Anonymous Feedback with a QR Code: Privacy, Contact and Consent

Promise contact-free feedback, not invisible activity

When a form does not ask for a name, email or phone number, the business cannot identify the respondent from a contact field. That is often what customers need in order to answer honestly.

The response is not context-free. Campaign and placement identifiers, submission time, locale, score and structured answers remain useful for reporting and operations. Avoid claiming that no metadata exists or that re-identification is impossible in every situation.

Design the form so contact is genuinely optional

Begin with the score or experience question and add a short reason. Remove the contact block when follow-up is not part of the programme, or leave it optional when some customers may want a reply.

Do not make contact details the price of submitting criticism. A CSAT or NPS response can remain useful through its placement, time and structured answers even when no person is identified.

• One primary score or pulse question
• One optional reason or comment
• Optional contact block only when a team can respond
• No personal identifier inside the QR URL or placement name

Separate contact details from consent to follow up

Leaving an email address is not the same act as agreeing to be contacted about the feedback. Mosaqo records follow-up consent separately so the inbox can distinguish contact supplied with consent from contact supplied without it.

Only follow up when the customer consented and the organisation has an appropriate lawful process. The product does not send an automatic customer email or SMS; the team uses its own approved channel.

Understand what the workspace can see

An anonymous response can still show the campaign, placement, location context, submission time, form version, score and answers. That is enough to compare a receipt with a counter, or detect repeated delivery complaints, without requiring a customer identity.

When contact is provided, it is encrypted and access is restricted by workspace role. Contact values are not added to ordinary CSV exports or low-score webhooks by default.

Reduce accidental identification in questions and operations

Free text can reveal a name, order number, medical detail or a uniquely identifiable event even when the form has no contact field. Ask for only the detail needed to improve the experience and tell respondents not to include sensitive information.

Small teams and narrow time windows can also make a response inferable from context. Broaden reporting windows where appropriate, restrict inbox access and avoid placing personal identifiers in campaign or placement metadata.

Use retention to minimise raw data over time

Workspace retention can be set to 90, 180 or 365 days. After the selected period, Mosaqo removes raw answers and contact information and marks the response anonymised while preserving score, date and placement context needed for historical aggregates.

Retention is not a substitute for a privacy notice, access control or a lawful data policy. Choose the shortest period that supports the programme and document who can read and export responses.

Choose between anonymous insight and consented recovery

Use contact-free feedback when the goal is pattern detection, experience measurement or a safer channel for candid comments. Enable optional contact when the business can resolve an individual issue and has an owner for follow-up.

An anonymous low score can trigger operational learning, but the team cannot reply to a person it cannot identify. Make that trade-off explicit in the form design instead of promising both complete anonymity and individual recovery.