1. Data Collection and Use

1.1. User Analytics

Our Services use Google Analytics to capture anonymized usage information ("User Analytics").
Google Analytics does not share any personally identifiable information with SmartMerge AI.
We collect information about your device and its software, such as browser type and version, operating system, device type, date and time of access, pages visited, and feature usage frequency.
This information is used exclusively for operating, maintaining, and improving our Services.
We do not collect personally identifiable information outside your Google account.

1.2. Personal Data in Your Spreadsheets and Documents

SmartMerge AI provides the ability to merge spreadsheet data with Google Doc templates and optionally generate AI-personalized content.
In order for our add-on to function, it requires access to data in your Google Sheets and Google Docs ("Personal Data").
Important: Our add-on only interacts with the Personal Data that you consent to and explicitly select.
All operations performed on Personal Data are carried out within and under the authority of your Google account.
We do not transmit your spreadsheet content, document content, or Personal Data to SmartMerge AI servers.
Any documents created by our add-on are stored in your Google Drive under your control.
All intellectual property rights to your Personal Data are retained by you.

1.3. Settings and Preferences

SmartMerge AI stores your configuration settings (template selections, field mappings, merge preferences) using Google's Document Properties.
These settings are stored per-spreadsheet within Google's infrastructure.
Settings are not transmitted to SmartMerge AI servers.

2. AI Personalization Feature and Gemini API Data Disclosure

2.1. How AI Personalization Works

When you enable the AI Personalization feature, SmartMerge AI sends data to Google's Gemini API to generate personalized content for your merged documents. This section describes exactly what data is sent, when, and how it is handled.

2.2. What Data Is Sent to Google's Gemini API

When AI personalization is active during a merge, the following data is transmitted to the Gemini API:

Spreadsheet row data: The column values for the current row being processed. Only columns relevant to the merge are included — not your entire spreadsheet.
Your AI prompt/instructions: The text you enter in the AI personalization step of the wizard, with {{placeholder}} values replaced by actual data from the current row.
Google Doc template structure: The section structure and headings of your selected template document are sent to provide context for AI content generation.

Example: If your prompt is "Write a comment for {{studentName}} about their {{grade}} score," and the row contains "Sarah" and "92%," the text sent to Gemini would be "Write a comment for Sarah about their 92% score," along with the relevant template section context.

What is NOT sent: Your entire spreadsheet, other rows not currently being processed, files unrelated to the merge, or any data from other spreadsheets or documents.

2.3. When Data Is Sent

Data is sent to the Gemini API only during active merge operations where you have enabled AI personalization.
Data is sent row-by-row — one API call per spreadsheet row being merged. Each call contains only the data for that specific row.
No data is sent to the Gemini API if AI personalization is disabled. You can perform standard merges without any external API calls.

2.4. How Google Processes This Data

Data is processed by Google's Gemini 2.0 Flash model via the Gemini API.
Google's processing of this data is governed by Google's own AI terms of service and privacy policies.
For details on how Google handles data sent to the Gemini API, see Google's Gemini API Terms of Service and Google's Privacy Policy.

2.5. Use of Data for AI/ML Model Training

We do not use any data obtained from Google Workspace APIs (including spreadsheet data, document content, or data sent to the Gemini API) to develop, improve, or train our own or any other artificial intelligence and/or machine learning models. Google's handling of data is governed by their terms, as linked above.

2.6. Data Retention

SmartMerge AI does not store, log, or retain any data sent to or received from the Gemini API beyond the active merge session. Once the AI-generated content is inserted into your merged document, no copy is kept by SmartMerge AI.
Google's data retention for Gemini API calls is governed by Google's own terms and policies. SmartMerge AI has no control over Google's retention practices.
No spreadsheet data is permanently stored by the AI service on SmartMerge AI's side. All generated documents are saved to your Google Drive under your control.
The Gemini API key is stored securely in Google Apps Script's Script Properties (not accessible to users or exposed in client-side code).

2.7. Your Control Over AI Data

AI personalization is entirely optional. You can use SmartMerge AI's full merge functionality without enabling AI features.
You choose what data is included. You select which rows to merge and which columns to reference in your AI prompt. Only the data you include is sent to the API.
You can review AI-generated content before finalizing documents through the AI Preview feature, giving you full control over what appears in your final merged documents.
When AI is disabled, no data is sent to any external APIs.

3. Add-on Authorization Scopes

Our add-on requires specific permissions to function. We request only the minimum permissions necessary:

3.1. Permissions We Request

drive.file: Access only the template documents and destination folders you explicitly select through the Google Picker. We cannot see or access any other files in your Drive.
spreadsheets.currentonly: Read your spreadsheet data (column headers, row content) to perform the mail merge. We only access the spreadsheet where you opened the add-on.
Display third-party content: Display the SmartMerge AI sidebar interface within Google Sheets.
Connect to external service: Send AI prompts to Google's Gemini API when AI Personalization is enabled.
Connect to Stripe: Process subscription payments securely through Stripe when you upgrade your plan.

3.2. Why We Use drive.file Instead of Full Drive Access

Unlike some legacy merge tools that request access to your entire Google Drive, SmartMerge AI uses the narrow drive.file scope. This means:

We can only access files you explicitly select through the Google Picker.
We cannot browse, search, or access any other files in your Drive.
IT departments can approve our add-on with confidence.

3.3. Google API Services User Data Policy

SmartMerge AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.4. Reviewing Your Permissions

You can review and revoke access to your Google Account at any time:

Go to myaccount.google.com/permissions
Find "SmartMerge AI" in the list
Click to view or remove access

4. Payment Data

When you purchase a subscription to SmartMerge AI, your payment is processed by a third-party payment processor, Stripe.

We do not collect, store, or have access to your credit card details or other sensitive payment information.
Your payment information is provided directly to Stripe, and its use is governed by Stripe's Privacy Policy.

5. How We Share Information

5.1. With Third Parties

We may share anonymized User Analytics with trusted third-party service providers who perform technology services on our behalf (e.g., data storage, analysis), exclusively for the purpose of carrying out their work for us.
Contractors and service providers who may have access to User Analytics are subject to the same confidentiality and data security requirements as SmartMerge AI employees.
We do not rent or sell information for marketing purposes.
We will never share or sell User Analytics with third parties for marketing purposes.

5.2. Legal Requirements

We may be required to share information with law enforcement or other third parties when:

Compelled by court order or other legal process.
Required to comply with statutes or regulations.
We believe in good faith that disclosure is necessary to protect the rights, property, or personal safety of our users.

6. Data Security

6.1. Our Security Practices

All data transmission between your browser and Google's servers is encrypted using HTTPS/TLS.
We do not operate our own servers for storing user data.
Your spreadsheet and document data remains within Google's secure infrastructure.
API keys and sensitive configuration are stored in Google Apps Script's secure Script Properties.
We follow Google's security guidelines for Workspace Add-ons.

6.2. Your Responsibility

You are responsible for maintaining the security of your Google account.
Use strong passwords and enable two-factor authentication on your Google account.
Be mindful of what personal data you include in AI personalization prompts.

7. Your Rights and Choices

7.1. Data Access and Portability

Your spreadsheet data, documents, and generated files are stored in your Google Drive under your full control.
You can export, download, or delete this data at any time through Google Drive.

7.2. Opting Out of Analytics

To opt out of having your User Analytics captured, you can install the Google Analytics opt-out browser add-on.
This prevents Google Analytics JavaScript from sharing information about your activity.

7.3. Deleting Your Data

Uninstalling SmartMerge AI removes the add-on from your Google Sheets.
Settings stored in Document Properties remain in the spreadsheet file; delete the spreadsheet to remove them.
Generated documents in your Google Drive can be deleted by you at any time.
We do not retain any of your Personal Data on our servers.

7.4. Do Not Track

At this time, our Services do not respond to Do Not Track ("DNT") browser signals.

8. Age Requirements and Children's Privacy

SmartMerge AI requires all users to be 18 years of age or older. This requirement reflects the terms of the Google Gemini API, which powers SmartMerge AI's AI Personalization feature and requires all users to be 18+. We do not knowingly collect personal information from individuals under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at info@getsmartmerge.com so we can take appropriate action.

8.1. AI Personalization and the Gemini API

The AI Personalization feature is powered by Google's Gemini API, whose Additional Terms of Service explicitly require users to be 18 years of age or older. All use of SmartMerge AI — including both AI-powered and basic merge functionality — is restricted to users 18 and older to ensure consistent compliance.

8.2. Use in Educational Settings

Educators may use SmartMerge AI to process student data (e.g., generating personalized report cards or letters). In such cases:

The educator (not the student) is the user of the add-on and must be 18 or older.
The educational institution is the data controller and is responsible for compliance with applicable student privacy laws (e.g., FERPA, COPPA).
Student data processed through AI Personalization is subject to the same protections described in Section 2 of this policy.

9. EU General Data Protection Regulation (GDPR)

SmartMerge AI is designed to be GDPR compliant.

9.1. Data Controller

SmartMerge AI acts as the data controller for User Analytics collected through Google Analytics. For spreadsheet and document data processed through our add-on, you (the user) are the data controller — SmartMerge AI acts as a data processor operating under your instructions when you initiate a merge. When data is sent to Google's Gemini API for AI personalization, Google acts as an independent data processor under its own terms.

9.2. What We Collect and Our Basis for Doing So

User Analytics: We collect anonymized usage information through Google Analytics for the legitimate interest of operating, maintaining, and improving our Services (GDPR Article 6, Section 1(f)).
Settings/Preferences: Stored with your consent when you configure the add-on.

9.3. What We Do Not Collect

We do not collect or maintain any spreadsheet content, document content, or personally identifiable information from your files.
We do not transmit your Personal Data to SmartMerge AI servers.
All operations on your data are performed within your Google account.

9.4. Your GDPR Rights

As an EU resident, you have the right to:

Access: Request information about what data we hold about you.
Rectification: Request correction of inaccurate data.
Erasure: Request deletion of your data.
Portability: Receive your data in a portable format.
Object: Object to processing of your data.
Restrict: Request restriction of processing.

To exercise these rights, contact us at info@getsmartmerge.com.

10. California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the CCPA:

Right to Know: You can request disclosure of the categories and specific pieces of personal information we collect.
Right to Delete: You can request deletion of your personal information.
Right to Opt-Out: You can opt out of the sale of your personal information (note: we do not sell personal information).
Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at info@getsmartmerge.com.

11. International Data Transfers

SmartMerge AI operates primarily through Google's infrastructure. Your data may be processed in various locations where Google operates data centers. Google maintains appropriate safeguards for international data transfers, including EU Standard Contractual Clauses where applicable.

When you use AI Personalization, data is processed by Google's Gemini API, which may involve international data transfers subject to Google's data processing terms.

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our Services or legal requirements. When we make changes:

We will update the "Last Modified" date at the top of this page.
For material changes, we will provide notice through the add-on or via email (if we have your contact information).
Your continued use of the Services after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: info@getsmartmerge.com

Website: getsmartmerge.com/contact

Privacy Policy