The Mail Merge add-on requires you to grant permissions to several services associated with your Google Account. It uses the simple and secure OAuth 2 protocol to get data from the user’s Google account and does not have access to your account password.
If you ever wondered why Mail Merge requires all these permissions, this screenshot of the consent screen should answer it all.
Read, send, delete, and manage your email – The add-on needs to connect to your Gmail account to fetch the Gmail drafts that will be used as templates for Mail Merge.
View and manage the files in your Google Drive – The add-on can pull files and documents from your Google Drive for inserting as attachments in your emails.
Manage your contacts – You can import your Google Contacts into the Google Spreadsheet with the Mail Merge add-on.
View and manage your spreadsheets in Google Drive – All the mail merge data is contained in a Google Spreadsheet. The add-on needs to connect to the Spreadsheet service to read data for sending merges.
View and manage data associated with the application – The add-on saves user configuration, like the sender’s name, after you configure Merge. This is done to prevent the user from entering the same data every time they have to start a new Mail Merge session.
Allow this application to run when you are not present – Mail Merge can send scheduled emails and it does so by running a cron job in the background that will run even while the spreadsheet is closed.
Send email as you – The main job of the Mail Merge application is to send emails. Thus it requires permissions to send emails on your behalf.
Connect to an external service – When you buy a Mail Merge licenses, it connects to the external vendor to verify your payment and activate the product.