when small groups or complements could disclose a response. Minimum group5 is a product safeguard, not a legal anonymity standard. There are no arbitrary cohort/date/text filters or answer drilldowns.

After a post-close privacy change, or when content becomes due/ineligible by time, the unlinked report becomes unavailable rather than exposing a reduced comparable report. Identified aggregate availability remains distinct from raw identity access.

Read the exact original answer meaning#

Individual response access is separately granted. Each detail joins its own immutable questionnaire and participation notice. Unlinked rows expose only the accepted calendar day; no hidden exact time or respondent identity is supplied.

Technical random-UUID cursor order is not submission chronology. Restricted, removed or due content is excluded from ordinary raw reads/exports; owner privacy sees minimized lifecycle references where required. No identity/date/answer search is introduced.

Download only the currently allowed segment#

Select one collector so question columns retain a stable meaning. Raw export requires both read and export responsibilities and current authority on every request. Download permitted accepted rows in bounded segments up to500; the returned continuation selects the next segment.

Exports omit security/context/replay/receipt/private rationale fields. Formula-active cells are neutralized and UTF-8/newline/quotes are preserved. Design and already-permitted aggregate exports are separate from raw feedback export; shared table tools do not create an alternative download permission.

Preview a question file before replacing a draft list#

Download the exact sample columns question_key,type,label,help,required,settings_json. Type-specific settings follow the question builder’s real choices. Upload a readable UTF-8 CSV, inspect field/row errors and the resulting question list, then deliberately confirm the exact current-draft replacement.

Changing the file invalidates its preview. Expired, foreign, published or stale draft previews cannot commit. This import never creates a response, person, participation decision, notice or marketing subscription.

Review exact irreversible content removal#

Owner privacy selects current response references/versions from one survey, supplies the actual reason and previews the irreversible consequence. An active explicit hold prevents removal. Confirm only the exact current selection and expiring review.

Content removal wipes answers, identity, follow-up and recoverable receipt content once. Minimal technical references follow the disclosed replay window; no raw answer/reason archive is created. Existing exported files cannot be recalled, and backups follow platform policy rather than a forensic-erasure promise.

Keep collection pause separate from an explicit retention hold#

A retention hold is an owner-reviewed privacy decision with an actual reason and finite end date. It lasts through the chosen collector-local calendar day and expires at the next local midnight converted to UTC. It is never created by pausing or closing collection.

Receipt withdrawal under an active hold restricts content immediately from ordinary results and exports. Releasing/expiry allows due privacy work; release itself does not claim deletion. Minimized owner due references and actual active holds remain distinct lists.

Read metadata without a second answer archive#

History records actual staff decisions, actor snapshots, affected fields and appropriate dates. It does not retain raw answers, respondent identity, CSV, receipts, private reason bodies or timestamped public submission events.

Design/analysis histories omit owner privacy events that could reveal individual response existence. Current permitted original records remain the source for content; history does not expand access.

Protect retained feedback after app removal#

Current owner recovery can read retained survey references and close collection, manage actual finite privacy holds and remove permitted response content. It cannot create/publish/open surveys, issue new grants or bypass expiry.

Reinstalling does not bind an old collector to a new installation or revive staff grants. Create a deliberate new collector for future feedback. Genuine accepted acknowledgment/receipt withdrawal retains its own capability boundary while disclosed technical records remain; purged demo data is never reconstructed.

Preserve an unresolved original request#

Field errors preserve entered data. A stale review needs a current deliberate read/review. An unknown outcome locks its original body/context/UUID; use the original status or retry control instead of changing data and replacing the identifier.

Public retries send the exact original only after a deliberate click. Staff receipt checks open current guarded records after a confirmed completion. Neither workflow automatically resends unknown work or manufactures success.

Publish a deliberate language and readable directions#

Questionnaire content supports English, Arabic, Urdu, Hindi, Spanish, Turkish, Russian, French, Portuguese and Bengali. Arabic/Urdu use RTL; technical IDs, email addresses and numbers keep isolated readable direction.

Publish the exact supplied notice language and visibly identify any deliberate fallback. Platform identity/logging fragments are versioned localized facts, not a browser-generated legal translation. Preview mobile, keyboard navigation and mixed-direction content before sharing.

Use the same useful workflow in the isolated demo#

Demo feedback uses the same local design, publication, public submission, permission and privacy controls under its actual lifetime. There are no real providers, invitations, messages or source integrations in this release.

Synchronous expiry stops access and genuine isolated purge removes all eight Surveys tables, including cyclic references and private capability material. A demo pause or extension request never bypasses actual platform expiry/purge.