隱私權政策 (Privacy Policy)
最後更新日期：2026 年 6 月 9 日
一、 營運主體與政策適用範圍
「閒貓電郵」（Saltycat Mailservice，以下簡稱「本服務」）是由 陞和姍科技商號 (https://shengshan.tw/) 營運。我們極為重視您的個人數據與隱私安全，並致力確保您在使用本服務時的權益受到保護。
本《隱私權政策》（以下簡稱「本政策」）旨在向您說明我們如何收集、處理、利用以及保護您在註冊及使用本服務時所提供的相關資訊。
二、 個人資料收集之類型
為了提供穩定、安全的雲端轉寄服務，我們僅在必要之最小範圍內收集以下資訊：
- 帳戶與註冊資訊： 當您註冊本服務時，我們會收集您的電子郵件地址、設定之密碼（採高強度單向雜湊加密），或自 Google 第三方登入（OAuth）取得您的公開基本檔案資訊（包含 Google Email、姓名與公開大頭貼 URL）。
- 網域與轉寄設定： 為了執行轉寄服務，我們將儲存您所新增綁定之自訂域名（Domains）及您建立的轉寄對照規則（Mappings）。
- 帳務與訂閱紀錄： 我們會紀錄您的訂閱方案、交易時間與狀態。本服務所配合之第三方金流服務商（例如 Stripe）將直接處理您的信用卡資訊，本服務伺服器絕不會直接儲存、接觸您的完整信用卡號或安全碼。
- 技術與系統日誌： 為了確保轉寄正常運作及偵測系統異常，我們會自動紀錄必要的系統運行日誌，包括轉寄是否成功、錯誤代碼及系統處理時間。
三、 電子郵件內容之「零留底」承諾
我們不儲存、不讀取、不轉售您的任何電子郵件內容！
本服務的本質為「非同步郵件路由中繼服務」。所有透過您自訂網域寄達的信件之處理機制如下：
- 暫存緩衝區： 進站郵件會短暫寫入 Amazon S3 的受保護緩衝區，以便系統 Lambda 轉寄引擎讀取及投遞。
- 即時刪除原則： 一旦郵件成功轉寄至您的指定目標信箱（例如您個人的 Gmail），該信件的原始內容便會立即自 Amazon S3 中物理刪除。
- 自動清理機制： 任何因網路波動或其他不可抗力導致轉寄失敗或延遲之臨時緩衝檔案，設有 24 小時強制自動過期刪除機制，絕不在伺服器或系統中留存任何備份。
四、 資料之處理與利用方式
我們所收集的資料將僅用於以下合理且特定之用途：
- 提供、維持並優化本服務之各項轉寄核心功能。
- 用於處理您的付款交易、進行續訂與訂閱管理。
- 回覆您的客服諮詢、商務合作與技術支援要求。
- 防止任何惡意濫用（Abuse）或發送垃圾郵件（Spam）等違反服務條款之行為。
五、 第三方服務商與資料共享
我們絕不會將您的個人資訊、帳戶資料或轉寄紀錄出售、交換或出租予任何第三方。然而，為使本服務得以順暢營運，我們會與以下值得信賴之第三方基礎設施服務商進行必要且受控之數據串接：
- Amazon Web Services (AWS)： 作為我們最核心的雲端託管、S3 暫存緩衝以及 AWS SES 郵件路由與寄送引擎。
- Stripe 等第三方金流： 負責安全合規地處理信用卡、訂閱與款項收付。
- Google Identity Service： 用於提供安全的 Google Social Sign-In 第三方登入服務。
六、 Cookies 與瀏覽器本地儲存（Local Storage）
為了維持您的登入狀態、提升操作流暢度並優化使用者體驗，我們的網站可能會使用 Cookies 或瀏覽器的 Local Storage 機制。這些機制僅用於儲存加密的登入金鑰、個人語系設定或暫時性會話資訊。您可以透過瀏覽器設定隨時清除或禁用這些功能，但這可能會使您在使用本網站時需要重新進行登入。
七、 您的資料控制權與刪除申請
我們全力尊重您對個人資料的控制權利：
您可以隨時登入控制台變更或清除您的轉寄對照規則。如果您希望徹底關閉帳戶、註銷域名綁定、或完全從我們的資料庫中抹除與您的註冊帳號相關之所有個人隱私資訊，請直接發送電子郵件至我們的官方客服信箱 cs@saltycat.tw。我們將於收到您的申請並確認身分後，在 14 個工作天內安全地將您的帳戶資料執行物理性永久刪除。
1. Operating Entity & Scope of Policy
"Saltycat Mailservice" (referred to as the "Service") is operated by Sheng Shan Technology Co. (https://shengshan.tw/). We place the utmost importance on your data privacy and security, and are committed to ensuring that your privacy is respected and protected while you use our Service.
This Privacy Policy (the "Policy") explains how we collect, process, utilize, and secure your personal information when you register for and utilize the Service.
2. Types of Information We Collect
In order to deliver a stable, reliable, and secure cloud email forwarding service, we limit our data collection to the minimum details necessary:
- Account & Registration Info: Upon registration, we collect your email address, a password (which is single-way hashed with high-strength security encryption), or basic profile info shared by Google OAuth (such as Google Email, full name, and avatar URL) if you choose to sign in via Google.
- Domains & Routing Rules: To perform email routing, we store the custom domains you register with us and your custom forwarder mappings.
- Billing & Subscription Logs: We track your subscription plan, billing timestamps, and status. All credit card details are securely handled directly by our certified third-party payment gateways (e.g., Stripe); our servers never collect or store your actual credit card numbers or CVV.
- Technical System Logs: To verify forwarding accuracy and debug anomalies, we log basic metadata about inbound mail handling (such as status codes, delivery indicators, and execution duration).
3. Our "Zero-Retention" Guarantee
We do not store, inspect, or monetize your email contents!
Our Service functions as an asynchronous mail routing relay. Every email received through your custom domain is handled in accordance with the following absolute guidelines:
- Transient Buffering: Incoming mail payloads are briefly stored in a secure Amazon S3 buffer bucket so that our Lambda relay engine can read and forward them.
- Instant Deletion Policy: Once an email is successfully relayed to your destination mailbox (e.g., your personal Gmail account), the email content is instantly and permanently deleted from our S3 storage.
- Automatic Lifecycle Purge: Any failed or deferred forwarding buffers are subject to a strict 24-hour AWS lifecycle expiration policy, guaranteeing physical deletion from our systems.
4. Purposes of Data Processing
The information we collect is strictly processed for the following legitimate business purposes:
- Providing, operating, and maintaining the core forwarding features of the Service.
- Managing and verifying your payments, invoices, and billing subscriptions.
- Responding to your customer support tickets, business inquiries, and technical requests.
- Protecting the system against malicious activities, terms violations, and outbound spam abuse.
5. Third-Party Infrastructure & Data Sharing
We never sell, trade, rent, or distribute your personal account details or routing history to third parties. However, we utilize trusted, enterprise-grade external service providers for core infrastructure:
- Amazon Web Services (AWS): For hosting cloud infrastructure, transient S3 storage, and handling MX routing via AWS SES.
- Stripe / Payment Gateways: For industry-compliant payment processing and recurring billing administration.
- Google Identity Service: To provide secure, standardized Social Sign-In authentication.
6. Cookies and Local Storage
To persist your logged-in session, optimize user interaction, and personalize language settings, our website utilizes standard Cookies and browser Local Storage. You can clear or disable these tools through your browser configuration, though doing so may prevent you from maintaining a logged-in state.
7. Data Control & Account Erasure Rights
We fully respect your absolute ownership over your private data:
You may remove your forwarder mapping rules and domain linkages directly from the console at any time. If you wish to permanently terminate your account, delete your registered metadata, and physically erase all personal details from our databases, please contact us at cs@saltycat.tw. Upon validating your identity, we will permanently and securely delete your record within 14 business days.