Privacy Policy
Last updated: 24 March 2026
Overview
First Step Design & Development ("we", "us", "our") is a fully remote digital agency based in Hong Kong. We provide web development, e-commerce, digital marketing, and paid advertising management services for small local businesses.
This policy describes what data we access, how we use it, and your rights. It applies to our website at firstepdev.com and to the services we provide on behalf of our clients.
Our Website
Our website is fully static. We do not use cookies, analytics, tracking pixels, or contact forms. We do not collect any personal data through our website.
Google Ads API Data
We manage Google Ads accounts on behalf of our clients through a Google Ads Manager Account (MCC). We use the Google Ads API to provide advertising management services.
OAuth Scope
We request the following OAuth scope when clients authorize access to their Google Ads accounts:
https://www.googleapis.com/auth/adwords— manage Google Ads campaigns and access reporting data
What Data We Access
When authorized by a client, we access the following data from their Google Ads account:
- Campaign performance data (impressions, clicks, conversions, cost)
- Keyword research and search term data
- Conversion tracking data
- Ad account configuration and settings
- Ad group, ad copy, and bidding information
How We Use This Data
We use Google Ads data solely to provide advertising management services to the client who authorized access. This includes:
- Creating, editing, and optimizing ad campaigns
- Generating performance reports for the client
- Conducting keyword research to improve campaign effectiveness
- Monitoring and adjusting bids, budgets, and targeting
How We Store This Data
We access Google Ads data in real time through the API. We do not maintain a separate long-term database of client Google Ads data. Temporary data (such as report exports or working documents) is stored on access-controlled systems and deleted when no longer needed for the active engagement.
How Data Is Deleted
When a client relationship ends or a client revokes authorization, we delete all copies of their Google Ads data from our systems within 30 days. Clients can also revoke API access at any time through their Google Account permissions at myaccount.google.com/permissions.
Google API Services — Limited Use Disclosure
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- We only use Google Ads data to provide and improve the advertising management services described in this policy.
- We do not sell Google Ads data or any data received from Google APIs to third parties.
- We do not use Google Ads data for purposes unrelated to the client's advertising campaigns.
- We do not use Google Ads data to build user profiles for advertising by other parties or for any form of surveillance.
- No humans read Google Ads data except as necessary to provide the services authorized by the client, investigate security issues, or comply with applicable law.
Third-Party Sharing
We do not sell, rent, or share client data with third parties, except in the following limited circumstances:
- At the client's direction — for example, sharing a performance report with a third-party consultant the client has engaged.
- Service providers — we may use tools (such as reporting software) that process data on our behalf, subject to appropriate data handling obligations.
- Legal requirements — if required by law, regulation, or legal process applicable in Hong Kong.
Data Retention
We retain client Google Ads data only for the duration of our active engagement with the client. Working documents (reports, exports) are retained for up to 12 months after the engagement ends for reference purposes, then deleted. Clients may request earlier deletion at any time.
Your Rights
Under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), data subjects have the right to:
- Request access to personal data we hold about them
- Request correction of inaccurate personal data
- Request deletion of their data
Additionally, clients who have authorized Google Ads API access can revoke that access at any time through their Google Account permissions.
To make a data access, correction, or deletion request, contact us at the address below.
Contact
If you have questions about this privacy policy or wish to exercise your data rights, contact us:
First Step Design & Development
Email: info@firstepdev.com