A health-insurance lead funnel wanted its ads to learn which leads actually closed, not which ones filled in a form.
The catch: the person's details can't go anywhere near the ad platforms.
The ad click lands with its click id, which the page saves first-party, and the tracker mints its own. We know which ad, and nothing about the person.
On submit, the click id rides into the lead system as a sub id. The person's details go to the lead system and only there, and a lead that arrives without a click id fires an alert.
A sale in the dialer posts a webhook to my endpoint: secret-gated, fails closed, no manual path. The lead system cuts the click id to 30 characters, so the endpoint resolves it back to the full 36 and dedupes re-fires.
The sale fires back to Google Ads with the click id, conversion name, time and value, and a partner network gets a server-to-server postback with revenue. No name, phone or email in either.
A reconcile compares lead counts between the lead system and the tracker and categorizes every gap. One command traces a single conversion through 5 hops.
It caught Google Ads rejecting conversions whose click id was empty, and the fix went in upstream, at capture.
