Privacy policy
Last updated: 1 November 2026
This policy covers EpiFive Mail Merge for Outlook (the "add-in"), its website at https://epifive-addins.pages.dev and its licence service. The add-in is made by EpiFive ("we").
The short version
- Your recipient list, your message, your attachments and the emails you send never leave your mailbox and Microsoft's service. They are not sent to or stored on EpiFive servers.
- The only data that reaches us is a one-way hash (SHA-256) of your Microsoft account email address, used to check whether you have a Pro subscription.
- No advertising, no tracking cookies, no analytics in the add-in.
What the add-in does with your data
| Data | Where it goes | Why |
|---|---|---|
| Your spreadsheet (CSV, Excel or pasted rows) | Read in the add-in pane on your device, kept in memory only, and discarded when you close the pane. | To fill in each email. |
| Your subject and body template | Saved in your browser's local storage on your device. | So your template is still there next time. |
| The emails you send, including attachments | Sent directly from your device to Microsoft Graph, which sends them from your mailbox and saves them in Sent Items. | To deliver your mail merge. |
| Files from OneDrive or SharePoint links (only if you use an attachment link column) | Downloaded from Microsoft Graph into the add-in pane and attached to that email. | To attach the file you linked. |
| Daily send counter | Stored on your device and in your mailbox's add-in settings (Outlook roaming settings). | To apply the free daily limit. |
| SHA-256 hash of your email address | Sent to the EpiFive licence service on Cloudflare. | To check your plan (Free or Pro). |
Microsoft permissions
The add-in signs you in with Microsoft and asks for these delegated permissions. It acts only as you, and only when you click a button.
- Mail.Send: send the emails you create, from your mailbox.
- User.Read: sign you in and read your basic profile.
- Files.ReadWrite: requested only if you use per-row attachment links, to download the linked file. The add-in does not change or delete files.
The add-in can also read the subject and body of a draft you have open, but only when you click "Use the open draft as the template".
Licence service
Our licence service runs on Cloudflare Workers and stores, per hashed email address: your plan, the date your Pro period ends, your payment subscription ID and its status, and when the record was last updated. A hash cannot be turned back into your email address. Cloudflare may process IP addresses in standard request logs to run and protect the service.
Payments
Pro subscriptions are processed by Razorpay. When you pay, Razorpay collects the payment and contact details it needs under its own privacy policy. We receive the subscription status and the hashed email address we attached to your subscription. We never see or store your card or bank details.
Website
This website does not use cookies or analytics. Our host, Cloudflare, processes basic request data (such as IP address) to deliver and secure the site.
How long we keep data
Licence records are kept while you have a subscription and for up to 24 months afterwards for accounting and dispute purposes, then deleted. You can ask us to delete your record earlier.
Your rights
You can ask us to access, correct or delete the licence data linked to your email address, or to stop processing it, under applicable laws such as India's Digital Personal Data Protection Act 2023 and the EU/UK GDPR. Write to epifive2@gmail.com from the address you use in Outlook. To remove everything on your device, uninstall the add-in and clear the add-in's data in Outlook.
Children
The add-in is for business and personal productivity and is not directed at children under 18.
Changes
If we change how data is handled, we will update this page and the date above before the change takes effect.
Contact
EpiFive, epifive2@gmail.com