Skip to main content
Orbit records two things about how a contact found you:
  • Source, on every contact, from their form submissions and bookings. Always on.
  • Website visits, the pages they view on your own site after they’ve identified themselves. Off until an admin turns it on.

​
Contact source

Every form submission and booking is a touch. From them Orbit keeps, on the contact: The source is worked out from, in order: an ad click id on the landing page (gclid, msclkid, fbclid, ttclid, li_fat_id and similar mark it as paid; the id itself is never stored), the UTM parameters, then the site that sent the visitor (search engines, social networks, AI assistants and webmail are recognised). Nothing at all means Direct traffic. All of these show in the Source card on the contact’s page and can be used as filters on the Contacts list and in saved views (Original source, Latest source, First UTM campaign, and so on). Through the API they are filter keys too: originalSource, originalSourceDetail, latestSource, firstUtmSource, firstUtmMedium, firstUtmCampaign, latestUtmSource, latestUtmMedium, latestUtmCampaign.
Contacts imported, created by hand or through the API have no source until they submit a form or book a meeting. Forms embedded with the plain <iframe> code can’t see what sent the visitor to your page; use the embed.js code for the full source.

​
Website visits

With website tracking on, each contact’s timeline shows their visits to your site: one item per visit (a visit ends after 30 minutes without a page view), with the pages they viewed and when. Last website visit and Website visits are filters on the Contacts list.

​
How visitors are identified

Orbit only records visits of people who have identified themselves, in one of three ways:
  1. They submit one of your forms embedded on your site.
  2. They book a meeting through a booking page embedded on your site.
  3. They click a link to your site in an email you sent from Orbit (a one-to-one email or a sequence). Links to your tracked domains carry a short _ovt token that names the contact; embed.js removes it from the address bar as soon as the page loads.
Before that, page views stay in the visitor’s own browser (at most 50, for at most 30 days) and are never sent to Orbit. When the visitor identifies, those buffered views are sent with the first identified one, so the timeline shows how they got there. A visitor who never identifies never reaches Orbit.

​
Turn it on

1

Open Settings → Website Tracking

Only workspace admins can change it.
2

Add your website's domains

Only pages on these domains and their subdomains are recorded. acme.com covers www.acme.com and blog.acme.com.
3

Choose the consent mode

Wait for consent (the default) records nothing until your site calls OrbitForms.tracking.consent(true). Track unless the visitor opts out records from the first page view.
4

Add the snippet to every page

Settings shows the snippet with your workspace id. If the page already loads embed.js for a form or booking page, add data-orbit-track="…" to that tag instead of adding a second one. If your site sends a Content Security Policy, allow https://orbitforms.ai in script-src and connect-src.
5

Turn on Track website visits and save

Sites pick up the change within five minutes.
Call these from your cookie banner or consent manager:
If your consent manager runs before embed.js loads, set window.orbitTrackingConsent = true (or false) instead. Whatever the mode, Orbit never tracks a browser that sends Do Not Track or Global Privacy Control.

​
What Orbit stores

Orbit keeps the visitor id in localStorage rather than a cookie (consent rules for cookies apply to it all the same), does not fingerprint browsers, does not store IP addresses with visits, and never records query strings, form fields or anything typed on your pages. Visits are stored only for the domains you listed, and only for contacts. Permanently deleting a contact deletes its visits and source. Merging two contacts keeps both contacts’ visits and the earlier original source. A browser that identifies as a different person later (a shared computer) is re-assigned to the new contact from then on; earlier visits stay with the first.

​
Your privacy notice

Because website tracking records personal data about your visitors, describe it in your privacy notice. A starting point (have your counsel review it):
We use Orbit to manage our sales relationships. When you submit a form, book a meeting or click a link in an email from us, and you have allowed it, Orbit records the pages of our website you visit and when, and links them to your contact record so our team can follow up in context. Orbit does not record visits from browsers that send Do Not Track or Global Privacy Control signals, and does not use fingerprinting. You can withdraw your consent at any time through our cookie settings.

​
Turning it off

Turn off Track website visits in Settings. Within five minutes, embed.js stops recording and Orbit stops accepting page views. Visits already recorded stay on the timeline.