Privacy Policy

Applies to the "Mail Merge for Outlook" add-in and this website. Last updated: 3 July 2026.

The short version

Your contacts and your emails never touch our servers. All mail-merge processing happens inside the add-in in your browser, and emails are sent directly from your mailbox via Microsoft's own API (Microsoft Graph). The only data our server ever stores is what's needed to validate Pro license keys.

Data we do NOT collect

Your recipient lists (CSV/Excel/pasted data) — parsed locally in your browser, never uploaded to us.
Your email content — messages go from your browser straight to Microsoft Graph.
Your Microsoft password — sign-in is handled by Microsoft (MSAL); we never see credentials.
Analytics, tracking pixels, or advertising identifiers — none are used.

Data we process

Microsoft account token (in your browser only). When you connect your account, Microsoft issues the add-in a token with permission to send mail as you (Mail.Send) and read your basic profile (User.Read). The token stays in your browser's local storage and is used only to call Microsoft Graph. You can revoke it anytime at myapps.microsoft.com or by uninstalling the add-in.
License activation (Pro only). When you activate a license key, our licensing API (hosted on Cloudflare) stores the license key, its status, and the Microsoft account ID and email address it is bound to. This exists solely to prevent key sharing and validate your subscription.
Local settings. The add-in stores small items in your browser's local storage: your daily send counter and your cached license entitlement. These never leave your device.
Payments (Pro only). Subscriptions are processed by our merchant of record; we never see or store your card details. The payment provider's own privacy policy applies to checkout.

Where data lives

License records are stored in Cloudflare Workers KV. Website hosting is Cloudflare Pages. Everything else stays between your browser and Microsoft 365, under your organization's existing Microsoft agreements.

Data retention and deletion

License records are kept while your subscription is active and deleted on request after cancellation. To request deletion of your license record, email gaveeshags@gmail.com from the bound address.

Your responsibilities as a sender

You are the data controller for the recipient lists you import. Send only to people you may lawfully contact under applicable law (e.g. GDPR, CAN-SPAM).

Changes and contact

We'll update this page if our practices change; material changes will be noted in the add-in. Questions: gaveeshags@gmail.com.