On this page
All policies
What the tracking script collects
The HeyLead script runs on our customers' websites. On each page view it sends the page address and title, the referring website, UTM tags and ad click IDs, the device type and screen width, and a random visitor and visit ID.
When a visitor submits a form, it sends the form's answers so the website owner can see where the lead came from. It never reads password, payment card or file-upload fields.
Our servers work out the visitor's country from the IP address while handling the request. The IP address itself is not stored.
Cookies and local storage it uses
All storage is first-party: it lives on the customer's own domain, is only readable by that website, and is never used to follow people across other websites.
| Name | Purpose | Kept for |
|---|---|---|
_lo_vid | Random visitor ID, so return visits join the same journey | 13 months |
_lo_visit | ID of the current visit | 1 day |
_lo_seen | Time of the last page view, to know when a new visit starts | 1 day |
_lo_touch | First and last marketing source, used to fill hidden form fields | 13 months |
_lo_consent | Remembers that the visitor accepted (consent mode only) | 6 months |
_lo_debug | Turns on debug logging (local storage, only if added to the address) | Until removed |
Consent mode for cookie banners
Website owners who need consent before analytics can turn on consent mode. The script then stores nothing and sends nothing until the visitor accepts.
- Add
data-consent="required"to the HeyLead script tag. - When the visitor accepts your banner, call
HeyLead.consent(). If your banner runs before our script has loaded, setwindow.heyLeadConsent = trueinstead. - To withdraw consent, call
HeyLead.consent(false). This stops tracking and removes HeyLead's cookies and local storage. - In consent mode, browsers that send a Global Privacy Control signal are not tracked unless the visitor explicitly accepts.
Without consent mode, the script starts straight away. Make sure your privacy notice mentions attribution tracking and that this fits the rules where your visitors live.
Cookies on heylead.io and the dashboard
Our marketing website uses Google Analytics to count visits and see which pages and sources bring people to heylead.io. We don't use advertising cookies, and Google Analytics doesn't run inside the dashboard.
| Name | Purpose | Kept for |
|---|---|---|
_ga | Google Analytics: tells visits from different browsers apart | 2 years |
_ga_<ID> | Google Analytics: keeps track of the current visit | 2 years |
You can block these with your browser settings or Google's opt-out add-on without affecting the site. When you sign in to the dashboard we set essential cookies:
| Name | Purpose | Kept for |
|---|---|---|
better-auth.session_token | Keeps you signed in (secure, HttpOnly) | 30 days, renewed while you use the app |
better-auth.session_data | Short-lived cache of your session to keep pages fast | 5 minutes |
On secure connections these names start with __Secure-. The dashboard also remembers small preferences, such as the selected website and date range, in your browser's local storage. Blocking these may sign you out or reset your choices.
Questions
Email hello@heylead.io. We reply within one business day.