HTML installation

Install the Korvus snippet directly in your site's HTML.

Before you install: mandatory GDPR checklist

Korvus acts as a processor within the meaning of Article 28 of the GDPR. Before you deploy the snippet, check the 5 points below: without them, your site does not meet the information obligation set by Article 13 of the GDPR and Article 82 of the French Data Protection Act (loi Informatique et Libertés).

Sample opt-out link

To add to your privacy policy:

<a href="#" onclick="document.cookie='korvus_optout=1; path=/; max-age=31536000'; alert('La collecte Korvus est désactivée sur ce navigateur.'); return false;">
  Refuser la collecte Korvus
</a>

Prerequisites

• An active Korvus account (create an account)
• Access to your site's HTML head

Steps

Add the following snippet before the </head> tag on every page of your site:

<script src="https://cdn.korvus.fr/v1/korvus.min.js" data-api-key="VOTRE_CLE_API" defer></script>

Replace VOTRE_CLE_API with your API key, available in your site settings on the Korvus dashboard.

Content Security Policy (CSP)

If your site uses a CSP, you need to add the Korvus domains. See the CSP page for the directives to add.

Verification

Once installed, go back to your Korvus dashboard. The first data shows up within a few minutes. The 7-day learning period starts automatically.

During this period, Korvus observes your site's normal behavior without sending alerts.

Step 2: GTM purchase tag (required for euro figures)

The snippet automatically detects the order confirmation page (the "a transaction happened" signal), but the transaction amount requires a dedicated tag in your GTM. Without this tag, Korvus knows the transaction took place but cannot calculate the financial impact of the leaks it detects.

This tag is our independent source of truth. Because it is separate from your GA4 tracking, Korvus can monitor that tracking and alert you if your GA4 dataLayer breaks (revenue missing in GA4 while the transaction did reach Korvus is a clear warning sign). If we simply read your GA4 dataLayer, we could never monitor it: nobody can check a source with the source itself.

1. Create the Custom HTML tag

In your GTM (Google Tag Manager) workspace, create a new Custom HTML tag and paste exactly the code below:

<script>window.korvus.purchase({ value: {{Purchase Value}}, currency: {{Purchase Currency}} });</script>

The tag is a single line. The Korvus snippet accepts calls made before it has fully booted: the transaction is queued and sent as soon as the snippet is ready (command-queue pattern, similar to Mixpanel or Segment), so you do not lose a transaction if the GTM tag fires before the snippet has finished loading.

2. Map the GTM variables

Create two GTM variables (User-Defined Variables) that point to the source of your amount and currency:

If you have neither a dataLayer nor a usable JS object, create a Custom JavaScript Variable in GTM that reads the value from the DOM (for example, a selector on the element that holds the order total).

3. Set up the trigger

Type: Page View. Condition: the URL matches your order confirmation page (e.g. Page URL contains /commande-confirmee, /order-received, /checkout/success).

Best practices:

• Turn on the GTM setting Consent Initialization Required: analytics_storage so the tag only fires once the visitor has consented. Korvus already filters out, client-side, any data sent without consent, but this setting stops the tag from even trying to fire.
• Once published, check on a test order that the transaction shows up in your Korvus dashboard within the next few minutes.

Why a dedicated tag rather than automatic detection?

The Korvus snippet never reads page body content (a non-negotiable CNIL rule) or the body of your back end's HTTP requests. The exact amount of a transaction is therefore out of reach for passive observation. The GTM tag is the industry-standard mechanism (used by Contentsquare, Hotjar, FullStory, etc.) to send this precise piece of data, under the site owner's explicit control.