Support

What access Tapper asks for on each platform and what it does with it

On this page

What Tapper changes depends on your products: with Block it sets up exclusions, while a Lift only workspace does none of that.

How access works

  • You sign in to each platform yourself and approve the permissions it shows. You never give Tapper a password, and on Google Ads there is no manager-link invitation or access request to accept.
  • Your access sets the limit. Tapper can only see and change what your sign-in can. On a Google Ads account where your sign-in cannot make changes, for example with read-only access, Lift's fix buttons are grayed out, with the reason on hover.
  • No one at Tapper works in your ad accounts by hand unless you ask them to.
  • Google data follows Google's rules. Tapper's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, as the Privacy Policy at tapper.ai/privacy-policy states.

Google sign-in

Tapper asks for email and profile to create your account and sign you in.

Asks for: email, https://www.googleapis.com/auth/adwords and offline access, so Tapper keeps working when you are not signed in.

Reads: every Google Ads account your sign-in can reach (a manager account is expanded into its client accounts), plus campaign structure and metrics for the dashboard and Lift.

Changes with Block:

  • Replaces the account-level tracking template with Tapper's. Tapper keeps a copy of yours and restores it, or clears the field, when you disconnect.
  • Creates conversion actions, user lists and audiences whose names start with "Tapper - ". See What Tapper creates in your Google Ads account.
  • Adds IP exclusions, audience exclusions and conversion value rules to protected campaigns, and placement exclusions at account level. In monitor-only, Tapper writes none of the exclusions it detects; only IPs you exclude by hand are pushed.

Changes with Lift (both workspace types): only when a person presses a fix button on a Lift card. Each button names its change, such as Exclude placements, Turn off Search Partners, Add negative keywords, Pause ad or Pause campaign. Tapper makes that one change through the Google Ads API, and you can revert it; only what Tapper created is ever removed. Mark as done changes nothing in Google Ads. Automatic fixes are off by default; when on, they cover only target CPA and target ROAS moves of a kind a person has already applied and kept. See Fix, mark as done, dismiss and revert.

Changes when you ask for them: a blocking-lift experiment creates a Google Ads campaign experiment that splits one campaign into a protected control and an unprotected treatment; Create shadow campaign adds a shadow campaign; and each Tapper goal creates a conversion action and a custom goal, and attaching it to a campaign changes which conversion goals that campaign bids on.

Google Analytics

Asks for: email, https://www.googleapis.com/auth/analytics.readonly and https://www.googleapis.com/auth/bigquery.readonly.

Reads the GA4 properties and the BigQuery export project you enter on the Google Analytics row of Setup > Data sources. Both permissions are read-only, so Tapper changes nothing in Google Analytics or Google Cloud.

Meta Ads

Asks for: email, pages_show_list, ads_read, ads_management, business_management and pages_read_engagement.

Reads: the ad accounts your Facebook profile can reach and their spend. For Lift, also each connected account's campaigns, ad sets and ads with their settings and their figures over the last 28 days, every day.

Changes with Block: creates the custom audience "Tapper - Invalid Traffic Audience" in each linked ad account, and attaches it as an exclusion to an ad set when you switch that ad set's Protection on (or removes it when you switch it off). Nothing is switched on automatically.

TikTok Ads

You grant access through TikTok for Business's own sign-in. Tapper reads your ad accounts and their spend. For Lift, it also reads each account's campaigns, ad groups and ads and their daily figures, once a day; Lift changes nothing. With Block, it creates the audience "Tapper - Invalid Traffic Audience" and changes no ad group.

Microsoft Ads

Asks for: msads.manage offline_access.

Reads: your accounts, campaigns and spend. Changes with Block: connecting sets up the account tracking template and auto-tagging, offline conversion goals, a UET tag and two remarketing lists.

LinkedIn Ads, Snapchat Ads and Apple Ads

Tapper reads each connected account's structure and daily performance and changes nothing.

Salesforce

The connection on the entity's Salesforce row of Setup > Data sources is read-only: "Tapper never writes to your Salesforce org." It is part of Tapper Vantage.

Asks for: a permission set with API Enabled and Read, and only Read, on Lead, Opportunity, Contact, Account, Task and Event. Task and Event access is for sales activity outcomes, never their subject or description.

Reads: each lead's and opportunity's outcome.

Taking access back

Disconnecting an account stops Tapper working with it; for Google Ads, your own tracking template comes back. See Disconnect an ad account. You can also remove Tapper in the platform's own settings, for example under Business integrations in your Facebook settings.

Still need help?

Chat with our team and mention this article.