Privacy, cookies and consent

What the script stores

One first-party record in the visitor's browser, on your own domain (a _sx cookie and local storage entry, kept for up to 400 days). It holds the first and latest source of the visit, nothing else. SourceXray does not record page views, sessions or clicks, does not fingerprint devices and does not follow people across websites.

Data is only sent to SourceXray when someone sends a form: the source, the form name and page, and the contact details from the form (name, email and phone), so you can see who the lead is.

Waiting for consent

If you need consent before storing anything, add data-consent="wait" to the script tag (or consent: 'wait' in window.sxConfig). Then tell SourceXray when the visitor agrees or declines:

// When the visitor accepts marketing or analytics cookies
SourceXray.consent(true);

// When the visitor declines (also removes anything stored)
SourceXray.consent(false);

If your banner may run before the script loads, use the queue: window.sxq = window.sxq || []; sxq.push(['consent', true]);. With Google Tag Manager, you can also fire the SourceXray tag only on your consent trigger.

Not collecting contact details

Two ways: switch off Store name, email and phone with each lead in the website's Settings tab, or add data-pii="off" to the script so contact details never leave the browser. Leads then arrive with their source only.

Where data is kept

Data is stored with our hosting providers and encrypted in transit and at rest. The full list of sub-processors and where they operate is in our Data Processing Addendum.

Deleting data

Delete a website to remove it and all of its leads. Close your account to delete everything. To answer a request from one of your own leads, find them on the Leads page and email us if you need a record removed. Read the full Privacy Policy.