Data & tracking

What the script does

The script runs on our customers’ websites. We remember an anonymous visitor for up to 90 days, so an AI discovery can be connected to a later enquiry or purchase. When a visit starts, it records where the visitor came from. When the visitor submits a form, it passes the details they typed along with that source, so the business can see which channels (including AI assistants) bring in real customers.

What it collects

Item	When	Why
Random visitor ID and visit ID	Every visit	Links a later form submission to the visit that brought the person in
Referring website (its address only, never the full link) and landing page path	Start of each visit	Tells us whether the visit came from an AI tool, a search engine, social media and so on
Campaign tags utm_source, utm_medium, utm_campaign, and whether an ad click ID (such as gclid) was present, never its value	Start of each visit, if the link had them	Separates ads and campaigns from other traffic
Pages viewed (path and title, never anything after “?” or “#”)	Each page load	Shows the business which pages a visitor read before getting in touch
Phone or computer, and active time on the site	During each visit	Basic reporting
Name, email, phone	Only when the visitor sends a contact or quote form	Matches the enquiry to the lead in the business’s own records
“How did you hear about us?” answer	Only when the visitor submits a form	Captures customers who found the business through AI but arrived another way
Clicks on phone, email, WhatsApp, text and booking links	When clicked	Counts website visitors who chose to get in touch
Order or booking value and ID	Only on a confirmation page where the business added it	Ties online sales to where the customer came from

Which forms and fields it reads

Only contact and quote forms, and from them only the visitor’s own name, email and phone. The script decides by what the visitor is shown, not just by how a field is named in the page’s code.

Fields. A field is read only when its type or name says it is a name, email or phone and its visible label agrees (its label, placeholder or the short text beside it). So a phone-type box labelled “One-time code”, or a box labelled “Project name” or “Company name”, is not read. Someone else’s details (“Friend’s email”, “Emergency phone”) are not read either, and the value must look like a name, email or phone number. The script never reads message boxes or other free text, hidden fields, passwords, codes, or any sign-in, payment or card field.

Forms. A form is read only when all of these are true: it has no password, code, sign-in or payment field and isn’t a search box; nothing it displays (its heading, the text in it, its buttons) says it is for signing in, registering, subscribing, checking out, paying, commenting or downloading; it has an email or phone field plus a name, phone or message field; and something it displays says it is for contact or a quote, such as “Contact us”, “Get a quote”, “Book” or a box labelled “Message”. A form that shows no such purpose is left alone, whatever it is named. Forms that aren’t read are never changed either. Businesses can exclude any form by adding data-was-ignore to it, or mark a contact form the script didn’t recognise with data-was-form="lead" (this never overrides the sign-in and payment rule).

The script doesn’t record keystrokes or screen activity, doesn’t store IP addresses, and doesn’t set advertising cookies.

On Webflow sites

Webflow sites get their own script (https://whichaisent.com/wf/t-1.5.0.js), added by our Webflow app through Webflow’s Custom Code API. It works differently from the rules above in these ways:

• It reads only the forms the site owner chose in the Which AI Sent dashboard, from the list Webflow’s Forms API gives us, and, in them, only the fields the owner picked as name, email, phone or “how did you hear”. A form is recognised only by Webflow’s own IDs for it (its element ID and page ID, which Webflow publishes on the form); never by its name, so a different form with the same name is never read. It never guesses: every other form and field is ignored.
• Sign-in and account forms are never read, even if chosen. Before anything in a chosen form is read, the script skips the whole form if any field is, or is shown as, a password, username, sign-in, verification-code or payment field; if it is a Webflow user-account form; if its name, heading, button, labels or messages speak of signing in or up, logging in, sign-in links, registering, accounts, passwords or verification codes; if it has fewer than two boxes to type into (an email or phone box on its own is how sign-in links and codes are requested); or if it is a search box.
• Consent is decided before it starts. It first loads the site’s settings (consent required or not, the optional question, the forms and fields the owner chose, and whether tracking is stopped: one request with the site key and nothing about the visitor, never stored). Nothing else happens until consent allows it: the site’s own ['consent', true|false] command (its latest command counts, even while the settings are loading) and a recognised banner (Finsweet Cookie Consent, Cookiebot, CookieYes, OneTrust, Complianz, Google consent mode). A “no” from either always wins. Browsers that send Global Privacy Control are never measured.
• Withdrawal stops everything on the page at once: the script removes its listeners and page observer, removes the optional question it added, deletes its cookie and local storage, and never reads, sends, stores or changes anything again on that page.
• Stopping tracking takes effect at once: when the owner stops tracking (or uninstalls the app), the copy still on their published site loads only the settings, sees tracking is stopped, deletes its cookie and local storage and does nothing else, until the next publish removes it.

It doesn’t use the WhatsApp reference code, the order-value command, hidden form fields or the business-details block described on this page.

Optional: WhatsApp reference code

Off unless the business turns it on. When a visitor taps a WhatsApp link, the script adds a short random code to the prefilled message (for example “Hi! (Ref: WAS-7K2QF)”) and records that code with the click. The visitor sees the message and can edit it before sending. We never see the WhatsApp chat. If the business later types the code into its dashboard, the lead is matched to that visit. Not available on Webflow sites.

Business details we add for you (optional)

In the dashboard’s Business details for AI tool, you can ask us to add your business details to your home page for you. This is off unless you switch it on. When it’s on, our script adds one block of structured data (schema) to your home page, built only from what you typed in the tool: business name, address, phone, opening hours, areas served and links to your profiles. It contains nothing about your visitors, and it changes nothing a visitor can see. If your page already has its own business details, we leave it alone. You can remove it in one click. We don’t do this on Webflow or Shopify sites: there you paste the code in yourself.

Site audit

When a business clicks Run audit in its dashboard, our server opens that business’s own public pages (the home page and up to 8 more, plus robots.txt, sitemap.xml and llms.txt), the same way a search engine would, and scores them. It also opens the home page once as each of four AI assistants’ crawlers (ChatGPT search, ChatGPT, Perplexity, Claude) to see whether a firewall turns them away. It reads nothing behind a login and collects nothing about visitors. Only the scores and the list of checks are saved.

Cookies and storage

Name	Type	Lasts	Purpose
_ta_vid	First-party cookie	90 days from the last visit	Random visitor ID
_ta	Local storage	Reset after 90 days without a visit	Visitor and visit IDs, the time of the last page view, and the current visit’s source: the referring site, campaign tags, and whether an ad click ID was present (stored as “1” or its name, never its value). Outside Webflow it also keeps the first and latest traffic source.
_ta_conv	Local storage	Until cleared	Order IDs already counted, so a refreshed confirmation page isn’t counted twice. Not used on Webflow.
_ta_optout	Local storage	Until cleared	Set only when the site owner opens their own site with the “Don’t count my visits” link, so their own browser is skipped

Retention

Data is kept while the business uses Which AI Sent, and deleted within 90 days after they stop, or sooner if they ask.

Opting out

Visitors can clear cookies and site data for the website. Businesses can turn on support for the Global Privacy Control signal by adding data-respect-gpc="1" to the script tag. The script then does nothing for visitors whose browser sends that signal. On Webflow sites this is always on.

Wording for your privacy policy

If you use Which AI Sent, your privacy policy should mention it. You can adapt this:

This wording is a starting point, not legal advice. If you operate in a place with stricter rules on cookies, such as the EU or UK, you may need visitors’ consent before the script runs. Turn on Settings → Cookie consent in your dashboard and the script stores and sends nothing until the visitor accepts analytics cookies in your cookie banner (Cookiebot, CookieYes, OneTrust, Complianz and Google Consent Mode are detected automatically, or your site can call whichaisentQ.push(['consent', true])). If our settings can’t be loaded, the script also waits for consent, and until consent is given it stores nothing at all in the browser. If the visitor withdraws consent, the script stops completely on that page: it sends nothing more, deletes its IDs, saved order numbers and settings from their browser, removes the cookie, writes nothing further into the page, and (where the optional hidden form fields are used) takes its IDs back out of every form. Measuring only starts again on a later page, if the visitor consents again.

Questions

Email info@whichaisent.com. See also our privacy policy.