Asks let your organization put questions to people outside it through a link. An organization admin turns them on in Settings → Organization → Asks, after confirming that your organization has completed its privacy impact assessment and accepts crewkit's data processing agreement. This page gives the facts that assessment needs.
What is collected
- The answers a Respondent gives, every revision of them, and the language they chose.
- The name they give, which may be any name they choose.
- A hashed network address: an HMAC under a dedicated key, never the raw address, deleted after 30 days. It limits abuse (rate limits, reports).
- A token in the Respondent's browser, on
asks.crewkit.ioonly, so the same browser can return to its own Response.
Nothing is recorded when a page is only opened: no view counts, no first-seen stamps.
Purposes
Your organization uses the answers to make decisions in its projects. Answers a person in your organization confirms reach your AI agent sessions, and enter session records kept under your organization's session retention.
Where it goes
| Service provider | Role |
|---|---|
| Vercel | Serves the static asks page. It never sees a token, a question or an answer. |
| DigitalOcean | Hosts crewkit's API and database, where Responses are stored. |
| Anthropic | Sessions that read confirmed answers are summarized and analyzed under your session settings. |
| Voyage AI | Sessions that read confirmed answers are vectorized under your session settings. |
Information may be communicated outside Québec. The notice every Respondent sees names all four providers, whatever your session settings are.
The notice Respondents see
Every Ask page shows a fixed notice in English and French: the purposes, the means, the rights of access, correction and withdrawal, the service providers above, possible communication outside Québec, your privacy officer's title and contact, and a link to your privacy policy. The page also shows your organization's name and says it is hosted by crewkit, which never asks for passwords or payment. With a verified domain it shows that domain and your logo; without one it marks your organization as unverified and, when the publisher's proven address is under one of your domains, names that domain (never the address).
Rights
A Respondent keeps a private link to their Response. Through it they can read it, download it as JSON, change it while the Ask is open, and erase it at any time, even after the Ask closes or your organization turns Asks off. They can also write to your privacy officer.
Retention and erasure
- Responses are deleted when your organization's retention period (default 180 days) has passed since the Ask closed.
- Turning Asks off or moving to data residency closes every open Ask at once, which starts that period. Losing the verified domain closes nothing: the page is marked unverified and the logo is hidden.
- An erasure reaches every revision of the Response and every confirmed copy of it. Copies already in captured session transcripts follow session retention.
- A Respondent who answered as their crewkit account and later deletes that account keeps their Responses with your organization, without their name: the name shows as "Deleted account", and the account's name and email address, matched exactly as the account held them, are replaced in the answers, their revisions and every confirmed copy. Copies already read into your AI sessions follow session retention, and the answers can still identify the person by what they say. Their private link still lets them correct or erase the Response.
Who cannot use Asks
Organizations with data residency: resident data never reaches a public page.