The decision, first

Answer up front; the reasoning follows.

Why not simpler? Two options look tempting and are traps. Auto-opening a modal (OPT-5) converts best but interrupts hardest and, gated to passers, never hears the unhappy candidates whose feedback we most need. Redirecting to Senja's own form (OPT-2) is an hour of work but bypasses our database, brands the ask as Senja, and burns the free tier's 15-testimonial lifetime cap in a single busy day. Both are covered below so the trade-off is on the record.

The binding constraint: what Senja's free tier actually allows

Verified against Senja's own pricing page and free-vs-paid help docs, 10 Jul 2026.

Capability	Free tier?	What it means for us
Stored testimonials (text + video)	15 lifetime	The binding limit. No path raises it. Kills "collect from every candidate" on Senja itself.
Write API — POST /testimonials	No · $29/mo	The single blocker for an automated PATH B. Key lives in Senja's paid Automate settings.
Webhooks / Zapier	No · paid	Zapier's own free tier can't help — the Senja side of the connection is gated.
Hosted collection form	Yes · 1 form	Shareable link senja.io/p/<slug>/r/<id> + embeddable. Text and video.
Form prefill via URL	name, email, url only	Rating and custom fields (e.g. task_session_id) cannot be prefilled — no clean way to correlate back to a session.
Display widgets / Wall of Love	Unlimited	But watermarked on free; an embed on utkrusht.ai reads "Powered by Senja".
Consent-to-publish + GDPR	All plans	Built-in consent message; submissions land "unapproved" for review. A genuine upside of using Senja's form.
Custom branding (logo/colours/domain)	No · paid	"Make it look like Utkrushta" needs a paid plan.

So which integration path? Hybrid.

Take the collection-and-storage half of PATH B; bridge to Senja by hand for free.

We already own the pattern to clone. The candidate app has a working private-feedback flow for test sessions — FeedbackModal → /api/testSessions/submitFeedback → a user_feedback JSONB column. It even guards against double-submit and fires confetti. It is simply not wired for task sessions, which have no feedback column at all. That gap is the whole build.

Where the ask can live

The candidate's real path after they click submit. The green stage is the emotional peak.

The six options

Ordered gentlest → most forceful. Each shows a faithful mockup in the real candidate design system.

Why the phased OPT-3 → OPT-4 combo wins

It threads three findings that pull in different directions.

1 · The peak is the right moment, but it must be about the experience. The peak-end rule says ask at the emotional high — here, the relief of finishing. But grading is async, so we can't hook a "great score". OPT-3 asks at the confetti peak and frames strictly around the task and process. Its two-step gate stores every rating, so we also learn from the candidates who struggled — the feedback most worth having, and the segment an auto-modal gated to passers (OPT-5) would never hear. Recruiting's assessment stage carries a famously negative candidate-NPS; hearing the unhappy quietly and privately is how that improves.

2 · Publishing consent belongs after the outcome. Asking an anxious candidate mid-evaluation for permission to use their words publicly is close to coercive — and under GDPR/DPDP a consent obtained under that power imbalance is hard to defend as "freely given". OPT-4 moves the publish opt-in to the report page, after the result is known, where the imbalance has relaxed. That is where OPT-6's two-moment logic pays off without OPT-6's full cost.

3 · The storage design is right regardless of Senja. Every phase writes to our own Supabase — the collection half of PATH B, which we already have the FeedbackModal pattern to clone. Senja stays a manual, free display shelf (or we skip it and build our own Wall of Love with the design system, no watermark). If we ever decide $29/mo is worth automated sync, the schema below already has the columns to flip it on.

Guardrails to hold across every phase

Guardrail	Why
Text default; video strictly optional	We already spent the candidate's on-camera willingness on the mandatory explainer video. Don't double-dip.
No cash incentive	Recognition / LinkedIn-badge only, never conditioned on positivity (FTC rule on reviews).
Ask once	Reuse the !user_feedback single-shot guard the test flow already uses.
Never gate anything	The report, the result, and the candidacy must never sit behind the testimonial.
Repeat the anti-coercion line	"Separate from your evaluation · no effect on your result" everywhere the ask appears.

The exact words

Ready-to-use microcopy, tuned for the evaluative context.

Implementation sketch

Grounded in the existing backend patterns. Design the whole thing now; ship the free half first.

-- dedicated table (write as a migration, don't push). RLS + policies + FK actions per house rules.
CREATE TABLE testimonials (
  testimonial_id   uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  created_at timestamptz DEFAULT now(),  updated_at timestamptz DEFAULT now(),
  -- context, denormalised off the session at write time
  tasksession_id   uuid REFERENCES task_sessions(tasksession_id) ON DELETE SET NULL,
  user_id          uuid REFERENCES users(user_id)               ON DELETE SET NULL,
  position_id      uuid,   source_hashcode text,   -- org-visibility key
  -- content
  rating smallint CHECK (rating BETWEEN 1 AND 5),  quote text NOT NULL,
  author_name text,  author_headline text,
  -- gates
  consent_public  boolean NOT NULL DEFAULT false,
  approval_status text NOT NULL DEFAULT 'PENDING' CHECK (approval_status IN ('PENDING','APPROVED','REJECTED')),
  approved_by uuid,  approved_at timestamptz,
  -- Senja sync bookkeeping (dormant until we ever pay)
  senja_sync_status text NOT NULL DEFAULT 'NONE' CHECK (senja_sync_status IN ('NONE','PENDING','SYNCED','FAILED')),
  senja_id text,  synced_at timestamptz,  sync_error text
);
CREATE UNIQUE INDEX testimonials_tasksession_uidx ON testimonials(tasksession_id);
CREATE INDEX testimonials_moderation_idx ON testimonials(approval_status, senja_sync_status);

Decisions for you

Eight calls to make before implementation — a few change the schema.