When analytics is enabled, a campaign can replace an original URL with an opaque short token for each recipient. A click records campaign and contact context before redirecting to the destination. This supports unique-click and conversion analysis, but the token must never reveal a phone, email, or sequential ID. Validate destinations, classify bots, limit log retention, and use role-based report access. Tracking should also match the expectation established by consent and privacy information.
Use an opaque token
Keep PII out of the URL
Map a cryptographically random token to server-side context. Make it difficult to guess, support expiry or revocation, and mask the contact in logs. Validate the original destination as HTTPS.
Keep the redirect fast and safe
Record, classify, then redirect
Capture timestamp, campaign, token, and minimal request metadata. Prevent open redirects by using the stored destination instead of a query override. Label scanners and repeated clicks separately.
- Random token
- HTTPS destination
- No PII in URL
- Bot classification
- Retention limit
Document the attribution rule
Click window and conversion ID
Receive purchases or bookings with a stable event ID. Define the last-click window, deduplicate conversions, and reconcile refunds or cancellations. Restrict contact-log access to roles that need it.
Practical checklist
- Opaque token
- Destination validation
- Masked logs
- Bot label
- Attribution window
- Retention and access
Key takeaway
Contact-level tracking is useful when the token is private, the redirect is safe, and attribution rules are transparent.
Final thoughts
In a seed campaign, test a preview bot, real phone click, expired token, modified URL, and duplicate conversion. Use analytics for business learning, not intrusive profiling.
Verify consent, provider or carrier policy, and current applicable requirements before launching a campaign.
Start with 100 free automation credits →Common questions
Should a short URL contain the phone number?
No. Use an opaque random token and keep the mapping on the server.
Can I see who clicked?
Authorized campaign analytics may show masked contact context; access and retention should remain limited.
Sources and editorial note
Last editorial review: August 1, 2026. Legal and policy sections are general information, not legal advice. Verify current requirements with official sources and a qualified adviser.