Privacy Policy

Effective date: 1 September 2026  ·  Last updated: 1 September 2026

This Privacy Policy describes how Mail Merge for Outlook ("the Add-in", "we", "us") collects, uses, and protects information when you install and use the add-in through Microsoft Outlook or Microsoft 365.

1. Who We Are

Mail Merge for Outlook is developed and operated independently. For privacy enquiries please use the contact details at the bottom of this page.

2. What Data the Add-in Processes

The add-in processes the following categories of data to deliver its core functionality:

• Email addresses and recipient data — CSV files you import contain the names, email addresses, and any merge-field values you choose to include. This data is held in your browser's memory only during your session and is never transmitted to our servers.
• Email body and subject — The message content you compose in the add-in. This is transmitted directly from your machine to Microsoft's Graph API to send email on your behalf. We do not see or store your email content.
• Microsoft 365 tenant ID — When the add-in checks your subscription status it sends your organisation's Microsoft 365 tenant ID (a random identifier assigned by Microsoft) to our licensing API, to identify your organisation's Microsoft 365 tenant.
• User ID and email address — Your Microsoft 365 user (object) ID and your email address are also sent to our licensing API. This is used for per-seat licence validation (matching you to a licensed seat) and to enforce usage limits on your account. Unlike the tenant ID, your email address is personal information.
• Add-in settings and state — Your preferences (e.g. saved templates, rate-limit settings, opt-out lists) are stored in your browser's localStorage, which is local to your device and under your control. We cannot access this storage.

3. Data We Do Not Collect

• We do not store, log, or transmit the contents of your emails.
• We do not store your recipients' email addresses or CSV data.
• We do not read your Outlook inbox or calendar.
• We do not use cookies or third-party tracking scripts. (The add-in's own optional, first-party open/click tracking feature is described in Section 7 — it is not a third-party script and does not use cookies.)
• We do not sell, share, or rent any data to third parties.

4. Microsoft Graph API

The add-in requests three Microsoft Graph permission scopes, each for a specific feature — we request only what each feature actually needs:

• Mail.Send — to send email on your behalf when you click "Run merge". This is the core of the add-in and is always used.
• User.Read — to read your own basic profile (e.g. your display name and email address) so the add-in can address you correctly and pre-fill your account.
• People.Read — used only by the optional "company directory search" feature, which lets you search your organisation's contacts/address book to add recipients without typing addresses manually. This queries Microsoft's /me/people endpoint (a combination of your contacts, the global address list, and frequent collaborators) directly from your browser to Microsoft Graph. Results are used only to populate the recipient picker in your session — the add-in does not store, log, or transmit any contact/directory data to our own servers.

You can revoke any of these permissions at any time from your Microsoft 365 account's app consent page (myapplications.microsoft.com).

5. Licensing API

To verify your subscription plan, the add-in contacts our licensing API hosted on Cloudflare's global edge network. The data sent is your organisation's Microsoft 365 tenant ID, your Microsoft 365 user (object) ID, and your email address. This data is used solely to validate your subscription/plan and enforce usage limits (e.g. daily send caps), and is stored server-side in Cloudflare KV only for that licensing purpose. The API returns your plan tier and feature entitlements. This call is made once per 24-hour period; results are cached locally after that.

Cloudflare may retain server-side access logs (IP address, timestamp, HTTP status) for up to 30 days in accordance with Cloudflare's own Privacy Policy.

6. Payment Processing (Whop)

Paid subscriptions are billed by Whop, an independent third-party payment processor — we never see or store your card/payment details ourselves. Whop collects and processes your billing information (name, email, payment method, and country/region for tax purposes) as an independent controller of that data; see Whop's own Privacy Policy for how they handle it. When you subscribe, Whop notifies our licensing API of your subscription's email address and plan so we can activate your licence (Section 5) — we do not receive or store your payment/card details from Whop, only that email address and plan/status. You manage and cancel your subscription directly through your Whop account, not through us.

7. Open/Click Tracking (Pro Plan, Opt-In Per Send)

Users on the Pro plan may tick an "Enable open/click tracking" checkbox before running a merge (it is off by default and must be explicitly enabled for each send — it is never on automatically). When enabled, each recipient's copy of the email includes a unique, non-identifying tracking pixel and click-redirect link. When a recipient's email client loads that pixel (many block this by default) or they click a tracked link, our tracking API on Cloudflare Workers records that an open or click occurred against that specific send. We do not record the recipient's IP address, device, or any other information beyond the fact and time of the open/click, and this data is retained for 90 days before automatic deletion. This data is used solely to show the sending user aggregate statistics (e.g. "14 opened, 3 clicked") for their own merge runs — it is never shared with any third party, and a recipient's individual open/click activity is not exposed to the sender beyond that aggregate count.

This affects your recipients, not just you. The tracking pixel and link are embedded in the copy of the email your recipient receives — your recipients have not installed this add-in and have not agreed to this policy. If you enable tracking, you are solely responsible for complying with the laws that apply to you and your recipients (for example CAN-SPAM, POPIA, or GDPR/ePrivacy direct-marketing rules), including any notice or consent your jurisdiction requires before tracking a recipient's opens or clicks. We cannot advise you on what your specific situation requires — consult your own legal counsel if you're unsure.

8. Data Retention

We keep the following server-side data, each only for as long as needed:

• Licence records (plan, expiry, contact email) — kept indefinitely while your subscription is active, so we can validate it on each check. Deleted on request (Section 12).
• Whop purchase-linking records — created when you subscribe via Whop, linking your purchase to your Microsoft 365 account. Kept indefinitely (no automatic expiry) until your subscription is cancelled or you request deletion (Section 12).
• Open/click tracking data (Section 7) — automatically deleted after 90 days. Because this data is keyed to an anonymous per-send token, not a recipient's email address or name, we have no way to look up or delete one specific recipient's tracking data on an individual request before that window elapses — the 90-day automatic expiry is the only "deletion" available for this data.
• Daily send-quota counters — used only to enforce your plan's daily sending limit; each day's counter is superseded by the next and is not retained long-term.

9. Data Security

All API communication uses HTTPS with TLS 1.2 or higher. Our licensing API runs on Cloudflare Workers, which enforces Cloudflare's enterprise-grade security infrastructure. Your CSV data and email content never leave your browser.

10. Children's Privacy

The add-in is not directed at children under 13. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last updated" date above. Continued use of the add-in after an update constitutes acceptance of the revised policy.

12. Your Rights

Depending on your jurisdiction you may have rights to access, correct, or delete personal data we hold about you. Contact us and we will action a deletion request for any of the data described in Section 8 that applies to you (licence record, Whop purchase-linking record). As noted in Section 8, individual recipient-level tracking data cannot be looked up or deleted on request — it expires automatically after 90 days.