Permissions & your data

This page answers the questions we get most often from IT and security reviewers: which Google permissions Mail Merge requests, whether it can read your Gmail, which files it can access, and what happens to your recipient lists on our servers.

For the complete account, campaign, AI, analytics and support data disclosures, including recipients, retention and user controls, see our privacy policy.

The permissions shown during installation

When you install Mail Merge from the Google Workspace Marketplace, Google shows the add-on’s permission list. These are the scopes the add-on requests, and what each one is for:

Permission (OAuth scope)	Why Mail Merge needs it
script.send_mail — Send email on your behalf	Sending the emails you compose. This scope can only send — it cannot read, search, or list anything in your mailbox.
spreadsheets — See, edit, create, and delete your spreadsheets	Reading the recipient sheet you run the merge from, and writing the 📮 status column (Sent / Opened / Error…) back into it.
drive.readonly — See and download your Drive files	Reading selected content and downloading campaign attachments, including per-row attachments referenced by a Drive URL in your sheet. This scope does not permit modifying or deleting Drive files.
drive.file — Access files you open or create with this app	Per-file access used by the file picker.
userinfo.email	Identifying your account (your email address is your Mail Merge account id).
script.container.ui, gmail.addons.execute, script.scriptapp, script.external_request, script.locale	Standard Google Workspace add-on plumbing: showing the sidebar and dialog inside Sheets/Gmail, calling our backend, and displaying the UI in your language. script.scriptapp is also what lets a form automation install its “new form response” trigger in your spreadsheet.
forms.currentonly — View and manage forms that this application has been installed in	Only inside the Google Forms editor: finding the spreadsheet a form sends its responses to, and linking one when there is none, so a form automation can be set up from the form itself. Mail Merge never reads the responses through this scope.

This table describes the Workspace add-on. Permissions for the web app and AI-assistant connections depend on the features you authorize; optional mailbox warm-up has a separate connection.

Can it read Gmail messages, or only send?

The add-on’s sending permission is send-only. The add-on requests no Gmail read scope: sending goes through script.send_mail, which is send-only. The optional Gmail connection described below adds gmail.send (also send-only) and gmail.metadata, which Mail Merge uses for reply and bounce detection on threads that your own campaigns started — it reads message metadata (including sender headers), rather than message bodies, for this feature.

Optional mailbox warm-up uses a separate Google App Password and SMTP/IMAP connection. It can find matched warm-up messages, move them out of spam, mark them as read, reply and archive them. This is separate from the add-on’s send-only permission and campaign reply detection.

All Drive/Sheets files, or only selected files?

The spreadsheets scope is account-wide by nature — that is how Google’s Sheets add-on model works, since the add-on has to read whichever spreadsheet you open it in and write delivery statuses back into it. Requested app and AI tools can also read spreadsheet previews, create sample spreadsheets, import Google Docs content as templates and process selected attachments. The drive.readonly scope permits reading, not modifying, Drive files. The separate drive.file scope grants per-file access to files you select or create with the app; it is not a read-only scope.

Contacts

Mail Merge requests no Google Contacts scope to populate recipient lists. Recipients can come from spreadsheets, saved Mail Merge contacts and lists, or direct app/tool inputs. Saved contacts and custom fields are stored in our backend for reuse.

Offline access (acting on your behalf while you’re signed out)

Authorized background features can continue while you are signed out, including scheduled and throttled campaigns, spreadsheet status updates, and campaign reply/bounce detection. Google refresh tokens are stored encrypted. Revoke Google access at myaccount.google.com/connections to stop future operations that require that permission. Revocation does not erase data already processed.

Optional warm-up uses its own stored, encrypted App Password. Stop warm-up separately and revoke the App Password in your Google account when you no longer want that connection.

What happens to your recipient list

What our servers receive

When you launch a campaign, the recipient rows needed to send it — email addresses, cc/bcc, and the merge-field values used to personalize each message — are sent to our backend (Google Cloud / Firebase), along with the message template and any attachments. This is what makes scheduling, throttling, daily-quota handling, and open/click tracking possible.

When you connect an AI assistant, it sends tool inputs to Mail Merge and receives results such as contact fields, spreadsheet previews, template content and campaign activity. These results can contain personal information. Mail Merge’s own AI generation also sends submitted prompts through its AI service providers. The privacy policy describes these recipients and processing in detail.

How long it is stored, and how it is deleted

• Queued and active campaigns: expiry is calculated from expected completion plus seven days, and adjusted when scheduling, throttling or autopilot changes. Pausing generally sets a 30-day grace period.
• Completed or stopped campaigns: free-plan history becomes eligible for deletion after three days. Campaigns completed or stopped during an active paid subscription have no automatic history-expiry timer. A later downgrade does not add one; request deletion of retained history you no longer need.
• Deleted scheduled campaigns: cancellation stops further sending, but their data generally becomes eligible for cleanup after approximately 24 hours. Expiry and cleanup run asynchronously; these are not guaranteed erasure deadlines. Campaign cleanup also attempts to remove queued recipient jobs and associated campaign attachments.
• Saved contacts, lists, templates and template files are retained for ongoing use until deleted or handled through a data deletion request. Deleting a list does not delete its contacts.
• Delivery/engagement statuses (Sent, Opened, Clicked, Error) can be stored in backend campaign, tracking and analytics records and written back into your spreadsheet. Campaign expiry does not erase all these separate records or your Google account’s copy.
• Unsubscribes are kept. When a recipient clicks the unsubscribe link, we store that address flagged as unsubscribed under your account so future campaigns automatically exclude it. Keeping this list helps honor the recipient’s choice.
• Your account record (email, subscription/billing status, saved templates, quota counters) persists for as long as you have an account.

Account, tracking, analytics, diagnostic, suppression and provider records do not all share a fixed automatic expiry. See the privacy policy for retention criteria and controls across these categories.

For an account or data deletion request, email contact@merge.email with the account address and scope of your request. Uninstalling the add-on, revoking access or deleting a main account record alone does not erase every associated record or copies already held by recipients and providers.