Privacy Policy

1. Information we process

• Google account and authorization information. When you sign in with Google, we receive your Google account identifier, email address, and authorization information. Sign-in requests the OpenID, email, and basic profile permissions; our account records store your identifier and email address. The backend stores an encrypted Google refresh token and the permissions granted. We do not receive your Google password.
• Spreadsheet information. When you select a Google Sheet, we access its identifier, title, worksheet information, column headers, and row values needed to preview and prepare the mailing. These values can include recipients’ email addresses, names, and other information you include in the sheet. A snapshot of the selected sheet data is stored for processing the campaign.
• Email and campaign information. We process the sender, recipients, subject, message body, merge fields, and attachments you use for a mailing, together with campaign settings, timestamps, delivery results, and provider message identifiers. A campaign template sent to the temporary address provided by Mail Merge is received by our mail server and processed by our backend. A test-send request transmits the selected compose content and campaign settings to the backend.
• SMTP settings, if you use this option. We store the server address, port, connection security settings, username, sender details, and an encrypted password that you provide for sending through your chosen SMTP provider.
• Browser data. The extension stores its sign-in session, preferences, draft recovery state, and rating-prompt state. It also keeps a list of up to 30 recently opened Google Sheets, including their identifiers, titles, links, and last-opened times, to help you select a sheet.
• Operational information and correspondence. We process service request identifiers, timestamps, status and error codes, performance measurements, and information you send when contacting support. Network services necessarily receive connection information such as an IP address. Application and reverse-proxy request logs are designed to omit message bodies, credentials, full request URLs, and query strings.

The extension integrates with Gmail compose windows used for mail merge. Its Google API authorization permits sending email; it does not grant API access to read your Gmail inbox. The recent-sheet feature observes Google Sheets pages, rather than collecting a general browsing history.

2. How we use information

We use information to authenticate you, connect the services you authorize, display and validate spreadsheet data, insert merge fields, prepare personalized messages, send tests and campaigns, retry deliveries when appropriate, and show sending progress and history. We also use operational information to secure the service, diagnose failures, prevent abuse, and respond to your requests.

Where a data-protection law requires a legal basis, we rely on providing the service you request, your consent where required, our legitimate interests in operating and securing that service, and applicable legal obligations. Google authorization can be revoked as described below. We do not sell personal data, use it for targeted advertising, or use Google user data to train generalized artificial-intelligence or machine-learning models.

You decide which recipients and spreadsheet values to include. When we process recipient lists and email content on your behalf, we use them to carry out your mailing instructions. You are responsible for having an appropriate basis to use that information and contact those recipients.

3. Google data and Limited Use

Mail Merge complies with the Google API Services User Data Policy, including its Limited Use requirements, in its use and transfer of information received from Google APIs. Mail Merge also follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

Google Sheets access is read-only and supports selecting, previewing, and personalizing a mailing. Gmail sending access is used to send messages you request. Google authorization credentials are handled by the backend; the extension receives a separate Mail Merge session.

Google user data is used only for the disclosed mailing features and their necessary operation. Transfers are limited to delivering these features with your authorization, protecting security, or meeting legal obligations. We do not use this data for advertising, data brokerage, credit assessment, or unrelated profiling.

We do not allow people to read Google user data except with your explicit permission for specific data, when necessary for security or legal compliance, or for internal operations using aggregated and anonymized information as allowed by the applicable Limited Use rules.

4. Browser permissions and storage

• Identity: starts the Google sign-in and authorization flow.
• Scripting: enables the Gmail integration that supports composing mail-merge messages.
• Side panel: displays campaign setup, spreadsheet selection, and sending status.
• Storage: saves sessions, preferences, recent sheets, and recovery information.
• Clipboard write: copies a merge-field placeholder when you use its copy/insert control. The extension does not request permission to read your clipboard.
• Host access: connects the Gmail integration on mail.google.com, the recent-sheet feature on docs.google.com, and the backend on mailmerge.work.

Recent-sheet information and some preferences use Chrome’s synchronized extension storage and may be synchronized through Google across devices signed into your Chrome profile, depending on your browser settings. Mail Merge sign-in credentials use local extension storage; temporary recovery state uses browser session storage. The recent-sheet list belongs to the Chrome profile and is not isolated by the Google account selected inside Mail Merge.

This privacy page contains no advertising, analytics scripts, or cookies. The extension includes the InboxSDK library for Gmail integration with its event tracking and global error reporting disabled. Google, your email provider, and external pages may use their own cookies and storage under their own policies.

5. Sharing and service providers

Information is shared only as needed for the functions and circumstances described here:

• Google: provides sign-in, the Google Sheets and Gmail APIs, and Chrome synchronization when enabled. Google receives the requests needed to read the sheets you select and send messages through Gmail. Google’s handling of information is described in its Privacy Policy.
• HostHatch: hosts the Mail Merge backend and its service data in London, United Kingdom. We operate the application database, object storage, incoming-mail service, and monitoring on this infrastructure.
• Your chosen SMTP provider and email recipients: when you select SMTP, that provider receives the connection credentials and messages needed for delivery. Recipients and their mail providers receive the personalized messages and attachments you send. Those providers’ own retention and privacy practices apply to their copies.
• Extpage: our installation, uninstallation, and rating/feedback links redirect to extpage.app. Visiting those pages discloses ordinary web connection information to Extpage, together with a rating value when included in the link and any feedback you choose to submit. The extension does not attach Google tokens, spreadsheet contents, or campaign email contents to these links. These pages are external services and may apply their own privacy and cookie practices.
• Support communications: messages sent to our contact address are processed through Gmail, including the contact details and content you send us.

We may disclose information when necessary to comply with applicable law or protect the service and its users from fraud, abuse, or security threats, subject to the restrictions on Google user data described above. We do not share mailing lists or message content with advertisers or data brokers.

6. Retention and deletion

• Completed campaigns: seven days after a campaign reaches completion, its content becomes eligible for automated cleanup. Cleanup removes stored templates, sheet snapshots, and attachments, and clears recipient addresses, merge values, provider message identifiers, subject and sender details, and the associated sheet selection from campaign records. This also applies to completed test mailings. Cleanup runs periodically; temporary processing failures can delay deletion until a successful retry.
• Campaign history: campaign identifiers, account associations, timestamps, delivery counts and statuses, and operational records remain after content cleanup to support history, reliability, and duplicate-send prevention. Account records, unused draft bindings, and unfinished campaigns are not covered by the seven-day completed-campaign cleanup. They remain until separately removed; you can request their deletion using the contact below.
• Incoming-mail copies: after successful processing or a permanent rejection, the incoming template is moved to a temporary mail-server folder. It becomes eligible for removal after one day, followed by scheduled mailbox and storage cleanup. Messages awaiting processing or retry can remain longer.
• Credentials: Google refresh credentials are retained while the account remains connected. When we disconnect your Google account from Mail Merge, its stored Google credential is removed and its refresh sessions are invalidated. SMTP connection details remain until the profile is removed; deleting a profile clears its operational credentials, while a minimal historical record remains. A profile still referenced by an active draft or unfinished mailing cannot be deleted until those references are resolved.
• Logs and metrics: centralized operational logs use a seven-day retention setting, and service metrics use a fifteen-day setting. Local container logs rotate by size, so their retention period varies with activity.
• Browser storage: local settings and session information remain until cleared, replaced, or removed by the extension or browser. The recent-sheet list is capped at 30 entries and can remove older entries sooner to meet browser storage limits. Synchronized copies are also subject to Chrome’s synchronization settings.

Signing out, revoking Google access, or uninstalling the extension does not automatically delete your Mail Merge account or existing server records. To request deletion, email adsacckir@gmail.com from the connected account and identify the account or campaigns concerned.

We may verify your identity before fulfilling a request. If applicable law requires retention of particular records, we will explain the reason and limit their use accordingly. Deletion from Mail Merge does not remove original Google Sheets, Gmail drafts or sent messages, recipient copies, or copies independently held by your email provider. Automated cleanup is logical deletion from active service storage, not a guarantee of immediate physical erasure from every storage medium.

7. Security

Connections between the extension and our public backend use HTTPS. Stored Google refresh tokens and SMTP passwords are encrypted using authenticated AES-256 encryption. Account access is checked by the backend, and application logs are designed to avoid credentials and email content. These measures do not mean that all stored campaign content is encrypted at the application level.

Email delivery also depends on Google, your selected SMTP service, and recipients’ mail providers. No internet service or email delivery path can be guaranteed completely secure.

8. Your choices and rights

You can choose which sheets and messages to use, remove browser permissions or the extension, change browser synchronization settings, and revoke Mail Merge’s Google access in your Google Account connections. Revocation prevents further authorized Google access but does not recall emails already sent or erase previously stored records. Contact us if you also want the service-side connection or account data removed.

Depending on the law that applies to you, you may have rights to access, correct, delete, or receive a copy of your personal data, restrict or object to certain processing, and withdraw consent. You may also complain to your local data-protection authority. Send requests to adsacckir@gmail.com; we will handle them within the time limits required by applicable law.

If your information was included in a mailing by someone else, that sender decides why and to whom the mailing is sent. You can contact the sender about that use, or contact us so we can help identify and route a request concerning data held by Mail Merge.

9. Processing locations

Our primary backend hosting is provided by HostHatch in London, United Kingdom. Google, Extpage, and the mail providers involved in a delivery may process information in other countries. Your information may therefore be processed outside the country where you live. Applicable requirements for international data transfers continue to apply; contact us for information about the providers and safeguards relevant to your use.

10. Policy updates and contact

We may update this policy when the service or its data practices change. The current version will remain available at this address with an updated date. For material changes, we will provide any notice and obtain any additional consent required by law and the Google API policies before applying the new use of data.

Responsible developer: Kirill Valikov
Privacy and deletion requests: adsacckir@gmail.com