For IT and procurement
Security & data
Last updated 29 October 2026
How Propel Max uses the access it asks for, where data goes and how long it stays, written from what the code does. If you need something not covered here, or an NDA or a data processing agreement, email hello@propeldigital.com.
The Google permission we ask for
Propel Max asks for one permission: the Google Ads API scope, https://www.googleapis.com/auth/adwords. Google offers no read-only version of it, so it’s the narrowest permission that lets any tool read Google Ads data. That’s why Google’s screen says the app can “see, edit, create, and delete” your Google Ads accounts and data: the wording describes the scope, not what we do with it.
What Propel Max does with it
It only reads. These are the only Google Ads API services it uses:
- GoogleAdsService (Search and SearchStream): reports on campaigns, keywords, conversions, budgets and the other areas the audit covers.
- CustomerService (ListAccessibleCustomers): which accounts your Google login can reach, for the account picker.
- KeywordPlanIdeaService (GenerateKeywordHistoricalMetrics): search volumes for keywords.
It calls no method that creates, edits, pauses or deletes anything. An automated test in our code fails if any part of the audit could reach one.
Outside Google Ads, the audit also loads public pages of your website and your public Google Tag Manager container, to check how your tracking is set up, and looks up your website’s domain with SpyFu for competitor data.
Four things that hold us to read-only
- Google’s rules. Apps that use Google user data must follow Google’s API Services User Data Policy (opens in a new tab). We declared to Google that Propel Max reads Google Ads data to produce an audit. Using the access to make changes would break those rules, and Google can suspend the app.
- Our terms. Our terms commit us in writing: we only read your data, and we use it to produce your audit and to follow up with you about it. Any other use is outside what you authorise.
- The law. Changing data in a computer system without authorisation can be a criminal offence under the Computer Misuse Act 1990 (opens in a new tab).
- Google’s change history. Google Ads logs every change to an account, including changes made through the API, with the tool that made them. Google keeps it for two years, and it can’t be edited from within Google Ads. How to view your change history (opens in a new tab).
How to make read-only enforced by Google
Connect with a Google login that has Read only access to your Google Ads account. Google then refuses any change made with that login, whatever its permission screen says, so read-only no longer depends on us. An administrator can add a read-only user under Admin, then Access and security, in Google Ads. How Google Ads access levels work (opens in a new tab).
Where data is stored and how it’s protected
- Audits run on Google Cloud in London (europe-west2): Cloud Run for processing, Firestore for records, Cloud Tasks for the audit queue, Cloud KMS for encryption keys and Secret Manager for our own credentials.
- Your Google access token is encrypted with a Cloud KMS key that never leaves Google’s key service, on top of the encryption Google Cloud applies to all stored data.
- Every connection, between your browser, our website, our servers and the services below, uses HTTPS.
- The website is hosted on Vercel. Your report is loaded by your browser directly from our Google Cloud service, so its contents aren’t stored on Vercel.
How long each kind of data is kept
| Data | How long |
|---|---|
| Your Google access token (encrypted) | Until your audit finishes or fails, then revoked at Google and deleted. If you don’t start an audit, it expires after 15 minutes and is revoked. |
| Sign-in state: your email, company and a one-time code for Google’s sign-in | 10 minutes, then deleted. |
| Your answers to the audit questions | Up to 1 hour while you answer them; removed from the audit record once the audit finishes. |
| Your audit record: your email, company, audited account name and ID, and the report | Deleted 12 months after the audit. The report’s private link stops working sooner, after 90 days. |
| How many audits your email address has run, to apply the limit of three in 30 days | Deleted 30 days after your most recent audit. |
| Requests for an emailed link to the audit | Stored only as one-way hashes, to limit how often one address or connection can ask. |
| Your email, company and report link in our customer records (HubSpot) | Kept as part of our customer records, as described in our privacy policy (opens in a new tab). We don’t send your Google Ads data to HubSpot. |
Who data passes through
Every outside service in the data path, and what it’s used for. Some of them may process data outside the UK; our privacy policy (opens in a new tab) explains the safeguards.
| Service | What for |
|---|---|
| Google Cloud | Runs the audit and stores its records, in London. |
| Firebase Hosting (Google) | Routes requests to our Google Cloud service. |
| Google Ads API | The data source: your account’s data is read from here. |
| Anthropic | Writes the audit’s analysis from your account’s data. Under Anthropic’s commercial terms (opens in a new tab), the data isn’t used to train AI models. |
| Microsoft (Microsoft 365) | Sends our emails, such as the link to your report. |
| HubSpot | Our customer records: your email, company and a link to your report, so Propel’s team can follow up. Not your Google Ads data. Also the chat on our website. |
| SpyFu | Competitor data for your website’s domain. Only your website’s domain and target country are sent, not your Google Ads data. |
| Vercel | Hosts the website. |
| Cloudflare Turnstile | The check on our form that stops bots. |
| Cookiebot | Asks for and records your cookie choices. |
| Mux | Hosts the video on our landing page. It loads only if you press play. |
| Google Tag Manager, Google Ads, Meta and LinkedIn | Marketing measurement on our landing, sample and confirmation pages, only with your cookie consent. Never on the pages that show your account’s data. |
Who can see your report
Your report sits at a private link with a long random code in it, emailed to you. The page isn’t indexed by search engines. Anyone with the link can open it, so share it as you would a document. Propel’s team also gets the link so we can follow up. The link works for 90 days.
How to revoke access
We revoke our access automatically when your audit finishes. You can also remove it yourself at any time in your Google Account (opens in a new tab), under third-party apps and services.
Contact
NDA or data processing agreement requests, and anything else about security or data, including reporting a security issue: hello@propeldigital.com.