Support

What access Tapper asks for on each platform and what it does with it

When you connect an ad account, an analytics property or a CRM, Tapper asks the platform for specific permissions. What Tapper changes depends on your products: a Block + Lift workspace lets Block set up exclusions, while a Lift only workspace does none of that.

How access works

  • You sign in to each platform yourself and approve the permissions it shows you. Tapper then works through that grant. You do not give Tapper a password, and on Google Ads there is no manager-link invitation or access request to accept.
  • Your access sets the limit. Tapper can only see and change what your sign-in can see and change in that account. On a Google Ads account where Tapper cannot make changes, for example because your sign-in has read-only access, Lift's fix buttons are grayed out, with the reason when you hover over them.
  • No one at Tapper works in your ad accounts by hand unless you ask them to.
  • Google data follows Google's rules. Tapper's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, as the Privacy Policy at <https://tapper.ai/privacy-policy> states.

Google sign-in

If you sign in to Tapper with Google, Tapper asks for email and profile. It uses them to create your Tapper account and sign you in.

Asks for: email, https://www.googleapis.com/auth/adwords and offline access, so Tapper can keep working when you are not signed in.

Reads: every Google Ads account your sign-in can reach (a manager account is expanded into its client accounts), plus campaign structure and metrics for the dashboard and for Lift.

Changes with Block (Block + Lift only):

  • Replaces the account-level tracking template with Tapper's. Tapper keeps a copy of yours and restores it, or clears the field, when you disconnect.
  • Creates conversion actions, user lists and audiences whose names start with "Tapper - ". What Tapper creates in your Google Ads account lists each one.
  • Adds IP exclusions, audience exclusions and conversion value rules to protected campaigns, and placement exclusions at account level. In monitoring-only mode, Tapper writes none of the exclusions it detects itself; only IPs you exclude by hand are pushed.

Changes with Lift (both workspace types): when a person presses a fix button on a Lift card. Each button names its change, such as Exclude placements, Turn off Search Partners, Add negative keywords, Pause ad or Pause campaign. Tapper makes that one change for you through the Google Ads API on your connected account, and you can revert it; only what Tapper created is ever removed. Mark as done changes nothing in Google Ads. Automatic fixes are off by default; when they are on, they cover only target CPA and target ROAS moves of a kind a person has already applied and kept. See Fix, mark as done, dismiss and revert.

Changes when you ask for them: a blocking-lift experiment creates a Google Ads campaign experiment that splits one campaign into a protected control and an unprotected treatment; Create shadow campaign adds a shadow campaign; and each Tapper goal creates a conversion action and a custom goal in the account, and attaching it to a campaign changes which conversion goals that campaign bids on.

Google Analytics

Asks for: email, https://www.googleapis.com/auth/analytics.readonly and https://www.googleapis.com/auth/bigquery.readonly.

Reads the GA4 properties and the BigQuery export project you enter on the entity's Google Analytics tab. Both permissions are read-only, so Tapper changes nothing in Google Analytics or Google Cloud.

Meta Ads

Asks for: email, pages_show_list, ads_read, ads_management, business_management and pages_read_engagement.

Reads: the ad accounts your Facebook profile can reach and their spend. For Lift, Tapper also reads each connected account every day: its campaigns, ad sets and ads with their settings, and their figures over the last 28 days (90 days of account and ad set figures on the first read).

Changes with Block: creates the custom audience "Tapper - Invalid Traffic Audience" in each linked ad account, and attaches it as an exclusion to an ad set when you switch that ad set's Protection on (or removes it when you switch it off). Nothing is switched on automatically. On a Lift only workspace, no audience is created.

TikTok Ads

You grant access through TikTok for Business's own sign-in. Tapper reads your ad accounts and their spend. For Lift, it also reads each account's campaigns, ad groups and ads and their daily figures, once a day after 12:00 UTC; Lift changes nothing in the account. With Block, it creates the audience "Tapper - Invalid traffic" and attaches it to an ad group when you switch that ad group's Protection on.

Microsoft Ads

Asks for: msads.manage offline_access.

Reads: your accounts, campaigns and spend. With Block, connecting sets up the account tracking template and auto-tagging, offline conversion goals, a UET tag and two remarketing lists.

Salesforce

The connection on the entity's CRM tab is read-only: "Tapper never writes to your Salesforce org." It is part of Tapper Vantage.

Taking access back

Disconnecting an account in Tapper stops it working with that account; for Google Ads, your own tracking template comes back. See Disconnect an ad account. You can also remove Tapper from the platform's own settings, for example under Business integrations in your Facebook settings.

Still need help?

Chat with our team and mention this article.