Product privacy

MergeKit privacy policy

Updated: 25 October 2026

MergeKit is offered by Innova Apps. This policy describes the MergeKit add-on for Google Sheets™ and distinguishes it from the separate local browser workbench. For privacy questions, contact support@innovaapps.ai.

Data the add-on accesses

When you use MergeKit, it reads column headers and displayed cell values in the current spreadsheet to check readiness and fill your document template. It reads the Google Docs™ template and Google Drive™ folder you select through Google's file picker, and accesses documents and PDFs that it creates for your merge. It records file names, file identifiers, output links, job status and errors to manage the workflow.

MergeKit uses your Google authorization through Apps Script. Authorization tokens are used for the file picker and Google API requests; the add-on does not save them in its settings, spreadsheet snapshots or application logs. Google manages the underlying authorization grant.

Installing MergeKit through Google Workspace™ Marketplace can also display Google’s request for your Google Account email address and basic profile information, such as your name and profile picture. This request is part of the Marketplace sign-in and installation flow. Google manages that account and installation flow. MergeKit uses the verified account identifier and email described below; it does not use your profile name or picture for document generation or billing.

Account, allowance and payment data

MergeKit sends a short-lived Google identity token over HTTPS to its billing service. The service verifies it and uses your stable Google Account identifier, verified email address and, when present, Google's verified Workspace domain claim. These identify your account, check your plan and free allowance, and decide whether you belong to a paid domain. A domain claim proves membership, not administrator status. We do not use a typed email address as proof of domain membership.

The billing service stores a hashed key representing your Google Account identifier, the Workspace domain for a Domain checkout or subscription, your selected plan and subscription state, Stripe customer and subscription identifiers, and monthly merge counts. It retains opaque job-grant identifiers and integrity digests to recognize an already-authorized job on a later retry. It also stores checkout request/session identifiers, temporary checkout URLs, educator self-declaration, and webhook/payment-risk status needed to reconcile billing safely. The service does not receive raw spreadsheet values, document or template contents, filenames, Drive file identifiers, or generated document links. The digest is computed in Apps Script from the immutable recovery context; the underlying context is not sent. Raw identity tokens are not stored or intentionally logged.

Our billing service runs on Google Cloud™, using Cloud Run for requests, Firestore for billing and allowance records, and Secret Manager for server credentials. Stripe handles checkout, subscriptions and the billing portal. Your Google email is verified for account identity and returned to the sidebar; it is not stored as an email field in MergeKit's Firestore account records or sent when creating the Stripe customer. Stripe Checkout separately collects billing contact details. Stripe receives the billing contact and subscription details needed for payment. Payment information entered in Stripe's checkout goes directly to Stripe; MergeKit does not collect or store full card numbers. Stripe processes that information under its privacy policy.

Billing records have no automatic deletion in this release. We retain account, subscription, usage and operational records to run billing, recognize authorized retries and review payment or support issues. Job-grant records must remain available for as long as their saved jobs can be retried; a new calendar month does not delete them. Current file, recovery-data and add-on settings retention below still applies. MergeKit also retains an opaque per-plan checkout request identifier in Apps Script user settings to avoid duplicate checkout attempts; uninstalling does not prove that record was erased. For a billing data request, contact support@innovaapps.ai. We verify the requester and review access or deletion requests manually. We will explain which records can be removed and which still need to be retained, and why; there is no automatic account-deletion control. Removing a job grant prevents that saved job from being recognized as already authorized and can require a new allowance if it is retried. Review unfinished jobs and stop automation before requesting removal of their recovery records. Cancelling a subscription, uninstalling the add-on and deleting data are separate actions.

Stripe holds payment records separately under its privacy policy and may retain records after cancellation or a data-deletion request. A request to MergeKit does not promise immediate removal of Stripe's payment records, Google service records or backups. Any records retained for accounting, payment disputes or other applicable requirements are reviewed separately from the data needed to operate MergeKit; we do not promise an unverified fixed retention period.

How the data is used and transferred

The add-on uses these data to create personalized copies of your template, export PDFs, record results and recover interrupted jobs. Processing takes place on Google's Apps Script, Docs and Drive services and in the sidebar displayed in your browser. The add-on does not send your spreadsheet or document content to a separate Innova Apps merge server, analytics service or AI provider.

If you enable the optional form-submit trigger, it processes new rows in the configured response spreadsheet as the user who enabled it. It does not read the Google Forms™ form itself, collect respondents' Google authorization, or send emails.

The add-on does not automatically change file-sharing settings. A destination folder may already be shared, and generated files can inherit its access rules. Spreadsheet editors can see the merge result columns and recovery snapshots. Choose the sheet and folder permissions appropriate for your data.

What is stored

• In your spreadsheet: status, output links, errors and a recovery snapshot. The snapshot can include the full source row, template text, file and job identifiers, merge settings and processing checkpoints. It is ordinary cell content visible to spreadsheet editors. Its integrity signature detects modification; it does not encrypt the cell.
• In Google Drive: generated Google Docs and PDFs in the selected folder, with job identifiers used for recovery. PDF-only mode also retains the merged Google Doc.
• In Apps Script user settings: your template/folder choices, filename pattern, readiness rule, output choice, trigger identifier, temporary picker choices and a per-user key used to check recovery snapshots. For each configured tab, these settings also retain the last recorded caught trigger failure's row number, timestamp, and opaque notice and acknowledgment identifiers. The notice does not contain source values or raw errors. Acknowledging it hides the notice; it does not delete the stored notice data or recover the affected rows.
• In Google diagnostics: Apps Script can record execution failures and technical error information. The add-on does not intentionally log document bodies or authorization tokens. Access and retention are governed by the applicable Google services and project configuration.
• In support correspondence: if you contact support, we receive your message and the contact details and attachments you choose to send. Please avoid sending confidential spreadsheets, templates or recovery snapshots.

How we protect your data

Requests from MergeKit to Google's APIs use HTTPS. The add-on requests access to the current spreadsheet and to Drive files you select or it creates, rather than broad access to all your spreadsheets or Drive files. MergeKit also requests Google sign-in identity and email access to authenticate billing and usage checks. OAuth tokens are used temporarily for authorized requests and are not saved or logged by MergeKit's application code.

Recovery snapshots are checked with a user-specific HMAC integrity signature before a job is recovered. This helps detect changed snapshots and prevents another user's settings from being used to trust the original owner's recovery data. The signature protects integrity; it does not encrypt the cells or hide their contents from spreadsheet editors.

Google account and service access controls govern access to the files and settings stored in Google's services. You control who can access the spreadsheet and destination folder, and generated files may inherit that folder's permissions. Keep these sharing choices limited to the people who should see the source data and documents.

Retention and removal

MergeKit has no automatic expiry for generated files or spreadsheet recovery data. They remain until you delete them through Google Drive or Sheets, subject to Google's version history, trash, backup and organization retention controls. Deleting a generated file does not automatically recreate it or remove its link from the sheet.

Before deleting recovery cells, stop active runs, disable any form trigger and save output links you need. Clearing a row's MergeKit cells removes its recovery state and can let a later run create a new set of files. Do not remove or edit a snapshot while an uncertain job is being recovered.

Per-user add-on settings have no automatic expiry in this release. Uninstalling the add-on or revoking its Google access stops future authorized use but should not be treated as proof that stored settings, spreadsheet cells, generated files or Google service logs have been erased. Contact support for help with remaining settings or privacy requests. Google controls apply to files, history and service data it stores.

Support messages are kept while needed to address the request and any applicable recordkeeping obligations; we do not promise immediate deletion from mail backups. Contact us if you want your support correspondence or identifiable operational information reviewed for deletion.

Use restrictions and access

We use Google user data for the MergeKit features you choose and related support, security and operation. We do not sell it, use it for advertising, or use it to train generalized AI models. Human access to Google user data is limited to the permissions allowed by Google's policies, such as your agreement to review specific data for support, necessary security investigation or legal obligations.

MergeKit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Google Workspace API User Data and Developer Policy.

Your choices

You choose the template, destination folder, rows and output type. You can stop a manual run after its current batch, disable your form trigger, manage access to your spreadsheet and Drive files, uninstall MergeKit, and revoke its connection through your Google Account's third-party access controls. Work already completed remains in your files until you remove it.

The separate local workbench

If you use the standalone browser workbench, imported CSV/XLSX files, document templates and generated outputs are processed in that browser. Its source does not upload those file contents to a server. Working data and recent runs are held in memory and are discarded when you reload or close the page; downloaded files remain where you save them. This behavior does not describe the Google-hosted add-on above.

Changes and contact

We will update this page when our product data practices change and seek any additional consent required before a new use of Google user data. Contact support@innovaapps.ai with MergeKit privacy questions. Include only the information needed to identify your request.