Privacy Policy – Simple CRM & Mail Merge for Gmail

Last updated: July 23, 2026

Simple CRM & Mail Merge for Gmail (“the extension”) is a Gmail-native CRM tool designed to help users manage contacts, track sales opportunities, run mail merge campaigns, and optionally sync aggregate team metrics to a shared Google Sheet.

We take privacy seriously and collect only the minimum data required for the extension to function. We do not operate a proprietary backend server for storing or processing your CRM or spreadsheet content.

Summary

CRM data (contacts, deals, settings) is stored locally on your device unless you export it or use optional Google Sheets features.
Gmail content is read from the visible Gmail page in your browser (not the Gmail API) to match senders and optionally build on-device email log summaries.
Google Sheets / Apps Script are used only when you connect Google and use mail merge, campaign sheets, or team reporting.
We do not sell your data. CRM and sheet content are not transmitted to developer-operated servers.

1. Data We Access (Google OAuth)

When you click Connect Google or use a feature that requires sign-in, the extension uses Google OAuth. We do not request Gmail API scopes (such as gmail.readonly).

Scope	Purpose
Google Sheets `.../auth/spreadsheets`	Create and update mail merge campaign spreadsheets (Contacts and Config tabs); read and write template and recipient data; update send status after you trigger a send. Team reporting: connect to a shared team report sheet (including sheets created and shared by a manager), create report structure, and write one summary row per rep (pipeline counts, values, win rate, rep name/email, sync time). Contact lists, deal notes, and email bodies are not synced to the team report sheet.
Google Drive (per-file) `.../auth/drive.file`	Access spreadsheet files created or opened through the extension. This complements the Sheets scope for app-created campaign and report files. It does not grant access to your entire Google Drive.
User identity `.../auth/userinfo.email`	Identify your signed-in Google account; prefill team reporting settings; support subscription status via ExtensionPay.
Apps Script mail `.../auth/script.send_mail`	Send mail-merge Test and Send LIVE emails from your own Gmail account when you explicitly click those buttons. The extension cannot search, delete, or modify your existing Gmail messages.

All Google API calls are made directly from the extension to Google under your Google account. We do not proxy your Google data through our servers.

2. Gmail Integration & “Log Email”

The extension provides features inside your Gmail browser tab to help associate active email threads with CRM records.

Tab-only context: We do not use Google’s Gmail API to read your inbox. Gmail-related features read only what is rendered in the active, open browser tab when you interact with the extension (sender email, subject, and visible message text).
User-initiated only: Email summaries are created when you take an action (for example, “Log email”). We do not scan your inbox in the background.
Local processing: The “Log email” feature uses rule-based logic to strip signatures and disclaimers to create concise notes. This processing is performed locally within your browser; email content is never transmitted to our servers or third-party AI APIs.
Intent detection: The extension may scan the active thread for keywords (e.g., “meeting”) or time-based phrases (e.g., “next week”) to suggest follow-up actions. This analysis happens entirely on your device.
Reminders: If you enable reminders, optional desktop notifications may show opportunity names and due dates. They do not include email body content.

3. Team Reporting

Optional team reporting lets each person sync aggregate pipeline metrics to one shared Google Sheet — one row per rep.

What is synced: Summary counts and values (e.g. open opportunities, pipeline value, win rate), plus rep name, email, team name, and last sync time.
What is not synced: Contact lists, deal notes, email bodies, or per-deal detail rows.
Shared sheets: Team members may connect to an existing sheet URL shared by a manager. Sheet access is managed through normal Google Sheets sharing settings.
User control: Sync runs only when you connect a sheet and click Sync now, or when auto-sync is enabled and you save pipeline changes.

4. Google API Limited Use Disclosure

Simple CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do NOT use user data for advertising, data brokering, creditworthiness, or training AI models.

5. Data Storage

Local device storage: Your primary CRM data — contacts, opportunities, pipeline stages, settings, onboarding progress, entitlement state, and duplicate-protection hashes — is stored in chrome.storage.local on your device. Brief Gmail context (such as sender email and subject) may be held in chrome.storage.session while you use Gmail.
Google Sheets: Mail merge campaign sheets and optional team report sheets are stored in Google Sheets under your Google account. Contacts and opportunities are not automatically copied to Sheets unless you add recipients to a campaign sheet, export data, or sync team reporting metrics.

6. Mail Merge

Mail merge uses Google Sheets for campaign data and Google Apps Script to send email from your own Gmail account. Test and live sends are only initiated when you explicitly click the corresponding buttons (with confirmation for live sends). The extension does not perform automated background sending.

7. Data Sharing & Third Parties

CRM and spreadsheet content is not sent to developer-operated servers. Information is only exchanged over encrypted HTTPS connections with:

Google APIs — when you explicitly use Google Sheets, Drive, Apps Script, or account identity features
ExtensionPay / Stripe — for optional Pro subscription management only

We do not sell or rent personal data.

8. Payment Processing

We use ExtensionPay and Stripe to manage subscriptions.

When you subscribe, ExtensionPay stores your email address and payment status.
We never see or store your payment card details; all transactions are handled securely by Stripe.
See the ExtensionPay Privacy Policy for details.

9. Chrome Web Store Data Disclosures

The extension handles the following categories of user data as disclosed in the Chrome Web Store:

Personally identifiable information (e.g. contact and account email fields you enter or sync)
Financial and payment information (via ExtensionPay for optional Pro subscription)
Personal communications (Gmail thread context you view; emails you send via mail merge)
Website content (Gmail page content read in-browser for CRM context)

Your data is not sold, not used for unrelated purposes, and not used for creditworthiness or lending.

10. Export and Deletion

Export: You can export your local CRM data as a JSON file via Settings at any time. Data in Google Sheets you created or connected to remains accessible in your Google account.
Deletion: Uninstalling the extension removes locally stored CRM data from the browser. Google Sheets files remain in your account until you manually delete them.

11. Security

The extension uses Google-approved OAuth2 protocols and Chrome’s secure storage APIs. All communication with Google and payment providers is encrypted using industry-standard HTTPS.

12. Changes

If this privacy policy changes, the updated version will be published at this URL before new data practices take effect.

13. Contact Information

Simple CRM

📧 Email: hello@simple-crm.uk

🌐 Website: https://simple-crm.uk

📍 Business Address:
Unit 166427, 13 Freeland Park, Wareham Road,
Poole, Dorset, BH16 6FH, United Kingdom