Mail MergeCampaign Mail Merge Engine

Privacy Policy

Last Updated: July 2, 2026

At Mail Merge, we are committed to protecting your privacy. This privacy policy describes how your information is handled by our Google Sheets Mail Merge extension (hereinafter referred to as "the Extension").

Privacy-First Architecture: The Extension is container-bound and runs entirely under your own Google Apps Script environment. We do not have servers, databases, or access to your emails.

1. Data Collection and Storage

Unlike commercial SaaS alternatives, the Extension does not collect, harvest, or store your personal data, contact lists, draft templates, or sent email bodies on any third-party servers. All data processing (such as personalized tag replacement) occurs locally in your active browser window and within your Google account's cloud scope.

2. How We Use Google Account Permissions

To run the mail merge and track campaign metrics, you will be prompted to authorize permissions (OAuth Scopes). Here is how each permission is used:

  • gmail.send: Allows the script to send the personalized emails directly from your Gmail account to the recipients listed in your spreadsheet.
  • gmail.readonly: Allows the script to list and retrieve the subject and body of your Gmail drafts to use as mail templates.
  • spreadsheets: Allows the script to read names, contact columns, and customize tags. It is also used to log campaign metrics (Sent, Opened, Clicked) directly back to your spreadsheet rows.
  • userinfo.email: Used to display your sender address in the sidebar UI and verify active spreadsheet execution parameters.
  • script.container.ui: Allows the Extension to render the sidebar configuration interface inside your Google Sheet window.

3. Email Open and Link Click Tracking

If you enable tracking, the Extension appends an invisible pixel to email HTML bodies and rewrites links to redirect through your deployed Apps Script Web App URL.

When a recipient opens an email or clicks a link, their browser requests your Web App URL. The script increments the stats column in your spreadsheet. This tracking hit is 100% self-hosted; the data is written directly to your sheet and never goes to a third-party analytics tracker.

4. Data Retention

Since we do not have external storage databases, we do not retain your data. Any campaign metrics, template configurations, or recipient lists are stored solely within the cells of your Google Sheet. If you delete the sheet, all corresponding data is permanently removed.

5. Changes to This Privacy Policy

We may update this policy from time to time. If we update the Extension, the revised policy will be posted on this page. We encourage you to check this page periodically for updates.