Privacy policy

Effective date: 18 October 2026

Merge X is a mail merge service: it sends personalised emails from your own Gmail account to the people listed in a Google Sheet. Merge X is operated by Version Phi, in Lagos State, Nigeria ("we", "us"). This policy explains what we collect, why, how long we keep it and what you can do about it. Questions go to support@versionphi.com.

The short version

• We ask Google only for the permissions a feature needs, and only when you first use it.
• We can send email as you. We cannot read your inbox.
• We use your data only to run the features you use. No ads, no selling, no AI training.
• Recipient data from your campaigns is deleted 90 days after a campaign completes.
• You can delete your account at any time, and that deletes your data.

What we collect

• Your account: your name, email address and Google account ID from Google sign-in, and whether your account belongs to a Google Workspace organisation (this sets your daily sending limit).
• Your Gmail connection: when you connect Gmail, Google gives us a token that lets Merge X send email as you. We store it encrypted. It does not let us read, search or delete your email.
• Sender details: the send-as addresses and display names you add.
• Sheets you choose: the rows of the sheet you pick for a campaign (email addresses and the columns you use as merge fields). We also write each row's sending status back to that sheet.
• Templates and campaigns: your subject lines and email templates, and for each campaign the recipients, their merge values, their sending status and errors, send times and the message IDs Gmail returns.
• Unsubscribes: the addresses that unsubscribed from your emails (your suppression list), so they are never emailed again.
• Open and click tracking, only if you turn it on for a campaign: when a recipient first opens an email or clicks a link in it. Open tracking is approximate.
• Technical data: our hosting provider handles network data such as IP addresses to deliver and protect the service. We do not log email bodies or merge data.

The Google permissions we ask for

If we add a feature that needs another permission (for example importing Google Contacts), we will add it to this policy before we offer the feature. You can remove Merge X's access at any time at myaccount.google.com/permissions.

How we use Google user data

We use data from Google only to provide and improve the features you use in Merge X. We do not use it for advertising, we do not sell it, and we do not use it to train AI or machine learning models. People at Version Phi do not read it unless you ask us to (for example in a support request), it is needed for security (such as investigating abuse), or the law requires it.

Merge X's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

People you email

When you run a campaign, you decide who receives it and what it says. For the people on your sheet, you are responsible for having a lawful reason to email them, and we process their data only on your behalf and to run your campaign. Every campaign email includes an unsubscribe link. A recipient who wants their data removed can ask the sender, or write to us and we will help.

Who processes the data

• Cloudflare hosts Merge X and its database. Your data may be stored and processed in data centres outside Nigeria.
• Google provides the services you connect (sign-in, Gmail, Drive and Sheets). Google's own privacy policy applies to your Google account.

We share data with no one else, except where the law requires us to.

How long we keep it

• Recipient merge data is deleted 90 days after a campaign completes.
• Deleting a campaign deletes it and its recipient data straight away.
• Your account, templates, sender details and suppression list are kept until you delete your account. The suppression list is kept so that people who unsubscribed are not emailed again.
• Deleting your account deletes all of the above and revokes Merge X's access to Google.
• Deleted data can stay in our database provider's backups for up to 7 days before it is gone for good.

Your rights

Under Nigeria's Data Protection Act 2023, the GDPR and similar laws, you can ask to see, export, correct or delete your data, object to how we use it, and withdraw your consent. You can delete your account in the app, and remove Merge X's Google access at any time. For anything else, email support@versionphi.com and we will reply within 30 days. You can also complain to the Nigeria Data Protection Commission or the data protection authority where you live.

Cookies

Merge X uses one cookie: a sign-in session cookie that keeps you signed in. It is needed for the service to work. We use no advertising or tracking cookies. If we measure visits to our public pages, we use Cloudflare Web Analytics, which does not use cookies.

Security

All traffic uses HTTPS. Gmail connection tokens are encrypted when stored. Access to production data is limited to the people who run the service. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Age

Merge X is for people aged 18 or over. We do not knowingly collect data from anyone younger.

Changes to this policy

We will post any change on this page and update the effective date. If a change matters, for example a new permission or a new use of your data, we will also tell you in the app or by email before it applies.

Contact

Version Phi, Lagos State, Nigeria. support@versionphi.com