First Look privacy policy

This policy applies to First Look, Zbang's free Google Ads audit, available at https://ads.zbang.ai/app-home. It explains what Google and Microsoft identity and advertising data the app accesses, how that data is used, and what controls users have.

First Look is operated by Zbang Ltd (registered in England and Wales as ZBANG LTD, company number 11824205; registered office 71–75 Shelton Street, London, WC2H 9JQ, United Kingdom), referred to as "Zbang" in this policy.

What we collect

Identity and advertising-platform data

• Basic Google account information returned during OAuth sign-in, including the user's Google subject ID, email address, and basic profile details.
• Encrypted Google refresh tokens needed to maintain the user's Google Ads connection.
• When Microsoft Advertising is enabled and connected, Microsoft identity metadata, an encrypted refresh token, accessible customer/account metadata, and reporting evidence needed for audits.
• Advertising-account metadata and reporting/configuration data needed to generate audits, dashboards, and exportable recommendations.
• This can include account, campaign, ad group, keyword, search term, asset, conversion, audience, Shopping, and product-feed data when available in the connected account.
• After repeated password failures, Cloudflare Turnstile processes browser, device, network, site-origin, and challenge-result signals to protect the login flow from automated abuse. Zbang does not place the submitted email or password in Turnstile's action, custom-data, or server-verification fields.

Why the optional Microsoft connection requests each permission

The Microsoft connection is separate, opt-in, and read-only in Zbang. Disconnecting it stops future Microsoft Advertising access.

Why the app requests each Google permission

Google Ads API access is provided through a single broad OAuth scope. Zbang uses that scope in a read-only way to analyse the user's data and does not use it to launch, edit, or remove campaigns.

How we use the data

• Authenticate the user and associate each opted-in Google or Microsoft connection with the correct private workspace.
• List accessible Google Ads or Microsoft Advertising accounts so the user can choose which account to audit.
• Retrieve the selected platform data needed to calculate account-health checks, recommendations, and supporting evidence tables.
• Run user-configured recurring audits, targets, alerts, and disclosure-scoped report delivery.
• Store generated dashboards and outputs for the retention period described in the app.

Roles and legal bases

• Zbang generally acts as controller for account, authentication, workspace-administration, and security data processed in this app.
• When a user asks Zbang to analyse a Google Ads or Microsoft Advertising account, Zbang may act as processor for customer advertising data, depending on the user's relationship with the advertiser.
• Our legal bases can include performance of a contract, steps taken at the user's request before providing the service, legitimate interests for service security and reliability, and consent or explicit request where optional processing is triggered.

How we share data

• We do not sell identity or advertising-platform data.
• We do not use Google Ads data for unrelated advertising.
• We only share data with service providers needed to host, secure, and operate the app, and only to the extent required to provide the service.
• Cloudflare Turnstile receives adaptive security signals only when the password-login abuse threshold requires an additional check.
• When server-side AI is enabled, opening Google Ads account setup automatically sends the account name, top landing domains, and up to 200 sampled search terms to the configured AI provider to suggest account identity patterns. Manual Google Ads audits request AI recommendations by default; other jobs send relevant bounded analysis data only when AI recommendations are enabled for that job. A separate generate-copy action sends the selected campaign and ad-group context, keywords, landing-page URL or angle, and chosen copy references only when a user explicitly requests new copy after an audit.
• If a user configures scheduled delivery, the explicitly selected disclosure-safe report may be sent to Resend for email delivery or to the user's encrypted Slack or Microsoft Teams webhook destination.

International transfers

• Some service providers used to host or operate the app may process data outside the EEA or UK.
• Where such transfers occur, Zbang aims to rely on adequacy decisions, Standard Contractual Clauses, or other lawful transfer mechanisms, as applicable.

Retention, deletion, and user controls

• Generated audit files and job artifacts are retained in workspace storage for up to 7 days before cleanup. Connection, schedule, and account settings remain until you change or delete them.
• Zbang keeps an anonymous daily count of completed audits by platform and run type. It holds no user, account, or advertising data, it stays after audits are deleted, and Zbang may publish totals from it.
• Users can independently disconnect Google Ads or Microsoft Advertising, which stops future access to that platform.
• Signed-in users can export their stored account data and request deletion from the in-app privacy and data page.
• Users can stop using the app at any time and may request privacy assistance using the contact details below.

Cookies and tracking

• The app sets strictly-necessary cookies for sign-in and CSRF protection, and stores your consent choice in browser localStorage under the key zbang-consent-v1.
• Optional analytics and marketing categories are off by default. If granted, Google Analytics 4 and Meta Pixel load from their respective third-party domains. We pass anonymize_ip: true to GA4 and disable ad-personalisation signals.
• You can change your choice anytime via the Cookie preferences link in the footer.
• Full details and a list of each cookie, category, and third-party provider are on the app cookie policy.

Security and compliance

• Google and Microsoft refresh tokens and report-delivery destinations are stored in encrypted form inside the app deployment.
• Zbang applies access controls so audits and dashboards stay private to the user's account inside the app.
• Zbang's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy , including the Limited Use requirements.

Your GDPR rights

• You may have the right to access, correct, erase, restrict, or object to certain processing of your personal data.
• You may have the right to data portability where GDPR applies.

Complaints

If you have a complaint, contact us first and we will work to resolve it. You can also contact the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF

Online form: ico.org.uk/make-a-complaint

If EU GDPR applies to you, you may also complain to the supervisory authority in the EU member state where you live, work, or where you believe an issue occurred.

Contact

For privacy and data-protection requests, contact go@zbang.ai.