1. Data Collection and Use

1.1. User Analytics

Our Services use Google Analytics to capture anonymized usage information ("User Analytics").
Google Analytics does not share any personally identifiable information with SmartMerge AI.
We collect information about your device and its software, such as browser type and version, operating system, device type, date and time of access, pages visited, and feature usage frequency.
This information is used exclusively for operating, maintaining, and improving our Services.
We do not collect personally identifiable information outside your Google account.

1.2. Personal Data in Your Spreadsheets and Documents

SmartMerge AI provides the ability to merge spreadsheet data with Google Doc templates and optionally generate AI-personalized content.
In order for our add-on to function, it requires access to data in your Google Sheets and Google Docs ("Personal Data").
Important: Our add-on only interacts with the Personal Data that you consent to and explicitly select.
All operations performed on Personal Data are carried out within and under the authority of your Google account.
We do not transmit your spreadsheet content, document content, or Personal Data to SmartMerge AI servers.
Any documents created by our add-on are stored in your Google Drive under your control.
All intellectual property rights to your Personal Data are retained by you.

1.3. Settings and Preferences

SmartMerge AI stores your configuration settings (template selections, field mappings, merge preferences) using Google's Document Properties.
These settings are stored per-spreadsheet within Google's infrastructure.
Settings are not transmitted to SmartMerge AI servers.

2. AI Personalization Feature

2.1. How AI Personalization Works

When you enable the AI Personalization feature, SmartMerge AI sends your AI prompt (with merged data from your spreadsheet) to Google's Gemini API to generate personalized content.

2.2. Data Sent to Google Gemini API

What is sent: Your AI prompt text with {{placeholder}} values replaced by actual data from the current spreadsheet row.
Example: If your prompt is "Write a comment for {{studentName}} about their {{grade}} score," and the row contains "Sarah" and "92%," the text sent to Gemini would be "Write a comment for Sarah about their 92% score."
What is NOT sent: Your entire spreadsheet, document template, or any data beyond what's included in your AI prompt.

2.3. Google Gemini API Privacy

AI personalization requests are processed by Google's Gemini API.
Google's Gemini API is subject to Google's AI Terms of Service and Privacy Policy.
SmartMerge AI does not store, log, or retain any data sent to or received from the Gemini API.
The Gemini API key is stored securely in Google Apps Script's Script Properties (not accessible to users or exposed in code).

2.4. Opting Out of AI Features

AI Personalization is entirely optional.
You can use SmartMerge AI's core merge functionality without enabling AI features.
When AI is disabled, no data is sent to external APIs.

3. Add-on Authorization Scopes

Our add-on requires specific permissions to function. We request only the minimum permissions necessary:

3.1. Permissions We Request

drive.file: Access only the template documents and destination folders you explicitly select through the Google Picker. We cannot see or access any other files in your Drive.
spreadsheets.currentonly: Read your spreadsheet data (column headers, row content) to perform the mail merge. We only access the spreadsheet where you opened the add-on.
Display third-party content: Display the SmartMerge AI sidebar interface within Google Sheets.
Connect to external service: Send AI prompts to Google's Gemini API when AI Personalization is enabled.
Send email as you (Pro feature): Send merged documents as email attachments to recipients you specify. Emails are only sent when you explicitly configure and execute this feature.

3.2. Why We Use drive.file Instead of Full Drive Access

Unlike some legacy merge tools that request access to your entire Google Drive, SmartMerge AI uses the narrow drive.file scope. This means:

We can only access files you explicitly select through the Google Picker.
We cannot browse, search, or access any other files in your Drive.
IT departments can approve our add-on with confidence.

3.3. Reviewing Your Permissions

You can review and revoke access to your Google Account at any time:

Go to myaccount.google.com/permissions
Find "SmartMerge AI" in the list
Click to view or remove access

4. How We Share Information

4.1. With Third Parties

We may share anonymized User Analytics with trusted third-party service providers who perform technology services on our behalf (e.g., data storage, analysis), exclusively for the purpose of carrying out their work for us.
Contractors and service providers who may have access to User Analytics are subject to the same confidentiality and data security requirements as SmartMerge AI employees.
We do not rent or sell information for marketing purposes.
We will never share or sell User Analytics with third parties for marketing purposes.

4.2. Legal Requirements

We may be required to share information with law enforcement or other third parties when:

Compelled by court order or other legal process.
Required to comply with statutes or regulations.
We believe in good faith that disclosure is necessary to protect the rights, property, or personal safety of our users.

5. Data Security

5.1. Our Security Practices

All data transmission between your browser and Google's servers is encrypted using HTTPS/TLS.
We do not operate our own servers for storing user data.
Your spreadsheet and document data remains within Google's secure infrastructure.
API keys and sensitive configuration are stored in Google Apps Script's secure Script Properties.
We follow Google's security guidelines for Workspace Add-ons.

5.2. Your Responsibility

You are responsible for maintaining the security of your Google account.
Use strong passwords and enable two-factor authentication on your Google account.
Be mindful of what personal data you include in AI personalization prompts.

6. Your Rights and Choices

6.1. Data Access and Portability

Your spreadsheet data, documents, and generated files are stored in your Google Drive under your full control.
You can export, download, or delete this data at any time through Google Drive.

6.2. Opting Out of Analytics

To opt out of having your User Analytics captured, you can install the Google Analytics opt-out browser add-on.
This prevents Google Analytics JavaScript from sharing information about your activity.

6.3. Deleting Your Data

Uninstalling SmartMerge AI removes the add-on from your Google Sheets.
Settings stored in Document Properties remain in the spreadsheet file; delete the spreadsheet to remove them.
Generated documents in your Google Drive can be deleted by you at any time.
We do not retain any of your Personal Data on our servers.

6.4. Do Not Track

At this time, our Services do not respond to Do Not Track ("DNT") browser signals.

7. Children's Privacy

SmartMerge AI is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete such information.

Note: Educators may use SmartMerge AI to process student data. In such cases, the educational institution is the data controller and is responsible for compliance with applicable student privacy laws (e.g., FERPA, COPPA).

8. EU General Data Protection Regulation (GDPR)

SmartMerge AI is designed to be GDPR compliant.

8.1. What We Collect and Our Basis for Doing So

User Analytics: We collect anonymized usage information through Google Analytics for the legitimate interest of operating, maintaining, and improving our Services (GDPR Article 6, Section 1(f)).
Settings/Preferences: Stored with your consent when you configure the add-on.

8.2. What We Do Not Collect

We do not collect or maintain any spreadsheet content, document content, or personally identifiable information from your files.
We do not transmit your Personal Data to SmartMerge AI servers.
All operations on your data are performed within your Google account.

8.3. Your GDPR Rights

As an EU resident, you have the right to:

Access: Request information about what data we hold about you.
Rectification: Request correction of inaccurate data.
Erasure: Request deletion of your data.
Portability: Receive your data in a portable format.
Object: Object to processing of your data.
Restrict: Request restriction of processing.

To exercise these rights, contact us at info@getsmartmerge.com.

9. California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the CCPA:

Right to Know: You can request disclosure of the categories and specific pieces of personal information we collect.
Right to Delete: You can request deletion of your personal information.
Right to Opt-Out: You can opt out of the sale of your personal information (note: we do not sell personal information).
Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at info@getsmartmerge.com.

10. International Data Transfers

SmartMerge AI operates primarily through Google's infrastructure. Your data may be processed in various locations where Google operates data centers. Google maintains appropriate safeguards for international data transfers, including EU Standard Contractual Clauses where applicable.

When you use AI Personalization, data is processed by Google's Gemini API, which may involve international data transfers subject to Google's data processing terms.

11. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our Services or legal requirements. When we make changes:

We will update the "Last Modified" date at the top of this page.
For material changes, we will provide notice through the add-on or via email (if we have your contact information).
Your continued use of the Services after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: info@getsmartmerge.com

Additional Resources

Privacy Policy