Privacy notice

Mail Merge Pre-flight Check is a Google Workspace™ editor add-on for Google Sheets™, published by AppGarden. This notice states what Google user data the add-on accesses, how it is used, who it is shared with, how it is protected, and how long it is kept. Sections 1–5 are the disclosures Google's API Services User Data Policy requires.

1. What Google user data the add-on accesses

The add-on requests exactly two OAuth scopes, and accesses only this data through them:

`spreadsheets.currentonly`	The contents of the one spreadsheet you open the add-on in: cell values, displayed values, number formats and formulas of the list tab you choose, the names of its tabs, and which rows are hidden or filtered. It also creates new tabs in that spreadsheet when you ask. It cannot see any other file in your Drive.
`script.container.ui`	No user data. This lets the add-on show its sidebar and dialogs.

The add-on also keeps small settings in Google Apps Script™ properties: your licence key, an anonymous install id generated on your machine, any campaign you choose to save (tab name, merge tool, template and settings), a pointer to the last campaign you used, and a one-off flag set by the “Re-check last list” menu item. The sidebar also keeps a copy of your licence record and a “welcome screen seen” flag in its own browser storage. The email template itself is text you paste into the sidebar.

The add-on does not access your Gmail™, your email address, your contacts, your Drive files, your Google profile or any other Google service. It cannot read or send your email. That is why the template is pasted in rather than read from your drafts.

2. How the add-on uses Google user data

Spreadsheet data is used only to provide the features you use, when you use them:

to run the checks (blank fields, broken merge tags, duplicates, typo'd addresses, sending quota) and show the findings in the sidebar;
to show a preview of what each recipient will receive;
to write the new tabs you ask for (Ready to send, Excluded, Pre-flight report, Batches, Preview), and to remove them again when you choose "Remove pre-flight tabs".

All checking runs inside the sidebar in your own browser session. The add-on never writes to the tab your list is in. Google user data is not used for advertising, is not sold, and is not used to develop, improve or train generalised or non-generalised AI or machine-learning models. No human at AppGarden reads it.

Nobody. Spreadsheet contents, recipient names and addresses, the template, sheet names and file identifiers are never sent to AppGarden or to any third party.

Only these things ever leave Google, and none of them is spreadsheet content:

Licence check: your licence key, the anonymous install id and the host (“sheets”) are sent to AppGarden's licence server (hosted on Cloudflare) to confirm your tier; later checks also send the activation id the server issued. None of this is Google user data.
Mail-server check (Pro, off by default): only if you switch it on, the domain names in your list (for example example.com, never a full address) are looked up with DNS-over-HTTPS at Google Public DNS (dns.google). Leave it off and no domain leaves your browser.

Payments are handled by Paddle.com Market Limited, the merchant of record, which receives what you enter at checkout, never any Google user data. After a purchase, AppGarden's licence server emails your licence key to the address Paddle holds for you, through the email service Resend; that address comes from Paddle, not Google, and is not stored by AppGarden. AppGarden does not sell, rent or transfer Google user data, and would disclose data only if required by law; since it never receives spreadsheet data, there is none to disclose.

4. How Google user data is secured and protected

Minimum access: spreadsheets.currentonly limits the add-on to the one file it is opened in; no Drive-wide or Gmail™ scope is requested.
Processed locally: spreadsheet data is processed in your browser and read and written through Google's own APIs. It is never stored on AppGarden servers, so there is no copy of it to breach.
Source tab never modified: results go to new tabs only.
Encrypted in transit: the licence check and the optional DNS lookup use HTTPS (TLS) only.
No third-party code in the sidebar: no analytics, advertising, tracking or externally hosted scripts; all of its code ships with the add-on.
Error logs: if the add-on hits an error, Google records the error message in the add-on's own Google Cloud™ logs so the fault can be fixed. A message can name a tab, but never includes cell values or template text. Only AppGarden can see these logs, and Google deletes them after its standard retention period.
If something goes wrong: if AppGarden becomes aware of a security incident affecting any data it holds, it will notify affected users without undue delay, and the UK Information Commissioner's Office and Google where required.
Access control: settings live in Google Apps Script™ properties, protected by your Google account; the licence server is accessible only to AppGarden, with credentials held in Cloudflare's secret store.

5. Retention and deletion of Google user data

Spreadsheet data: held in browser memory only while the sidebar is open, and discarded when you close it. It is never retained by AppGarden.
Tabs the add-on created: stay in your spreadsheet until you delete them. "Remove pre-flight tabs" deletes all of them in one step.
Saved campaigns: kept in your spreadsheet's or your own Apps Script™ properties until you delete them in the sidebar.
Licence record: key and install id are kept in your Apps Script™ user properties until you choose "Remove licence" in the sidebar. AppGarden's server keeps the key, its tier and status, and the install ids and activation dates of the installs using it, until you ask for them to be deleted. This is not Google user data.
Deletion on request: email support@appgarden.co.uk and AppGarden will delete the record for your key within 30 days. You can also revoke the add-on's access at any time at myaccount.google.com/permissions.

Limited Use

This add-on's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your recipients' personal data (UK GDPR)

Recipient lists are often personal data, sometimes children's data from school lists. AppGarden is not a processor of your recipients' data, because it never reaches us. You, the list owner, remain the controller. If you email us a sheet for support, only send one you are content to share, and strip out what support does not need to see.

Your rights

Email support@appgarden.co.uk to ask what is held against a licence key, to correct it, or to have it deleted.

Changes to this notice

If this notice changes materially, the date below is updated and the change is described here.

Last updated: 25 September 2026.