Google OAuth scope justification

FixAdSpend (https://www.fixadspend.ai) is a SaaS auditing tool that helps small-business owners and in-house performance marketers identify wasted ad spend in their Google Ads accounts. We are a Wyoming-registered LLC (Fixadspend LLC).

Users sign up at fixadspend.ai, connect their Google Ads account via OAuth, and the product reads campaign-level metrics nightly to surface recommendations like "pause campaign X — $240/month savings" or "add these 8 negative keywords".

• https://www.googleapis.com/auth/adwords — required to read Google Ads campaign/ad-group/keyword metrics + campaign metadata via the Google Ads API.
• openid, https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile — standard sign-in scopes for our NextAuth-backed authentication.

Our product has two distinct phases of interaction with the user's Google Ads account: continuous read-based monitoring (the default) and opt-in Autopilot writes (gated by tier and explicit user enrollment). We use the single adwords scope for both, with the safeguards described in Section 4.

Read use cases (always active for any connected account):

• Campaign-level metrics: spend, impressions, clicks, conversions, conversion value over the last 30 days by day, used by our root-cause analyst agent.
• Ad-group-level metrics: CPC, CTR, quality score, used by our creative-refresh and bid-optimizer agents.
• Search-terms report: last 30 days, used by our negative-keyword agent to surface wasted-spend search terms.
• Campaign metadata: status, budget, bidding strategy, used to filter recommendations to only campaigns the user can still act on.

Write use cases (Autopilot, opt-in only):

• Pause campaign (campaigns:mutate with status=PAUSED) — fired by our AI agents when they detect a campaign with sustained negative ROAS for more than 7 days, AND the user has opted into Autopilot, AND the action stays within the user's configured daily blast cap.
• Resume campaign (campaigns:mutate with status=ENABLED) — only fires as the reverse side of a previously-applied pause that the user wants undone (one-click revert).
• Adjust campaign budget (campaignBudgets:mutate with amount_micros) — fired by our budget optimizer agent when sustained over-pacing or under-pacing is detected, opt-in only, hard-capped at ±50 USD impact per individual mutation by our guardrails layer.

The single read-only sub-scope path doesn't exist. Google Ads API requires the full adwords scope for any GAQL query (even pure read SELECT). We use the same scope for our subsequent opt-in write paths described above, because there is no narrower alternative we could request instead.

Campaign metrics are stored in our PostgreSQL database (Neon, us-east-2 region) keyed to the authenticated user's account. Read data is used exclusively for two purposes:

• Rendering recommendations in the user's own dashboard at fixadspend.ai/dashboard.
• Sending campaign metrics to Anthropic's Claude API at audit time to produce diagnostic recommendations. Anthropic operates in zero-data-retention mode; we do not train any models on user data and we do not share user data with any third party.

Write safeguards (Autopilot). Every write mutation routes through a guardrails layer (see lib/autopilot-guardrails.ts in our codebase) before any Google Ads API call is issued. The guardrails enforce five gates, all of which must pass:

• Tier gate: only paid Scale, Agency, and Network plans include Autopilot. Free, Starter, and Growth users see recommendations but never trigger any write.
• Per-account opt-in: Autopilot defaults to OFF for every account. Users must explicitly enable it from their dashboard before our system can mutate their ad accounts.
• Per-action limit: any single mutation is capped at $50 USD-equivalent impact (pause/resume capped at $200). A budget reduction or increase larger than $50 is converted back into a recommendation, not auto-applied.
• Daily blast cap: the cumulative impact of all Autopilot mutations in a rolling 24h window is capped at the user-configured ceiling (default $50/day, max $500/day). Beyond the cap, further mutations are queued as PENDING recommendations for manual review.
• Master kill switch: a single environment variable can disable Autopilot globally (incident response control). Existing PENDING decisions stay queued; only the write firing stops.

Every Autopilot mutation is audited. We log each fired mutation to an internal AutopilotMutation table with: user, agent, platform, action type, target resource id, before/after values, estimated impact, raw request payload sent to Google, reversibility, and a timestamp. The user sees this log in their dashboard and can revert any reversible mutation with one click (we apply the inverse mutation via the same scope).

We never resell, share, or expose Google Ads data to anyone outside the authenticated user. Users can export everything (GDPR Art. 15) or hard-delete it (GDPR Art. 17) at any time from their data & privacy settings.

FixAdSpend's use of information received from Google APIs adheres to Google API Services User Data Policy, including the Limited Use requirements:

• We use the data only to provide and improve the features the user explicitly signed up for.
• We do not transfer the data except where necessary to provide the feature (e.g., sending it to Anthropic's Claude API for AI-generated recommendations, with zero-data-retention).
• We do not use the data to serve ads, including retargeting or interest-based advertising.
• We do not allow humans to read the data unless we have the user's explicit consent (e.g., support requests), or it is necessary for security or legal reasons, or it is aggregated and anonymized for internal operations.

/privacy · /terms · /data-deletion

Privacy policy lists the data we collect, retention period, and user rights under GDPR + CCPA. Terms cover account cancellation, refund window, and dispute resolution. Data deletion page documents the soft-delete + hard-delete flow.

On request, we provide:

• A 2-minute screen-recording demo showing the full OAuth consent flow + post-connect dashboard.
• A test Google Ads account (under our MCC) reviewers can use to test the full integration without using their own account.
• Live dashboard credentials (reviewer-test@fixadspend.ai) with the test data pre-loaded.

Email admin@fixadspend.ai for any of these.

Fixadspend LLC
Wyoming, USA
Developer contact: admin@fixadspend.ai
Application URL: https://www.fixadspend.ai
Privacy policy URL: https://www.fixadspend.ai/privacy