AAalavaya Mail Merge Pro← Back to Home

Privacy Policy

Last updated: October 11, 2026

1. Introduction

Aalavaya Mail Merge Pro is a Google Workspace Add-on that enables users to send personalized emails from Google Sheets. Aalavaya Mail Merge Pro is provided by Aalavaya Software Private Limited ("Aalavaya", "we", "our", or "us"). This Privacy Policy explains how we collect, use, store, and protect your information when you use our add-on, website, and related services.

2. Information We Collect

2.1 Information About You

  • Your Google account email address, name, Google account ID and profile picture URL, received when you sign in with Google (used for authentication and license management)
  • Payment information processed through Razorpay (we do not store card or bank details)
  • AI API keys you provide, if any (stored in your own Google Apps Script user properties; see Section 5)
  • WhatsApp/SMS provider credentials you provide, if any (Twilio or Meta), stored in your own Google Apps Script user properties and used only to call that provider
  • Messages you send us (for example support, account deletion or draft tester opt-out requests), including your email address. We use them only to handle your request.

2.2 Information Collected Automatically

  • Usage counts (number of emails, WhatsApp/SMS messages, PDFs and AI requests per day and month), used to enforce plan limits. No message content is part of these counts.
  • Campaign metadata: a campaign ID, the subject line, the completion time, and the number of recipients, sent and failed messages
  • Sign-in and account-change records (including the IP address of the request), kept in an audit log for security

2.3 Information About Your Recipients

  • Unsubscribe links. Every email carries an unsubscribe link. To create it, the add-on sends each recipient's email address to our backend, which returns a signed link for that address. The address is not stored at this step. It is contained in the signed link itself (signed, not encrypted).
  • Unsubscribe records. When a recipient uses that link, we store their email address, the time and the campaign ID for your account, so your future sends skip them. Before each send the add-on retrieves your account's list of unsubscribed addresses from our backend. Opt-outs recorded by earlier versions of the add-on are preserved and continue to be honored.
  • Re-subscribe. If you re-subscribe a contact who asked to receive your mail again, we record the address, who made the change and when, in an audit log.
  • Email verification. When you check addresses, only the domain part (for example, example.com) is looked up through Google Public DNS. Full addresses are not sent.
  • WhatsApp/SMS. When you send WhatsApp or SMS messages, the recipient phone numbers and the personalized message text are sent to the provider you configured (Twilio or the Meta WhatsApp Cloud API) using your own credentials.

2.4 Information We Do NOT Collect

  • We do not store the body of your emails on our servers. Emails are sent from your own Google account through Google's mail service.
  • We do not store your spreadsheet rows on our servers. The only recipient data we store is described in Section 2.3.
  • We only access spreadsheets that you open the add-on in, or that you select with the Google Picker. A spreadsheet you selected may also be accessed in the background, without the sheet being open, to run scheduled sends and follow-ups you have set up. The add-on cannot see other files in your Google Drive.
  • We do not sell, rent, or share your personal data with third parties for marketing

3. How We Use Your Information

  • To provide and maintain the Aalavaya Mail Merge Pro service
  • To manage your plan and paid periods, and enforce plan limits
  • To process payments through our payment provider (Razorpay)
  • To honor your recipients' unsubscribe requests in all of your future sends
  • To protect the service and your account (security and audit records)
  • To improve our service based on aggregated, anonymized usage patterns

4. Google API Services Usage

Aalavaya Mail Merge Pro's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from your spreadsheets is used only to provide the features you use (sending your messages, writing send status back to your sheet, and honoring unsubscribe requests) and is transferred only as described in Sections 2.3 and 6.

OAuth Scopes We Request

  • spreadsheets.currentonly — Read recipient data from the spreadsheet in which you open the add-on, and write send status back to it
  • drive.file — Access only the spreadsheets you select with the Google Picker, so scheduled sends and follow-ups can read and update them in the background through the Google Sheets API. It gives no access to any other file in your Google Drive.
  • script.send_mail — Send emails on your behalf using your Gmail/Workspace account
  • script.external_request — Communicate with our backend API, the Google Sheets API, Google Public DNS (domain checks), and the services you choose to configure (AI provider, Twilio or Meta for WhatsApp/SMS)
  • script.scriptapp — Create the triggers used for scheduled sends and follow-ups
  • script.container.ui — Show the add-on sidebar and dialogs inside Google Sheets
  • userinfo.email / email / openid / profile — Identify your account for sign-in and licensing

5. Data Storage & Security

  • Account, plan and payment status, usage, campaign metadata, audit and unsubscribe records are stored in our backend database, hosted by our cloud infrastructure provider
  • Any Gemini or OpenAI API key you provide is stored using Google Apps Script Properties and is used only to authenticate requests to the AI provider you select. The key is not sent to Aalavaya's backend and is not exposed through the Aalavaya Mail Merge Pro client interface.
  • Campaign schedules, send progress and campaign history are stored in your own Google account's Apps Script storage. Send status is written to your spreadsheet, and reports you create (for example, an Unsubscribe List) are added as visible tabs in your spreadsheet.
  • Payment processing is handled entirely by Razorpay — we never store credit card or bank details
  • All data transmission uses HTTPS/TLS encryption
  • Our backend API is protected by authentication, rate limiting, CORS restrictions, and security headers

6. Third-Party Services

We integrate with the following third-party services. Each has its own privacy policy:

  • Google — Google Workspace and Apps Script (runs the add-on), Google Sheets API, Google Picker, and Google Public DNS (domain-only email checks)
  • Google Firebase — Firebase Authentication for signing in to the website dashboard with your Google account
  • Razorpay — Payment processing (UPI, cards, net banking)
  • Google Gemini / OpenAI — AI email generation, only when you choose to use the AI feature and provide your own API key. When you use the AI writer, your instructions and the email subject/body you are drafting may be sent to your selected AI provider. Aalavaya Mail Merge Pro does not send Google Workspace API-derived spreadsheet data, including column headers, recipient rows, individual spreadsheet cell values, or recipient email addresses, to the AI provider through this feature. AI processing is subject to the terms and privacy practices associated with your selected provider and account. Google Workspace API data is not used to develop, improve, or train generalized or non-personalized AI or machine learning models.
  • Twilio / Meta (WhatsApp Cloud API) — WhatsApp and SMS delivery, only when you configure your own provider account. Recipient phone numbers and message text are sent to that provider (see Section 2.3).
  • Vercel — Website and API hosting

7. Data Retention

  • Account data is retained as long as your account is active
  • Payment records are retained for tax and legal compliance purposes
  • Unsubscribe records are retained so that recipients' opt-out choices keep being honored. A re-subscribe is recorded as a change; the opt-out history is kept.
  • If you uninstall the add-on, the send-status columns and any report tabs remain in your Google Sheet (you can delete them manually)
  • You may request deletion of your account and associated data at any time, as described in Section 7.1

7.1 Deleting Your Account and Data

Account and data deletion is handled manually by our team on request. There is no automatic deletion feature.

How to request deletion

  • Email support@aalavaya.com with the subject "Account Deletion Request – Aalavaya Mail Merge Pro".
  • Send the request from the Google account you use with Aalavaya Mail Merge Pro, and include that account's email address. If the request comes from a different address, we will confirm it with the account's email address before deleting anything.
  • If you have made a payment, include your Razorpay payment ID so we can locate your records.
  • We will complete the deletion and confirm by email within 30 days of receiving a verified request.

What we delete from our systems

  • Your account profile: email address, name, Google account ID and profile picture URL
  • Your plan and paid-period status
  • Your usage counts
  • Your campaign metadata (campaign IDs, subject lines and send counts)
  • The unsubscribe and re-subscribe records stored for your account. If you sign up again later, your previous unsubscribe list will not be restored.

What we may keep

  • Payment and invoice records, and other records we are required to keep for legal, tax, accounting, fraud-prevention or security reasons. We keep these only for as long as that requirement applies.
  • Your deletion request and our reply, as a record that we handled it.

Data in your own Google account

Some data is stored in your own Google account, not on our servers, so we cannot delete it for you. This includes your spreadsheets, the Status columns and report tabs the add-on adds, and the add-on's Apps Script storage (saved AI and WhatsApp/SMS provider keys, campaign schedules and history). You can delete saved provider keys from the add-on's Settings, delete columns and tabs from your sheet, and uninstall the add-on and remove its access at myaccount.google.com/permissions. Payments are also governed by Razorpay's own policies, and any AI or messaging provider you connected keeps data under its own terms.

8. Your Rights

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your account and associated data (see Section 7.1)
  • Request a copy of eligible account information we hold about you by contacting support@aalavaya.com. Requests are handled manually by our team. There is no self-service export feature
  • Withdraw consent for data processing at any time

9. Email Recipients' Privacy

When you send emails using Aalavaya Mail Merge Pro, you are the sender and are responsible for complying with applicable laws (CAN-SPAM, GDPR, etc.) regarding consent and disclosure. We add a built-in unsubscribe link to every email to help you maintain compliance. When a recipient unsubscribes, their email address is recorded for your account so that your future sends skip them (see Section 2.3).

10. Children's Privacy

Aalavaya Mail Merge Pro is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

📧 Email: support@aalavaya.com
🏢 Aalavaya Software Private Limited