Privacy Policy

Last updated: 1 October 2026

SuriaMail is a business email forwarding and SMTP relay service operated from Singapore. This policy explains what we handle when you use suria.biz and the SuriaMail gateway, and the choices you have.

1. Our zero-storage principle

SuriaMail is a proxy, not a mailbox provider. Inbound messages are processed in memory, filtered, and forwarded to the destination inbox you nominate (typically your own Gmail or Outlook account). We do not store the body of your email messages on disk.

• Message content is relayed, not retained, after successful delivery.
• Because the destination inbox holds the mail, your mailbox data stays under your control.

2. What we do hold

• Account data — name, business email address, phone number, domain name and forwarding destination, used to operate your account.
• Routing metadata — sender, recipient, subject line, timestamps and delivery result for each relayed message, retained for troubleshooting and abuse prevention.
• Billing records — plan, invoices and payment status. Card details are handled by our payment processor and never stored by us.

3. Spam and malware filtering

Inbound mail passes through an enterprise filtering gateway before it is forwarded, so junk and phishing do not damage the delivery reputation of your domain. Filtering relies on message metadata and reputation data; your forwarded mail is not used to build advertising profiles.

4. We do not sell your data

We do not sell, rent or trade personal data, and we do not use the contents of your correspondence for advertising.

5. Sharing with sub-processors

We share the minimum necessary with infrastructure providers that make the service work — hosting, DNS, outbound relay and payment processing. Each is bound by contract to use the data only on our instructions.

6. Your rights

Under Singapore's Personal Data Protection Act (PDPA) and, where it applies, the GDPR, you may request access to, correction of, or deletion of your personal data, and you may withdraw consent to processing. Contact us and we will respond within 30 days.

7. Security

Connections to our gateway use TLS. Credentials are transmitted only over encrypted channels and relay accounts are isolated per customer domain.

8. Changes

If we make a material change to this policy we will update the date above and, for significant changes, notify account holders by email.