1. Who we are
EasyMailMerge is developed by EasyCalculator.org. Contact: [email protected].
2. Data we handle
Supabase Auth processes your sign-in credentials and account email. When you choose to import contacts, we store recipient email addresses, first names, organizations, stated consent source, timestamp, consent proof and opt-out status. Campaigns store titles, subjects, composed messages, recipient delivery status and Gmail message identifiers. Your hosting provider may also collect technical server access logs.
3. Optional Google/Gmail permissions
Supabase sign-in with Google, if configured, authenticates your identity. It is separate from Gmail sending authorization. Connecting Gmail explicitly requests openid, email, and https://www.googleapis.com/auth/gmail.send, solely to identify your authorized sender account and send the messages you explicitly launch to documented opted-in recipients.
We do not request Gmail inbox reading permission, and the provided implementation does not read or sell inbox contents. Gmail refresh tokens are encrypted at rest in Supabase using a server-held key and are never returned to the browser. App administrators responsible for operating infrastructure may have technical access to server systems.
Google API Limited Use: Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data or use it for targeted ads.
Gmail sending is disabled in the provided configuration until the application's OAuth use is properly authorized.
4. How data is used and protected
We use data to authenticate users, store permission-based contacts, prepare drafts, personalize messages, record delivery outcomes, prevent unsolicited sends, honor unsubscribes and provide user support. Backend API requests validate Supabase sessions and scope records to the account owner. Browser clients do not receive the Supabase service role key. RLS and restricted Data API grants protect application tables.
We rely on Supabase and your chosen hosting provider to process information under their applicable contracts and policies. HTTPS, application security updates, data backup, monitoring and incident procedures should be configured for your production deployment.
5. Storage and retention
Contact, campaign, unsubscribe and delivery records are held until you delete them, or account closure/operational retention rules apply. A minimal Gmail sender-address/day usage counter is separately retained for short-term anti-abuse quota enforcement, normally purged after roughly two days while the sender worker is active. The application includes a Delete My App Data control. Supabase Auth records and host logs may have separate retention arrangements. Before public launch, define concrete retention and backup-deletion schedules.
6. Access, revocation and deletion
You may disconnect Gmail from the dashboard and revoke app permissions in your Google Account. You can delete app contact and campaign records in Settings, request complete account deletion via support, or contact us about data access or correction. Recipients can unsubscribe using the link in each commercial message; suppression is applied immediately to future sends.
7. Policy changes and contact
We may revise this policy as the product changes. For privacy requests, write to [email protected].