Privacy Policy
The short version
Your documents and spreadsheet data never reach our servers. FillMerge fills PDFs entirely inside your browser, within your Google account. Our backend stores exactly one thing about you: your account identity and credit balance.
What we process, and where
| Data | Where it's processed | Stored by us? |
|---|---|---|
| Your PDF templates | Your browser + your Google Drive only | Never |
| Your spreadsheet contents | Your browser + your Google Sheet only | Never |
| Generated PDFs | Your browser; saved to your Drive or downloaded by you | Never |
| Google account identity (user ID, email) | Our servers (EU-hosted) | Yes — to keep your credit balance |
| Usage counts (number of PDFs generated) | Our servers | Yes — free-tier and credit metering |
| Purchase records | Stripe (payment processor) + our servers | Yes — amount, credits, timestamp. We never see your card number. |
Google user data & API scopes
FillMerge requests the minimum scopes that make the product work:
- drive.file — access only to files you explicitly pick (via the Google file picker) and files FillMerge creates for you. We cannot see the rest of your Drive.
- spreadsheets.currentonly — read the spreadsheet the add-on is open in. No other spreadsheets.
- Basic identity (openid, email) — to know which PDF balance is yours.
- Sidebar & connectivity scopes (script.container.ui, script.external_request) — technical scopes that display the add-on's sidebar and let your browser call Google's own Drive API and FillMerge's quota API. They grant no access to any additional data of yours.
FillMerge's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or let humans read it. We do not retain or use any data obtained through Google Workspace APIs to develop, improve, or train generalized artificial-intelligence or machine-learning models.
How we protect your data
The strongest protection mechanism is architectural: your documents, spreadsheet contents, and generated PDFs are processed only in your browser and are never transmitted to, stored on, or readable by FillMerge's servers. There is no server-side copy of your sensitive data to secure, because none exists. For the little we do store, we apply these protection mechanisms:
- Encryption in transit — every connection FillMerge makes (the add-on to Google's APIs, the add-on to our quota API, this website, Stripe checkout) uses HTTPS/TLS. We operate no unencrypted endpoints.
- Encryption at rest — your identity record, PDF balance, and purchase history are stored in a managed PostgreSQL database hosted in the EU (Railway, EU-West region) on infrastructure with disk-level encryption at rest.
- Your OAuth tokens never reach us — Drive and Sheets access happens with short-lived Google OAuth tokens that stay inside your browser session. Our servers receive only a signed Google identity token to verify who you are; it is validated and discarded, never stored.
- Access controls — production data is accessible only to FillMerge's developer via credentialed access. We embed no third-party analytics, tracking, or advertising code in the add-on or this website.
- Data minimisation — we store the minimum needed to run the free tier and paid packs: your Google user ID, email address, usage counts, and purchase records. Nothing else, ever.
- Breach notification — in the unlikely event of a security incident affecting your data, we will notify affected users and the competent supervisory authority as required by the GDPR (Articles 33–34).
Payments
PDF pack purchases are handled by Stripe. Your card details go directly to Stripe and never touch our servers. We receive a confirmation of the purchase (amount, PDFs bought) to top up your balance. Prices are shown in EUR; the amount shown is the amount charged.
Data retention & deletion
Your identity record and purchase history are kept while your account has a balance or recent activity. Email support@fillmerge.com from your Google account's address to have your record deleted; unused PDFs from purchased packs are forfeited on deletion unless the purchase is refundable under applicable law.
Your rights (GDPR)
If you are in the EU/EEA, you can request access, correction, export, or deletion of your data at any time — email support@fillmerge.com. Since we store almost nothing, most requests are simple and fast.
Contact
All support and privacy contact is by email: support@fillmerge.com.