Privacy Policy

Last updated: 2026-11-02

This Privacy Policy describes how Emerge: Mail Merge (the "Add-on") handles your information. Emerge: Mail Merge is a Google Workspace add-on that runs inside Google Sheets. It reads the recipients and message template from your spreadsheet, renders a personalized email for each row, and sends it through your own Gmail account. Optionally, it can measure opens and clicks using Google Analytics, and you can connect it to an account on Emerge, our email platform, for higher sending limits, tracking, and more.

1. Where the Add-on runs and where your data lives

The Add-on's logic runs in Google Apps Script, inside your own Google account, under the permissions you grant during installation. Your spreadsheet data, message templates, and settings stay within your Google account. The Add-on's authors do not operate a server that stores your spreadsheet contents, your templates, your recipient list, or the email you send.

There are three exceptions, described below: the optional analytics feature, which uses a small, stateless tracking relay (Section 3); the optional connection to an Emerge account (Section 4), which you start yourself; and a usage record of each send (Section 5). If you never enable analytics or connect an Emerge account, neither of the first two is used.

2. Google user data and OAuth scopes

When you install Emerge: Mail Merge, Google asks you to authorize a set of OAuth scopes. We request only the scopes needed for the Add-on's features. The sections below describe each scope, the data it grants access to, and exactly how that data is used.

https://www.googleapis.com/auth/spreadsheets

What it grants: Read and write access to your Google Sheets spreadsheets.

How we use it: To read your recipient rows and column headers so each message can be personalized, and to store your message templates and campaign settings alongside the spreadsheet. The Add-on operates on the spreadsheet you open it from. It is not used to browse, collect, or transmit any other spreadsheet content.

https://www.googleapis.com/auth/gmail.send

Google's description: Send email on your behalf.

What it grants: Permission to send new outbound messages through Gmail. This scope is write-only — it does not allow reading, searching, or modifying existing messages, drafts, labels, threads, or settings.

How we use it: To deliver the personalized campaign emails you compose, one per recipient row, from your own Gmail account. Messages are sent only when you start a send. The Add-on never reads your mailbox.

https://www.googleapis.com/auth/userinfo.email

Google's description: See your primary Google Account email address.

How we use it: To identify your account and to offer your own address as the default sender / reply-to for a campaign. It is not shared with anyone.

https://www.googleapis.com/auth/userinfo.profile

Google's description: See your personal info, including any personal info you've made publicly available.

How we use it: To read your name and pre-fill the "Sender name" field so your recipients see a real name rather than a blank. You can change or clear it at any time. It is not shared with anyone.

https://www.googleapis.com/auth/analytics.edit

What it grants: Permission to create and configure Google Analytics resources in your Analytics account.

How we use it: Only when you turn on open/click tracking. The Add-on provisions a dedicated "Emerge Mail Merge" Google Analytics property, a data stream, and a write-only Measurement Protocol secret in your own Analytics account, so tracking events have somewhere to land. It does not modify your other Analytics properties.

https://www.googleapis.com/auth/analytics.readonly

What it grants: Read-only access to your Google Analytics reporting data.

How we use it: Only when tracking is enabled. The Add-on reads aggregated open and click metrics for your campaigns from the property it created and displays them in the Add-on's dashboard. It does not change any Analytics data.

https://www.googleapis.com/auth/script.scriptapp

What it grants: Permission for the Add-on to manage its own Apps Script triggers.

How we use it: To run large campaigns as a background queue. The Add-on schedules time-based triggers that send batches of messages over time, so a campaign stays within Gmail's sending limits and continues even after you close the spreadsheet. It accesses no personal data.

https://www.googleapis.com/auth/script.external_request

What it grants: Permission for the Add-on to make outbound network requests.

How we use it: To look up your profile name from Google's standard userinfo endpoint; when analytics is enabled, to build the tracking links embedded in your emails; to record send usage (Section 5); and, only if you connect an Emerge account, to exchange the data described in Section 4 with Emerge. Without a connected Emerge account, the Add-on does not transmit your spreadsheet contents or email bodies to any external service.

https://www.googleapis.com/auth/script.container.ui

What it grants: Permission to display the Add-on's user interface (sidebar and dialogs) inside Google Sheets.

How we use it: Solely to show the Add-on's compose, preview, send, and dashboard screens. It accesses no user data.

3. Open and click tracking (optional)

Open/click tracking is off unless you enable it. When enabled, each message includes a 1×1 tracking pixel and its links are wrapped so they pass through a small relay we operate (at app.emerge-email.com) before redirecting to the real destination. This relay exists because email clients can only issue simple web requests, while the Google Analytics Measurement Protocol requires a server-side call. (With a connected Emerge account, tracking works differently — see Section 4.)

The tracking link carries, in its URL:

• your Analytics measurement ID and a write-only Measurement Protocol secret (both belonging to the property in your own Analytics account);
• a random per-recipient identifier (not the recipient's email address);
• the campaign name and the email subject;
• for a clicked link, the destination URL.

When a recipient opens the email or clicks a link, their request reaches the relay. The relay forwards a corresponding event to Google Analytics and then returns the tracking pixel or redirects to the destination. It also processes standard request metadata (such as IP address and user-agent) for the duration of that request. From that metadata the relay derives, and includes in the analytics event, a coarse location (country, and where the network provides it, region and city) and the device type (device category, operating system, and browser), so you can see where and on what your recipients engaged. It does not derive or store a precise location or the raw IP address. The relay is stateless: it stores none of this data, keeps no database of recipients or events, and never receives recipients' email addresses or the body of any message. The resulting open/click metrics — including the coarse location and device breakdowns — live only in your own Google Analytics property.

4. Connecting an Emerge account (optional)

You can connect the Add-on to an account on Emerge, our email platform, from the Add-on's Account screen. Connecting is always your choice and happens only when you approve it in an Emerge window; Emerge's own Privacy Policy and Terms of Service then also apply to the data below. While connected, the Add-on sends Emerge only what's needed for the features you use:

• Your Google account's email address, to label the connection in your Emerge workspace.
• When you connect: a short-lived Google access token belonging to the Add-on. Emerge passes it only to Google, to confirm that the connection really comes from this Add-on signed in as that email address, and then discards it — Emerge does not store it or use it to access your Google account.
• For each send through Emerge: the spreadsheet's ID and name, the sheet's name, the email subject, each recipient's address, and a random per-recipient identifier — so the send counts toward your Emerge plan's limits, suppressed addresses (ones that bounced, complained, or unsubscribed) are skipped, and opens and clicks are recorded. Emerge also checks each recipient's domain in public DNS to skip addresses that can't receive email, and records an address the receiving server refuses outright as a bounce.
• For sending: while your Emerge workspace has a working sender, the full personalized message for each recipient (subject, body, Cc/Bcc, reply-to, and attachments), which Emerge sends through those senders instead of your Gmail, adding an unsubscribe link (unless you turn it off) and a one-click unsubscribe header; recipients who unsubscribe are recorded so later sends skip them. Until it has one, the Add-on keeps sending from your Gmail under its own free plan, as if not connected, and these messages are not sent to Emerge.
• If you use "Follow up with non-openers" or "Save as list": the recipients' addresses and, for a follow-up, the sheet's column values for those rows, which become contacts and a draft campaign in your Emerge workspace.

With a connected account, open and click tracking is done by Emerge instead of Google Analytics: each message carries an Emerge tracking pixel and its links pass through Emerge's click redirect, and Emerge records which recipients opened or clicked so the Add-on can show and write back those results. This data is kept for your Emerge plan's retention period. The Add-on never sends Emerge your Google password, and Emerge does not access your mailbox or other spreadsheets. You can disconnect at any time from the Add-on's Account screen or from your Emerge account settings; the Add-on then stops sending data to Emerge, and you can delete the data already in your Emerge workspace there.

5. Usage records

To operate the free plan's daily sending limit and to understand how the Add-on is used, each time you open the Add-on or send, it records a usage entry with our usage service: your Google account's email address, the time, the number of emails sent, the email subject, the body's size, the sending address used, and your IP address with the approximate location and time zone derived from it. It does not include recipients or email bodies.

6. Data security

Unless you connect an Emerge account, your spreadsheet data, message templates, recipient lists, and email content never leave your Google account, and remain protected by Google's own infrastructure and by the account permissions you control. Data sent to a connected Emerge account travels over HTTPS and is protected as described in Emerge's Privacy Policy. All traffic between the Add-on and Google's APIs, and between your recipients' email clients and the optional tracking relay, travels over encrypted HTTPS/TLS connections. The relay stores nothing and holds no credential to your account; the only secret it forwards is the write-only Measurement Protocol key belonging to — and confined to — your own Google Analytics property. Access to our relay's operational infrastructure is limited to authorized personnel for security and maintenance.

7. What we do not do

• We do not store your spreadsheet contents, recipient lists, templates, or sent email on our servers — except the data described in Section 4, and only while you've connected an Emerge account.
• We do not read your Gmail mailbox; the Gmail scope is send-only.
• We do not sell or rent your data, or any data about your recipients.
• We do not use your Google user data to serve advertising.
• We do not use your Google user data to train, fine-tune, or evaluate any machine-learning or AI model.
• We do not allow humans to read your Google user data, except with your consent, for security purposes, or to comply with law.

8. Limited Use compliance

Emerge: Mail Merge's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the user-facing features described above and is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice to you. Data is transferred to Emerge only when you connect an Emerge account, and only to provide the features you use there.

9. Data retention

Templates and settings persist in your spreadsheet until you delete them or the spreadsheet. Data in a connected Emerge workspace is kept under your Emerge plan's retention period, or until you delete it there. Tracking events transit the relay in memory only and are not retained by us; the aggregated metrics are retained by Google Analytics under your Analytics account's own retention settings. Standard server access logs for the relay may be kept briefly for security and operational purposes.

10. Revoking access

You can revoke the Add-on's access at any time by:

• removing or uninstalling the Add-on from Google Sheets, and
• revoking it from your Google Account permissions.

To stop tracking, turn off analytics in the Add-on; you may also delete the "Emerge Mail Merge" property from your Google Analytics account. To stop sharing data with Emerge, disconnect your Emerge account in the Add-on's Account screen.

11. Children

The Add-on is intended for use by adults sending email from their own accounts and is not directed to children under 13.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page.

13. Contact

Questions about this policy can be sent to support@redigit.net.