Read-only by design
First Look reads the Google Ads account you select so it can analyse it, and your Microsoft Advertising account too if you choose to connect one. That is the whole job. It never creates, edits, pauses, or deletes campaigns. It never sells your advertising data, never uses your Google Ads data for unrelated advertising, and never exposes your connection to other customers.
What we access, and why
When you connect Google, Zbang asks for a short list of scopes. If you also connect Microsoft Advertising, which is optional and separate, it asks for three more. Here is each one and what it is for.
Scroll to view every column
| Scope | What it’s for |
|---|---|
Google openid |
Confirm the identity of the Google account holder during sign-in and connection setup. |
Google email |
Link the connected Google identity to the correct private workspace, and show the connected account’s email. |
Google profile |
Read basic profile info to verify the connection belongs to the signed-in user. |
Google Ads API (.../auth/ |
List the accounts you can access and read reporting, campaign, asset, conversion, and product-feed data for the audit. Read-only: never used to create, edit or delete campaigns. |
Microsoft openid profile email |
Confirm the Microsoft identity that owns your Microsoft Advertising connection. |
Microsoft offline_access |
Keep the read-only connection working for manual and scheduled audits until you disconnect it. |
Microsoft Advertising API (.../ |
Microsoft Advertising requires it for account discovery and reporting access. First Look uses it only to read audit evidence: never to create, edit, pause or delete anything. |
You’re in control
You connect Google, and Microsoft Advertising if you want it, yourself. You choose the account and start each audit. You can disconnect either platform at any time, which stops future access, and you can export your data or ask for it to be deleted from the app’s privacy and data page.
Server-side AI recommendations are off unless the operator enables them. When AI is enabled, opening Google Ads account setup automatically sends the account name, top landing domains, and up to 200 sampled search terms to the configured AI provider for identity suggestions, and manual audits request AI recommendations by default. Asking for new ad copy after an audit sends the selected campaign and ad-group context, keywords and landing page to the AI provider, only when you ask. When AI is off, your Google Ads analysis stays inside the deployment unless you download the outputs or set up report delivery.
Data retention
By default, generated audit files and workspace artefacts are kept for up to 7 days, then automatically cleaned up. Your connection, schedule, and account settings remain until you change or delete them.
First Look also keeps an anonymous daily count of completed audits by platform and run type. It holds no user, account or advertising data, it stays after audits are deleted, and Zbang may publish totals from it.
Who processes your data
A small set of subprocessors helps run the audit:
Scroll to view every column
| Subprocessor | Role |
|---|---|
| Identity and the Google Ads API, used when you connect Google and run an audit. | |
| Microsoft | Identity and the Microsoft Advertising API, used only when you connect Microsoft Advertising. |
| Railway | Application hosting and runtime. |
| OpenAI | Optional AI recommendations and ad-copy suggestions, only when AI is enabled. |
| Cloudflare Turnstile | First Look login abuse protection and Zbang website contact-form abuse prevention. |
| Resend, Slack, Microsoft Teams, Pushover | Optional report delivery and notifications, only for destinations you set up. |
| The deployment database | Structured application storage. |
This is a summary; see the app’s subprocessor list below for the complete, authoritative set.
Read the full policies
This page is a friendly summary. The authoritative detail, the policy shown on the Google OAuth consent screen, lives in the app’s own policies.