Limited Use statement. TopAI Surveys' use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
1. Which Google APIs we use
TopAI Surveys integrates with the Google Ads API only. We do not request access to Gmail, Drive, Calendar, Contacts, YouTube account data, or any other Google service on behalf of customers.
| Scope / access | Purpose | Access type |
|---|---|---|
Google Ads API (adwords scope via OAuth 2.0) |
Read the customer's own account hierarchy and daily performance metrics so we can produce campaign-level delivery and lift reporting. | Read-only |
No write operations are performed. We do not create, modify, pause, delete or re-budget campaigns, ad groups, keywords, audiences or assets.
2. How authorisation works
- An authorised administrator of the advertising account completes the standard Google OAuth 2.0 consent flow.
- Google issues an access token and refresh token. Tokens are stored encrypted at rest and in transit.
- Access is limited to the accounts that administrator can already manage; we cannot reach any other account.
- Access can be revoked at any time in the Google Account permissions page or inside our workspace, which invalidates the token immediately.
3. What we do with the data
Advertising data obtained through the Google Ads API is used only to provide the reporting service the customer has signed up for:
- Displaying performance metrics inside the customer's own workspace.
- Joining campaign delivery data with first-party survey responses to compute brand-lift measurements.
- Generating scheduled reports and exports for that same customer.
- Detecting anomalies the customer has configured alerts for.
What we never do
- We do not sell Google user data or advertising data to third parties.
- We do not transfer it to advertising platforms, data brokers, or information resellers.
- We do not use it for serving personalised advertising, retargeting or profiling.
- We do not use it to determine creditworthiness or for lending purposes.
- We do not use it to train generalised machine-learning models that serve other customers.
- We do not allow humans to read the data, except where the customer explicitly asks for support on a specific account, where required for security or legal compliance, or where the data has been aggregated and anonymised for internal operations.
4. Storage, retention and deletion
| Data | Retention |
|---|---|
| OAuth refresh tokens | Until the customer revokes access or closes the workspace; deleted immediately on revocation. |
| Cached advertising metrics | Rolling 25 months for year-over-year comparison; deleted within 30 days of revocation or workspace closure. |
| Generated reports and exports | Retained for the workspace lifetime, deletable by the customer at any time. |
| Application logs | 90 days, containing request metadata only — never raw API payloads. |
Customers can request full deletion of their data at any time by writing to privacy@topaisurveys.com. Requests are actioned within 30 days and confirmed in writing.
5. Security controls
- TLS 1.2+ for all data in transit; encryption at rest for tokens and stored metrics.
- Role-based access control with least-privilege permissions; production data access requires an audited approval.
- Audit logging of administrative actions and data access.
- Secrets held in a managed secret store, never in source code or client-side applications.
- Regular review of connected accounts and scopes, with unused authorisations removed.
6. Sub-processors
We use a limited set of infrastructure providers to host the service (cloud hosting and object storage within the European Union). Sub-processors are bound by written data-processing terms that prohibit them from using Google user data for any purpose other than delivering the service to us. A current list is available on request.
7. Your controls
- Revoke access — in the Google Account permissions page, or from workspace settings.
- Export — download the stored reporting data at any time.
- Delete — request deletion of all data associated with an authorisation.
- Disconnect a single account — remove one customer account without affecting others.
8. Contact
Questions about this page, or about how a specific integration handles Google data:
Privacy and data protection: privacy@topaisurveys.com
API and integration enquiries: api@topaisurveys.com
Last updated: 25 October 2026