SFT Visitor Journeys — customer guide

What happens after you sign up, what you see in your dashboard, and what we keep about your visitors. If something below doesn’t match what you see in the dashboard, the dashboard is right — this guide describes the product as built, but interfaces move faster than documentation.

The second half, For developers, covers the technical details for anyone who manages your website or your Google Ads account. You don’t need it: we do the setup with you.

1. How the setup works

Each website costs €49.90 a month plus VAT, with no setup fee. Your first website starts with a free week: you enter your card when you activate it, and nothing is charged before day 8. You can cancel anytime under Billing › Manage billing, also during the free week, and then you pay nothing.

Once the website is activated, you book a setup session with us. Before it, send us:

• Access to your website, or the contact of the person who manages it. One two-line script goes into every page; on WordPress, Webflow, Wix and Shopify this takes a few minutes.
• Access to your Google Ads account (a read-only invitation is enough), if you run ads. One tracking template at the account level is all that’s needed.
• What counts as an enquiry for you: the buttons and forms that bring you customers — “Book a call”, “Request a quote”, your contact form, a phone number link.

In the session we install the script, name your buttons and forms, connect Google Ads and, if you want, make the tracker unblockable by ad blockers (the proxy, §9). Within a few seconds of the first visit the dashboard fills up. Nothing on your website changes for your visitors, and no cookie is set.

2. Your dashboard

Sign in at the address in your welcome email. You see three tabs:

• Overview — the last 7, 30 or 90 days (or today) in plain numbers: visits, enquiries, Google Ads clicks and how many of those clicks look like bots, each with how much it changed against the period before (green when that’s good news); where your enquiries come from; and the latest enquiries.
• Enquiries — every enquiry, newest first, with where the visitor came from (an ad, a search, a social network, another website, or typed in / bookmarked, with its logo where we know it), the pages they saw on the way (by name, see “Page names” in section 7), and Show every click for the full journey: one line per page, with how much of it they read, how long they stayed, and what they clicked, filled in and sent.
• Contact us — a message to us, answered by email. Use it for anything: “count the booking button as an enquiry too”, “a page changed”, “these ad clicks look strange”.

Your account and billing sit in the menu at the top right. Every Monday morning you also get a short summary email per website.

What an enquiry is

A visitor counts as an enquiry the moment they submit a contact form, book through Calendly, HubSpot, Typeform or Tally, or click a button we named as an enquiry for you. Each visitor counts once per day, however many forms they send. If a form or a button is missing, or one counts that shouldn’t, write to us through Contact us and we change the rule — the change applies to past visits too.

Which companies visited

Visits from a company’s own network, or from a business line that carries the company’s domain, can show the company’s name: “Siemens AG visited your pricing page and enquired”. People at home or on mobile stay anonymous, so only some visits get a name. It’s off until you turn it on, on the Overview (owners and admins), because your privacy notice has to mention it: the card gives you the paragraph to add and a link with which a visitor can opt out. Names show from the moment it’s on, with the company’s website icon where we found one (fetched by our server, never by your visitor’s browser), else its initials. Under Settings and privacy text you hide your own office (and any other company), or turn it off, which also deletes every company name found so far.

Ad clicks that look like bots

The Overview flags Google Ads clicks with strong bot signals: automated browsers, datacenter networks, or many clicks in a short time with no time spent on the page. Nothing is blocked automatically — a shared office network or a mobile carrier can look similar. When the numbers are high, press Contact us about it and we review the IP addresses with you and exclude them in Google Ads.

3. Data and privacy

We keep only what the product needs, for as short a time as it needs it:

• IP addresses and browser user-agent strings are deleted after 60 days. This happens automatically, on a schedule.
• All other visit data (page views, clicks, journeys) is deleted after 180 days.
• We never store form field values, names, email addresses or cookies. An enquiry carries only which form or button it was and an optional short label.
• A visitor is identified only by a pseudonymous daily id, recomputed from a salt that itself is deleted at the end of each day. Once that salt is gone, the id can’t be traced back to an IP address any more — except during the 60-day window above, where the raw IP is still kept alongside it for fraud review.
• Company names (when you turn that on) are deleted after 180 days, with the visit. They are looked up on our own server, from a licensed IP database and the address’s public reverse DNS name; no visitor address leaves it for this.
• Backups mean deleted data can take a little longer to fully disappear from every copy we hold — up to roughly two more weeks after the 60/180-day deletion above, because that’s how long our own backups are retained.

You (not us) are the data controller for your visitors’ data under GDPR — we process it on your behalf, as your processor, under a Data Processing Agreement. Our Data Processing Agreement and sub-processor list are published on our website; contact us if you’d like suggested wording for your own site’s privacy policy. None of this is legal advice — please have your own lawyer review it before you rely on it, especially the question of whether your cookie banner needs to mention us at all for the cookieless, non-consent-gated counting this product does by default.

Your account and your data

Everything is on the Account page (the menu at the top right):

• Email address — enter the new one. We send a link to your current address to confirm the change, then one to the new address; you sign in with the new address once you’ve opened both.
• Two-factor login (optional) — after your password, also ask for a 6-digit code from an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, 1Password and the like). Turning it on asks for your password, then shows a QR code to scan and ten backup codes, then a first code from the app. Save the backup codes somewhere safe, such as a password manager: each one signs you in once if you lose your phone, and they are shown only this once. Turning it off needs your password. Lost your phone and every backup code? Write to office@smoothflowtech.com from your account’s email address; once we’ve confirmed it’s you, we turn two-factor login off so you can sign in with your password and set it up again.
• Signed-in devices — sign out of every device except the one you’re using.
• Your data — download everything we hold for a website as CSV files: every recorded visit event (visitor IP addresses included while they’re younger than 60 days), the Google Ads clicks, and the enquiry rules.
• Delete workspace (owners) — deletes the workspace with all its websites and their recorded data, once no website is billed any more. Backups keep it for up to two more weeks, as described above.
• Delete account — deletes your sign-in. If you own a workspace, delete it first.

To delete a single website and keep the rest, write to us through Contact us.

Cancelling the subscription is done in Billing › Manage billing (the payment portal); it takes effect at the end of the paid month.

4. Getting help

If anything here doesn’t match what you see, or a step doesn’t work the way this guide describes, use Contact us in the dashboard or write to office@smoothflowtech.com — with your website name and, if you can, a screenshot. We’d rather hear about a confusing step from you than guess at it ourselves.

---

For developers

Everything below is what we do in the setup session. The pages it refers to (Setup, Enquiry rules, Website settings, Journeys, Bot clicks) are the expert view of the dashboard, which we use with you during the session.

5. The tracking snippet

Setup › Tracker shows two lines to paste once, in the <head> of every page you want tracked (before any other script that might call sft(...) — the tracker loads async, so the stub on the first line needs to be defined first):

<script>window.sft=window.sft||function(){(sft.q=sft.q||[]).push(arguments)}</script>
<script async src="https://www.your-domain.com/s.js" data-site="pk_…" data-consent="…"></script>

• The first line is a tiny stub. Anything you call before the real script has loaded is queued and replayed automatically once it has.
• data-site is the website’s public key — already filled in.
• data-consent reflects the consent mode chosen under Website settings (§6) — already filled in too. Never edit this line by hand.

The Tracker page polls for the first page view and shows a plain “we’re receiving data” confirmation once it arrives. It also has step-by-step guides, with a video each, for WordPress, Webflow, Wix, Shopify and custom websites.

If your website already uses Google Tag Manager, owners and admins can instead click Connect Google Tag Manager there and pick the container: the app adds the snippet as a tag in its own workspace (“SFT Visitor Journeys”) and publishes just that change — your unpublished work in other workspaces isn’t touched. Publishing needs a Tag Manager user who may publish; otherwise the tag waits there for your Tag Manager admin. Disconnecting removes the tag again.

Owners and admins can also connect their website platform there instead of pasting anything. Shopify: approve our app; then one click on Turn it on in your theme and Save in the theme editor (checkout pages aren’t tracked). Wix: install our app; the tracker is on every page of your published site right away. If you use Wix’s cookie banner, Wix starts it only once a visitor accepts analytics. Webflow: allow access and pick the site; the tracker goes into the site’s custom code (a paid site plan is needed) and is live with your next publish, which also publishes your other unpublished changes. In each case the shop’s or site’s address must be one of the website’s domains (Website settings).

Nothing about this script sets cookies. It reads no form field values, no contenteditable text and no password fields.

6. Consent mode

In Website settings, pick the option that matches the cookie banner, if there is one:

If the website uses…	Choose
No cookie banner, and the customer’s own legal advice says none is needed	Not required
Cookiebot	Cookiebot
Complianz	Complianz
CookieYes	CookieYes
Borlabs Cookie	Borlabs
Usercentrics	Usercentrics
A different consent tool, or the website’s own code controls it	API
Not decided yet	Off

Whatever is picked only ever controls one thing: whether a visitor who returns gets recognised as the same visitor across visits (a persistent id, kept for up to 180 days, deleted the moment consent is withdrawn). Day-to-day counting — page views, clicks, forms, journeys within a single day — runs every time, for every visitor, with no cookie and no persistent id at all. Once a consent mode is saved, the snippet on the Tracker page updates itself.

7. Enquiry rules

A visitor-day counts as an enquiry the moment any of these happens. Most of it is automatic:

• A contact-style form is submitted. Any native HTML form with an email or phone field (or a field named something like email or phone) counts automatically. Use the visual labeler to mark a form “Never an enquiry” if this rule catches something that isn’t one — a newsletter signup, or a search box that asks for a phone number.
• A popular embedded form is used. Calendly, HubSpot forms, Typeform and Tally are detected when their own “submitted successfully” signal fires.
• A button or form is marked as an enquiry by hand. On Enquiry rules, click Open visual labeler, enter the URL of a live page, and a new tab opens with an overlay: hover to highlight an element, click to lock onto it, type a name, optionally tick “apply to every page”, set “Always an enquiry” and save. Rules are retroactive — they relabel past visits as well as future ones. The labeler link is valid for one hour and only works on the website’s own domains.
• The website’s own code calls it directly:

  sft('lead', { label: 'Newsletter signup' }); // label is optional
  

• A server-to-server webhook, for enquiries that only exist in a backend (a CRM entry created after a phone call, for instance):

  POST https://www.your-domain.com/api/v1/leads
  Authorization: Bearer sk_api_…
  Content-Type: application/json
  
  { "ref": "<the visitor's pv>", "label": "Optional label" }
  

  ref links the webhook to a specific visit. For an ordinary HTML form, the tracker fills a hidden sft_ref field automatically the moment someone focuses the form, so the backend can read it straight off the submission. For a form a JavaScript framework controls, or an embed to prefill (Calendly’s utm_content, say), get it directly:

  sft('ref', (pv) => { /* attach pv to your own submission */ });
  

  The webhook only ever accepts ref and an optional short label — it rejects anything else, including email addresses, on purpose. We never want customers’ contact details in our database. The API key is created on Website settings › Keys.

Page names

The easy view names pages instead of showing their addresses: “Webdesign” rather than /services/webdesign. A page’s name is its title (what the browser tab shows) without your website’s name, so “Webdesign | Agentur XY” becomes “Webdesign”; the start page is always “Home page”. When a page has no title of its own, its address is tidied up instead (“Webdesign (Services)”). To give a page a better name, go to Enquiry rules › Page names, type the name next to the page and click Save; leave the field empty to go back to the automatic name. Names apply to past and future visits.

8. The Google Ads tracking template

Setup › Google Ads gives one tracking-template URL, built from the website’s own key and (if set up) its proxy prefix, plus a Copy button. Paste it once into Google Ads at the account level (Admin → Account settings → Tracking), not per campaign — the page walks through exactly where to find that setting, with a video.

Google Ads fills in the placeholders ({lpurl}, {gclid}, {campaignid}, and so on) on every click, for every campaign. If the account already has a tracking template for something else, the Setup page warns before it is overwritten — only one account-level template can be active at a time. Once pasted, Test it sends a test click through the same redirect the real ads use and confirms it lands back on the website.

Or connect Google Ads instead of pasting. Owners and admins see Connect Google Ads at the top of the page: sign in with the Google account you use for Google Ads (it needs direct access to the advertiser account — not only through an agency’s manager account) and pick the account. The app then sets the account-level tracking template for you, shows your campaign names next to every Google Ads visit, and lists any campaign whose own tracking template would bypass it. It never replaces a tracking template another tool has set: you’ll be asked to remove that one in Google Ads first. Disconnecting removes the app’s access but leaves the template in place, so clicks keep being recorded.

Showing campaign names, not just IDs

Every Google Ads visit shows the matched campaign ID and keyword. To see the campaign’s name too, add, right next to the tracking template (Admin → Account settings → Tracking → Final URL suffix):

utm_campaign={_campaign}

Then, on each campaign, add a custom parameter called _campaign set to that campaign’s short name (campaign settings → Additional settings → Custom parameters). The dashboard reads utm_campaign for every visit.

9. The proxy (for ad blockers)

Many ad blockers and privacy browser extensions block requests to known analytics domains by name — including ours, if the tracker talks to us directly. Those visitors are real; we just never hear about them.

Setup › Ad-blocker proxy walks through making our requests look like they go to the website’s own domain instead: a small piece of configuration — nginx, Apache, a Cloudflare Worker, Next.js on Vercel, Vercel, Netlify, or the WordPress plugin, whichever matches the hosting — forwards one short path prefix (for example /k3x9/) on the website’s domain through to us. Nothing about what’s measured changes, only where the request is addressed. The page generates ready-to-paste configuration filled in with the website’s own values, shows each platform’s steps as a video, and Check my proxy confirms it works. The proxy key it needs is created on Website settings › Keys.

This step is optional. Tracking works without it — the proxy only recovers the visitors an ad blocker would otherwise hide, and it lets ad-click tracking (§8) reach us over the same address as the visitor’s page views, which makes matching a click to its visit more reliable.

10. Journeys and Bot clicks

Journeys shows every visit as a timeline: where someone came from, what they clicked, how long they stayed, and whether it became an enquiry, with filters for ads, enquiries, bot clicks and abandoned forms.

Bot clicks is a separate, advisory view of click-fraud signals — IP addresses that show automated-browser markers, come from datacenter network ranges, or click an unusual number of times in a short window. Nothing here is blocked or hidden automatically anywhere else in the product — these are signals to review, not a verdict. A shared office network, a mobile carrier, or Apple’s iCloud Private Relay can trigger the same signal without a single visitor being a bot, so look at an IP’s actual behaviour (repeated clicks with no time spent on the page is a much stronger signal than the network type alone) before acting on it.

The page’s Copy likely-bot IPs button copies one IP per line, ready to paste into Google Ads’ own IP exclusion list. Use the account-level list (Admin → Account settings → IP exclusions) — it applies to every campaign at once, including Performance Max, where a campaign-level list isn’t available. Google Ads accepts up to 500 exclusions per list; above that, the page says so and the list needs splitting. We never exclude anything on the customer’s behalf.