> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useorbitcrm.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Contact Source, Website Visits & Form Capture

> See where each contact came from, which pages of your website they visit once they've identified themselves, and turn the forms on your own site into contacts with the Orbit Pixel.

Orbit records three things about how a contact found you and what they did on your site:

* **Source**, on every contact, from their form submissions and bookings. Always on.
* **Website visits**, the pages they view on your own site after they've identified themselves. Off until an admin turns it on.
* **Form capture**, the forms on your own site (a contact form built in Webflow, a newsletter box in WordPress, a quote request in your own code) submitted with an email address, as contacts and timeline items. Off until an admin turns it on.

Visits and form capture need one small script on your site: the **Orbit Pixel**.

## Contact source

Every form submission and booking is a *touch*. From them Orbit keeps, on the contact:

| Property | What it is |
| - | - |
| **Original source** | The source of their first touch: Organic search, Paid search, Organic social, Paid social, Email marketing, AI referrals, Referrals, Other campaigns or Direct traffic, with a detail such as the search engine, network, site or UTM source |
| **Latest source** | The same, for their most recent touch |
| **First UTM** | `utm_source`, `utm_medium`, `utm_campaign`, `utm_term` and `utm_content` of the first touch that carried UTM parameters |
| **Latest UTM** | The same, for the most recent touch that carried them |
| **Landing page** | The page of your site the first touch happened on |

The source is worked out from, in order: an ad click id on the landing page (`gclid`, `msclkid`, `fbclid`, `ttclid`, `li_fat_id` and similar mark it as paid; the id itself is never stored), the UTM parameters, then the site that sent the visitor (search engines, social networks, AI assistants and webmail are recognised). Nothing at all means **Direct traffic**. A form captured by the pixel is a touch too.

All of these show in the **Source** card on the contact's page and can be used as filters on the Contacts list and in saved views (**Original source**, **Latest source**, **First UTM campaign**, and so on). Through the API they are filter keys too: `originalSource`, `originalSourceDetail`, `latestSource`, `firstUtmSource`, `firstUtmMedium`, `firstUtmCampaign`, `latestUtmSource`, `latestUtmMedium`, `latestUtmCampaign`.

> [!NOTE]
>
> Contacts imported, created by hand or through the API have no source until they submit a form (including the form step of a Lead Capture + Schedule booking page, whether or not they go on to pick a time) or book a meeting. Forms embedded with the plain `<iframe>` code can't see what sent the visitor to your page; use the `embed.js` code for the full source.

## Install the Orbit Pixel

**1. Open Settings → Website Tracking**

Only workspace admins can change it.

**2. Add your website's domains and save**

Only pages on these domains and their subdomains are tracked, and only forms on them are captured. `acme.com` covers `www.acme.com` and `blog.acme.com`.

**3. Verify each domain is yours**

Nothing is tracked on a domain until your workspace has proved it controls it, so that a pixel tag placed on someone else's site can never bring that site's visitors or forms into your workspace. Click **Verify** next to the domain and do one of:

* add a DNS `TXT` record at `_orbit.acme.com` (or at `acme.com` itself) with the value shown, `orbit-site-verification=…`;
* or put the `<meta name="orbit-site-verification" content="…">` tag shown in the `<head>` of `https://acme.com/`.

Then click **Check now**. The value is the same for every domain of your workspace. DNS changes can take a few minutes to show.

**4. Add the snippet to every page**

```html theme={null}
<script src="https://orbit-serve.com/pixel.js" data-orbit-track="YOUR_WORKSPACE_ID" async crossorigin="anonymous"></script>
```

Settings shows the snippet with your workspace id. The pixel is a few kilobytes, loads in the background and never blocks the page. It is served from `orbit-serve.com`, a host that carries nothing else of Orbit (no app, no sign-in, no cookies), so if your site sends a Content Security Policy you allow just `https://orbit-serve.com` in `script-src` and `connect-src`.

Pages that already load `embed.js` with `data-orbit-track="…"` on that tag (the earlier snippet) keep working: `embed.js` loads the pixel for them.

**5. Check it is working**

Open any page of your site in a browser, then look at **Is it working?** under the snippet in Settings: it shows when the pixel last loaded and from which hostname ("last seen 2 minutes ago on [www.acme.com](http://www.acme.com)"). Orbit notes this every time the pixel loads on a domain in your list, even while visits and form capture are still off, so you can confirm the install before turning anything on. The pixel asks for its settings once per page load and the answer is cached for five minutes, so allow a few minutes and click **Refresh**.

**Check this page** reads a page of your site over HTTPS (up to 1 MB of it) and tells you whether the snippet is in its HTML, for this workspace, for another workspace, or missing. It sees only what your server sends: a tag added by a tag manager or another script does not show up there, so for those rely on the last-seen line.

**6. Turn on what you want and save**

**Track website visits**, **Capture forms on your site**, or both; both need at least one verified domain. Sites pick up the change within five minutes.

The pixel asks Orbit once per page load what your workspace turned on (a small, cached request), then does only that.

### What the pixel will never do to your site

The pixel is written so that your page always comes first:

* It loads in the background (`async`) and never blocks rendering. If it cannot load (Orbit is unreachable, a content blocker, a strict Content Security Policy), nothing happens on the page.
* It never throws an error into your page: its whole body, every timer, every event listener and every public function run inside their own error guards, and a browser that lacks something it needs (storage, `fetch`, secure random numbers) simply gets no tracking.
* It never writes to your page: no elements added or changed, no styles, no cookies read or set. Its only storage is two `localStorage` keys on your site: one holds a random visitor id and the page views not yet sent (at most 50, for at most 30 days), the other the consent choice.
* It never stops, delays or changes a form submission. It watches the browser's `submit` event in the capture phase and reads field values; it never calls `preventDefault`, `submit()`, `checkValidity()` or anything else that fires events on your fields or changes what your own code sees.
* It talks only to the origin it was loaded from, over HTTPS, with simple requests that carry no cookies. Orbit's answer is read as data (a few booleans and a list of form keys); it can turn the pixel off, never make it do anything new. If Orbit is down, requests fail silently and nothing is retried in a loop.
* It runs no code from your page or from the server, and runs only once per page even if the tag is included twice.

These rules are checked by automated tests on every change to the pixel.

## Website visits

With website tracking on, each contact's timeline shows their visits to your site: one item per visit (a visit ends after 30 minutes without a page view), with the pages they viewed and when. **Last website visit** and **Website visits** are filters on the Contacts list.

### How visitors are identified

Orbit only records visits of people who have identified themselves, in one of four ways:

1. They submit one of your Orbit forms embedded on your site.
2. They book a meeting through a booking page embedded on your site.
3. They submit one of your own forms that the pixel captured (see below).
4. They click a link to your site in an email you sent from Orbit (a one-to-one email or a sequence). Links to your tracked domains carry a short `_ovt` token that names the contact; the pixel removes it from the address bar as soon as the page loads.

Before that, page views stay in the visitor's own browser (at most 50, for at most 30 days) and are never sent to Orbit. When the visitor identifies, those buffered views are sent with the first identified one, so the timeline shows how they got there. A visitor who never identifies never reaches Orbit.

### Consent

Pick a consent mode in Settings. **Wait for consent** (the default) records nothing until your site calls `OrbitPixel.consent(true)`. **Track unless the visitor opts out** records from the first page view. Call these from your cookie banner or consent manager:

```js theme={null}
window.OrbitPixel && OrbitPixel.consent(true)   // the visitor accepted
window.OrbitPixel && OrbitPixel.consent(false)  // the visitor declined: clears the visitor id and buffered views
window.OrbitPixel && OrbitPixel.reset()         // forget the stored choice and everything stored
```

Keep the `window.OrbitPixel &&` guard: a content blocker may keep the pixel from loading, and your banner must not fail because of it. If your consent manager runs before the pixel loads, set `window.orbitTrackingConsent = true` (or `false`) instead. `OrbitForms.tracking.consent()` from the earlier snippet still works and needs no guard.

Whatever the mode, Orbit never tracks a browser that sends **Do Not Track** or **Global Privacy Control**.

## Form capture

With form capture on, the pixel watches for forms being submitted on your pages. When a submitted form contains an email address, the pixel sends the form's fields to Orbit, which:

* creates the contact, or fills in the blanks on an existing one (name, phone, company and job title are read from the fields; nothing already on the contact is overwritten), as a submission of an Orbit form would, including the blocklist of permanently deleted addresses. One difference: a contact in **Recently deleted** stays there (an Orbit form submission brings them back; a captured form can be forged by anyone who knows the address);
* shows the submission on the contact's timeline, with every captured field, under the **Forms** filter;
* records it as a touch for the contact's source;
* ties the browser to the contact when website tracking is on, so the pages they viewed before submitting land on the timeline too;
* fires the usual **Contact created** and **Contact updated** events for webhooks and workflows (a **Record Created** trigger on contacts runs for a new one).

### What the pixel captures, and what it never does

| Captured | Never captured |
| - | - |
| Text, email, phone, number, URL and date inputs; textareas; selected options of a select; checked checkboxes and radios | Password, hidden, file and button fields |
| The field's name, its label (or placeholder) and its value, each capped (values at 500 characters, at most 40 fields) | Fields whose name, label or `autocomplete` points at a password, a card number, expiry or security code, a one-time code, an API or access key, a social security, national insurance or other government id number, a passport, a licence, a bank account, a PIN, a date of birth, a security question, a captcha or an anti-forgery token; read-only fields |
| The page the form was on (address without the query string, and with token-like path segments such as a magic link replaced by `~`), what sent the visitor there, and UTM parameters | Any value that is a card number or a social security number, whatever the field is called; an email field meant for someone else (a referral, an invitation) is never taken as the submitter's address |
| | Any form with a password field (a sign-in or sign-up form) or a payment field (a checkout), anything marked `data-orbit-ignore` (a form, a field, or a container around them), and any form you turned off in Settings |

A form without a well-formed email address is never sent. A form the browser would refuse to submit (a required field empty, a malformed email) is not sent either. Orbit applies the same filters again when the submission arrives, and answers every request the same way, so nothing about your contacts can be learned from the endpoint. Nothing typed into a form is ever kept in the visitor's browser by the pixel.

Submitted forms are captured whatever the visitor's cookie choice, like the form itself is: a person filling in your contact form is giving you their details. Their page views still follow the consent rules above, and without consent the submission carries no visitor id.

### Forms the pixel has seen

Settings → Website Tracking lists every form the pixel has captured: its name (the form's `data-orbit-form-name`, `aria-label`, `name` or `id`, else the page title), the page it was first seen on, its fields and how many submissions it brought. Turn off any form that should not create contacts, such as a support form for existing customers; the pixel skips it within five minutes and Orbit refuses it straight away. Remove a form to clear it from the list (its submissions stay on the timelines); it comes back, on, if it is submitted again.

### Forms submitted from script

A form that posts with `fetch` (a React form, a multi-step flow) still fires the browser's `submit` event when the visitor presses the button or Enter, so it is captured like any other. A form your code submits without that event can be captured by hand, and a visitor you already know (after sign-in or checkout) can be identified:

```js theme={null}
window.OrbitPixel && OrbitPixel.capture(document.querySelector('#quote-form'))
window.OrbitPixel && OrbitPixel.identify({ email: 'ann@example.com', first_name: 'Ann', company: 'Acme' })
```

`identify()` takes `email` (required), `first_name`, `last_name`, `name`, `phone`, `company` and `job_title`, and shows on the timeline as **Identified on your website**.

### Limits

The capture endpoint is public, and the check that a request comes from your site is not an authentication, so Orbit bounds what anyone can do with it: at most 2,000 stored submissions per workspace per day, 20 per contact per day and 10 per email address per hour; at most 200 distinct forms per workspace; a browser is tied to a contact at most 5 times a day. The same submission sent twice within two minutes (a double click, a retried handler) counts once, and a request that is refused or deduped counts against nothing; only stored submissions do, so junk that gets through does use the quota, which is why the forms list lets you turn a form off the moment you see it. Treat captured values as what they are, something a visitor typed: Orbit shows them as such to your team and to its AI.

## What Orbit stores

| Where | What | How long |
| - | - | - |
| The visitor's browser (`localStorage` on your site) | A random visitor id, their consent choice, and up to 50 page views not yet sent | Views: 30 days. Id and choice: until cleared or `consent(false)` |
| Orbit, for website visits | For each identified browser: which contact it belongs to. For each visit: start and end time, the pages (address without the query string and with token-like path segments replaced by `~`, page title, time; at most 50 per visit), the referring site and the visit's UTM source, medium and campaign | Until the contact is permanently deleted |
| Orbit, for captured forms | For each submission: the contact, the form's name and page, the captured fields (name, label, value) and the time. For each form seen: its name, page, field names and counts | Until the contact is permanently deleted (submissions); until the workspace is deleted (the list of forms) |

Orbit keeps the visitor id in `localStorage` rather than a cookie (consent rules for cookies apply to it all the same), does not fingerprint browsers, does not store IP addresses with visits or submissions, and never records query strings or anything typed on your pages outside a submitted form. Visits and forms are stored only for the domains you listed. Permanently deleting a contact deletes its visits, submissions and source. Merging two contacts keeps both contacts' visits and submissions and the earlier original source.

A browser that identifies as a different person later (a shared computer) is re-assigned to the new contact from then on; earlier visits stay with the first.

## Your privacy notice

Because the pixel records personal data about your visitors, describe it in your privacy notice. A starting point (have your counsel review it):

> We use Orbit to manage our sales relationships. When you submit a form on our website, book a meeting or click a link in an email from us, Orbit records what you submitted and, where you have allowed it, the pages of our website you visit and when, and links them to your contact record so our team can follow up in context. Orbit does not record visits from browsers that send Do Not Track or Global Privacy Control signals, and does not use fingerprinting. You can withdraw your consent at any time through our cookie settings.

## Turning it off

Turn off **Track website visits** or **Capture forms on your site** in Settings. Within five minutes the pixel stops, and Orbit stops accepting page views and submissions straight away. Visits and submissions already recorded stay on the timeline. Removing a domain from the list also removes its verification; add it back and verify it again to track it later.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.