BusinessMCP

Analytics

Capture Leads from Embedded Funnels & Stripe

Embedded funnel tools and Stripe-only checkouts are the two trickiest places to capture a lead. Here is exactly what our script sees automatically, what the browser makes impossible, and the three ways to capture the rest.

By the BusinessMCP team8 min readJuly 27, 2026Last updated September 7, 2026
Capture Leads from Embedded Funnels & Stripe — illustrated overview

Key takeaways

  • Inline embeds are captured automatically; cross-origin iframes are walled off by the browser’s Same-Origin Policy — for every analytics tool, not just ours.
  • Three bridges close the iframe gap: provider postMessage broadcasts (automatic for Heyflow/Tally), a same-domain ?email= thank-you redirect, or a server-side webhook.
  • Stripe-only buyers are still captured — Payment Links are decorated with the visitor id automatically; custom checkouts should set metadata.mcph_sid.

What the tracking script captures automatically

Once the BusinessMCP script is on your site, it turns any email a visitor types into an identified CRM contact — no custom forms or code required. It listens for native form submits, for a valid email in any email field the moment it loses focus (which catches AJAX and single-page-app forms that never fire a real submit), and for an email passed in the page URL such as a ?email= parameter on a thank-you page. Each captured email is stitched to that visitor’s anonymous browsing journey and, for business domains, enriched with company firmographics.

This covers the vast majority of sites, including form tools that embed inline — where the provider’s script injects the form directly into your page’s HTML. Because those fields live in your page, our listeners see them and capture the email exactly like a native form.

The one thing no tracker can do: read inside a cross-origin iframe

Some funnel builders — Heyflow, Typeform and others — embed as a cross-origin iframe: an <iframe> pointing at the provider’s own domain. The browser’s Same-Origin Policy deliberately walls that iframe off from your page. No analytics tool — not BusinessMCP, not Google Analytics, not Segment — can read the fields inside it or listen to its events. This is a browser security guarantee, not a limitation of any one script. So if your email is only ever typed inside a cross-origin iframe, direct field capture is simply not possible.

The good news: there are three reliable ways to bridge that boundary, and BusinessMCP supports all three.

Which capture path applies, by provider and setup
Provider / setupBest integration method
Inline embeds (form injected into your page)Automatic — our field listeners capture the email directly
Heyflow (cross-origin iframe)Automatic — the heyflow-submit postMessage broadcast is captured
Tally (cross-origin iframe)Automatic — the Tally.FormSubmitted postMessage broadcast is captured
Typeform / Calendly (no email in broadcast)Redirect to a same-domain ?email= thank-you page, or a webhook
Fully off-domain funnelsServer-side webhook to /api/tracker/YOUR_TRACKER_ID/identify
Stripe Payment LinksAutomatic — the visitor id is decorated as client_reference_id
Custom Stripe checkout (API)Set metadata.mcph_sid (or client_reference_id) to the visitor id

Bridge 1 — the provider broadcasts its submission (automatic)

Many embed tools post a message to the parent page when their form is submitted. Heyflow emits a heyflow-submit event and Tally emits a Tally.FormSubmitted event, both carrying the submitted fields. Our script now listens for these messages and lifts the email out automatically — you do not have to configure anything beyond having the tracking script installed. If your provider is Heyflow or Tally, an iframe embed just works.

Note that some providers — Typeform and Calendly among them — do not include the email in the message they broadcast, by design. For those, use one of the next two bridges.

Bridge 2 — redirect to a thank-you page with the email in the URL

Almost every funnel tool lets you redirect to a URL after completion and pass answers as query parameters. Point that redirect at a page on your own tracked domain and include the email, for example https://yoursite.com/thanks?email={{email}}. Our script reads email, user_email, email_address, contact_email and e parameters on page load and identifies the visitor — stitched to their journey because they are back on your tracked domain. This is the most universal bridge and works with any provider.

Bridge 3 — a server-side webhook

For funnels hosted entirely off your domain, or when you would rather not rely on the browser at all, send a webhook. BusinessMCP exposes a simple endpoint at /api/tracker/YOUR_TRACKER_ID/identify that accepts a JSON body of { "email": "person@company.com", "visitorId": "optional", "traits": { } }. Wire your provider’s webhook (or a Zapier/Make step) to POST there and the contact is created in your workspace, company-enriched, and ready in your CRM. If you passed the visitor’s id into the funnel as a hidden field, include it as visitorId to stitch the full journey.

POST /api/tracker/YOUR_TRACKER_ID/identify
Content-Type: application/json

{
  "email": "person@company.com",
  "visitorId": "optional — stitches the full journey",
  "traits": {}
}

When the only capture is a Stripe payment

If a buyer never fills a form and simply pays, BusinessMCP still captures them. Connect your Stripe in the dashboard and every succeeded charge becomes a customer contact with rolled-up lifetime value and company enrichment, pulled in automatically by our revenue sync.

The subtle part is tying that payment back to the buyer’s browsing journey. To do that we need the anonymous visitor id to travel with the payment. If you use Stripe Payment Links, our script now handles this for you: it decorates links to Stripe checkout with the visitor id as client_reference_id, and our revenue sync reads it back to stitch the journey — no configuration needed. For custom checkouts built with the Stripe API, set metadata.mcph_sid (or client_reference_id) to the visitor id when you create the Checkout Session or PaymentIntent. You can read the current visitor id in the browser at any time with window.mcph.getVisitorId().

Even without any of that, a Stripe buyer whose email was ever identified on your site — through a form, an embed bridge, or a prior visit — is stitched automatically by matching the email. The visitor-id passing only matters for buyers whose very first touch is the payment.

Frequently asked questions

Does email capture work with Heyflow?

Yes. If Heyflow is embedded inline, our field listeners capture it directly. If it is embedded as a cross-origin iframe, our script listens for Heyflow’s heyflow-submit broadcast and captures the email automatically. You can also redirect to a ?email= thank-you page or send a webhook to /api/tracker/ID/identify.

Can you read the email typed inside a cross-origin iframe directly?

No — the browser’s Same-Origin Policy blocks any script on your page from reading inside a cross-origin iframe. No analytics tool can. That is why we support provider postMessage broadcasts, redirect parameters, and webhooks to bridge it.

Will a customer who only ever pays via Stripe show up in my CRM?

Yes. Connecting your Stripe turns every succeeded charge into a customer contact with lifetime value and company enrichment. Their browsing journey is stitched automatically for Payment Links (we pass the visitor id as client_reference_id) or when the email was seen on your site before; for custom checkouts, set metadata.mcph_sid to the visitor id.

BM

BusinessMCP Team

Every guide is written from running BusinessMCP on its own platform — the match rates, reply rates, and deliverability lessons are from our own data, not recycled blog folklore. About BusinessMCP

Turn your business into one AI-ready MCP server

Connect your tools, install one tracking script, and expose your unified data to any AI agent through a single secure endpoint.

Get started free