A practical review checklist for mail merge data flow, permissions, Gmail sending, tracking, retention, and Google Workspace admin approval.
A mail merge touches recipient data, message content, and a sending account. A privacy review should therefore begin with a data-flow question: where does each piece of information go, and why?
This guide is a practical checklist, not a compliance certification or legal opinion. Your organization should assess its own obligations and configuration.
Map the data flow
Document four parts of the workflow:
- Source: where recipient names, addresses, and business fields are stored.
- Processing: what reads the rows and replaces placeholders.
- Sending: which account and service deliver the email.
- Results: where send status, errors, and optional tracking data are recorded.
Mailvern works inside Google Sheets and sends through the user’s Gmail account. Rows remain in the Google Sheet rather than being exported as a CSV campaign list. Review the current privacy and security documentation for product-specific details.
Review permissions by purpose
A useful permission review asks what each permission enables, whether it is required, and who can authorize it. For a Sheets-to-Gmail workflow, expected capabilities may include reading the active spreadsheet, composing or sending messages, and accessing a selected Drive attachment.
Do not assume that a familiar marketplace listing automatically satisfies your organization’s policy. Google Workspace administrators may restrict installation or require an internal review.
Minimize the spreadsheet
Include only fields needed for the message and workflow. Avoid copying sensitive identifiers into a campaign sheet when a less sensitive reference will work.
Also review sheet sharing. A privacy-conscious sending tool cannot compensate for a spreadsheet shared too broadly.
Decide how tracking should work
Open tracking typically relies on a small remote image. It can be useful for aggregate campaign feedback, but it is not exact: image blocking, privacy protections, and automated scanners can affect results.
Decide whether tracking is appropriate for the message and audience. Transactional or sensitive notices may not need it. Read email tracking limitations before enabling the feature.
Check attachments and links
A Drive attachment can contain more sensitive information than the email body. Confirm that the selected file belongs to the intended recipient and that the workflow does not reuse a file across rows accidentally.
Test every personalized link. Avoid putting private values in a URL unless the destination is designed to receive them securely.
Define retention and access
Write down:
- who can edit the source sheet;
- who can run the campaign;
- how long send results are needed;
- how templates and old sheets are removed;
- how access changes when a team member leaves.
Simple ownership rules often prevent more risk than adding another tool.
Administrator review checklist
- Identify the Marketplace listing and publisher.
- Review requested Google permissions and their purpose.
- Confirm where spreadsheet and campaign data are processed.
- Check sender identity, aliases, and reply handling.
- Review attachment behavior.
- Decide whether open tracking is allowed.
- Limit installation to the right users or organizational units when required.
- Test with non-sensitive data before wider rollout.
Frequently asked questions
Does a mail merge copy my spreadsheet data?
That depends on the product. Review its data flow and privacy documentation. Mailvern reads the Google Sheet used for the campaign and does not require a CSV export of the recipient list.
Who sends the email?
With Mailvern, the message is sent through the connected Gmail account and appears in that account’s Sent folder. Gmail and Google Workspace limits still apply.
Is open tracking completely accurate?
No. Image blocking, privacy features, forwarding, and automated scanners can change open data. Treat it as an estimate, not proof that a person read a message.
Can an administrator control installation?
Google Workspace administrators can manage Marketplace app availability according to their organization’s settings and policies.
Does this make a workflow compliant with a specific law?
No tool alone guarantees compliance. The lawful basis, message purpose, data selection, retention, access, and recipient rights depend on your organization and jurisdiction.
Make the review concrete
A short diagram of source, processing, sender, and stored results gives reviewers something precise to assess. Pair it with the Mailvern privacy policy, current product documentation, and a limited test using non-sensitive rows.