Most contact forms send visitor data to five services before anyone has agreed to anything, and still fill up with spam.
Is this happening in your business?
- Your site loads tracking before visitors say yes.
- Your contact form gets spam, so real requests get missed.
- Requests land in an inbox with no structure, so qualifying them takes time.
- You are not sure what your site does with visitor data.
What it costs you
Your contact form is the first thing a buyer trusts you with. If it leaks data or loses requests, you lose the lead and some of your reputation before the first reply.
You are standing in it. Open the brief form.
How it works
- Nothing loads until you choose. Analytics stay off until a visitor accepts. Declining is one click and is respected.
- The form asks about the process, not the technology. Short questions a visitor can finish on a phone, with clear errors.
- Spam is stopped quietly. A hidden field catches bots, requests must come from the site itself, and each visitor can send at most five briefs an hour.
- No IP address is kept. The limit uses a one-way scrambled code of the address, so the address itself is never stored.
- The brief is filed for review. It is saved in a locked database and copied to a review table, where each request is read by a person.
Before
- Tracking loaded before consent
- Spam mixed with real requests
- Unstructured emails to sort
After
- Analytics only after a yes
- Bots and floods stopped before they are stored
- Every brief arrives in the same structured format
Decisions that make it safe to use
- Privacy first, by default. No consent, no analytics. The banner says plainly what is counted.
- The database is locked down. Visitors can only add a brief. Reading briefs needs the owner's login.
- Tested like a product. About fifty browser tests run the real pages, including the form, the banner and the security headers, before each change goes live.
What it runs on
- Next.js on Vercel: the site and the form handling on the server.
- Supabase: the locked database for briefs and site content.
- Airtable: the review table where each brief is read.
- Google Analytics 4: visit counts, only after consent.
- Playwright: the browser tests that check every change.
Inside the run
How it goes live in your business
The same intake works on your site: a form shaped around your own qualifying questions.
- Map the process with you. One call to walk through how the work happens today, who does what, and where it breaks. You get a one-page plan before anything is built.
- Build it on your accounts. The workflow connects to your own tools, with your own logins. Nothing runs through a shared account of mine, and you can switch it off at any time.
- Test with your real examples. We run it on a copy of your data and real past cases first, side by side with the way you work now, until the output is right.
- Go live with a safety net. Every failed step sends an alert to a person instead of failing silently, and anything uncertain is routed to a human.
- Hand over. You get a short guide to what it does, how to change the common things yourself, and what to do if a step fails.
Does your contact form lose real requests in the noise?
Describe the process in a short brief: what happens today, which tools are involved, and what "fixed" would look like. I read every brief and reply with whether I can fix it and how. Write a brief
My own site, in production. Everything described here is what this page you are reading does.