The snippet
<script>window.demander=window.demander||{q:[]};['init','track','identify','consent','page'].forEach(function(m){
window.demander[m]=window.demander[m]||function(){window.demander.q.push([m].concat([].slice.call(arguments)))}})</script>
<script async src="https://app.demander.to/t/demander.js" data-site-key="pk_…" data-endpoint="https://app.demander.to" data-consent-mode="strict"></script>Paste it into the head of every page; Website tracking, Add site gives you the snippet with your own site key. Calls made before the script loads are queued and replayed. The script is under 5 KB gzipped and loads asynchronously.
Three consent modes
| Mode | Before consent | After consent |
|---|---|---|
| strict (the EU default) | Nothing stored on the device. The server works with a cookieless key that rotates daily. | A persistent first-party id |
| balanced | A session id in sessionStorage | A persistent first-party id |
| off | A persistent id at once, for sites where consent is handled elsewhere or not needed | The same |
Call demander.consent() from your consent banner. Global Privacy Control and Do Not Track always count as no marketing consent. Ad click ids such as gclid, fbclid and li_fat_id are kept only with marketing consent, and withdrawing consent deletes what the tracker stored.
What the tracker records
-
01
Page views
Including single-page apps and hash routes: the tracker follows history changes and the back and forward buttons.
-
02
Engagement
Scroll depth, outbound clicks, downloads, video plays and completions.
-
03
Forms
Form starts and submits. The only form value ever captured is the e-mail field, and only when you switch form capture on and the visitor gave marketing consent.
-
04
Intent pages
Pricing, demo, docs, case studies, comparisons, careers and blog pages, classified on the server from the URL in several languages, with the page title as a fallback.
-
05
Where the visit came from
UTM parameters and, with marketing consent, ad click ids from the landing URL.
Companies by default, people only when they say who they are
Company identification runs only with a documented legitimate interest assessment for the workspace or the visitor’s marketing consent, and never when the browser sends Global Privacy Control. Visits through internet providers, mobile carriers and data centres are filtered out. IP addresses are never stored raw: Demander keeps a salted hash that rotates daily, and a truncated prefix (/24 for IPv4, /48 for IPv6) for the lookup.
Demander first uses evidence it owns: IP ranges registered to the company itself in the internet registries, prefixes your own contacts have identified themselves from (trusted once two different contacts back the same company, kept for 180 days), and reverse DNS as weak evidence. Dealfront, IPinfo and Snitcher can be connected on top.
A person becomes known only by identifying themselves: a form, an identify() call with marketing consent, or a reply. The public tracker can never grant e-mail consent. An opt-in ticked on your site sends a double opt-in e-mail, and consent is recorded only when the person confirms.
From a visit to a touch
-
Batches
Events go to Demander in small batches every few seconds, and with sendBeacon when the page closes.
-
One touch per visit
The first batch of a visit creates one touch for its source: a campaign and ad, an organic post, a sequence step or a referrer. Later batches merge into it (pages, strongest intent, demo flag, the contact once known), and a form fill turns it into a form touch.
-
Lineage
Paid clicks resolve to the campaign and ad through utm_campaign and utm_content, organic posts through utm_medium, and e-mail clicks through the sequence and step tags in your outreach links.
-
Signals and score
The account gets intent signals that fade over time and feed its score, its lifecycle stage and the retargeting lists.
Questions people ask
Does the tracker store anything before consent?
In strict mode, nothing on the device: the visit is held in memory and the server derives a key that changes daily. In balanced mode it keeps a session id in sessionStorage. After analytics consent it sets a persistent first-party id.
Can Demander tell me which person visited?
Only when that person identified themselves, for example through a form or a reply. Anonymous visits stay anonymous, and identification by IP stops at the company.
Will it slow my site down?
The script is under 5 KB gzipped and loads asynchronously. Conversion rules are limited in length and complexity, so a rule cannot slow a page down.
Do we need a legitimate interest assessment?
For company identification without marketing consent, yes. The workspace records that the assessment is done; without it, companies are identified only for visitors who gave marketing consent.