Attribution belongs on the order, with a note of how it was decided

Analytics can tell you where a visit came from. It can’t tell you where an order came from when the buyer ordered through a chat or a phone call, and in the market this store sells into, that’s common. So the order record carries the attribution itself, and analytics is only a funnel view on top.

What the browser keeps

A touch is one entry into the store from outside: a link with UTM values or an ad click ID, or an external referrer. The browser keeps two of them for 90 days:

• first: never overwritten while it’s younger than 90 days;
• last: replaced by every new touch. Direct visits and clicks inside the site never replace it.

Each touch stores the referrer’s host only and the landing path without its query string. Both are sent with the order, never as analytics properties, and ad click IDs stay on the order record. If storage is blocked (private mode), the order goes through without touches. A bad value is dropped, and never allowed to reject an order.

What staff add

Chat and phone orders have no touch, so staff ask “where did you hear about us?” at confirmation and pick from a fixed list: Facebook, TikTok, YouTube, Instagram, Zalo, friend or family, search, the QR code on the packaging, other, unknown. No free text, so the field can never end up holding a name or a phone number.

How a report decides

One view resolves each order:

source        = UTM source  → else the buyer's answer → else "unknown"
source_basis  = "utm"       | "heard_from"           | "none"

source_basis is the useful column. A weekly review can tell “measured from a link” apart from “the customer said so”, instead of adding the two together as if they were the same kind of number.

What stays out

The visitor’s IP address and user agent are personal data. They’re kept for fraud and cash-on-delivery risk checks, in a separate table, deleted after 180 days, and never joined into marketing reports.