Suffle Online

Operated by Naucera Travel Private Limited

1. Purpose and Scope

This Document Policy explains how Suffle Online allows customers, sellers and other authorised users to upload, store, organise, process, share and manage documents and files through the platform.

It covers documents uploaded directly by users, documents imported through authorised services, PDFs, screenshots, images, invoices, booking documents, product compliance documents, seller verification documents and other supported files.

This Policy should be read with the Privacy Policy, Data Security & Protection Policy, Connected Apps & Accounts Policy, Gmail / Email Data Policy, AI Tracking / Automated Processing Notice, Suffle AI Terms and other specialised Suffle policies.

2. Company and Contact

Suffle Online is operated by Naucera Travel Private Limited.

Website: www.suffleonline.com

General Support / Grievance Email: info@flyshoppy.com

Grievance Officer: Mr. Roopal Jain, Managing Director

Grievance Officer Mobile: 9707669981

Grievance Officer Email: info@flyshoppy.com

Address: 707, N. T. Road, Nalbari-781435 (Assam), India.

3. Central Document System

Suffle should use one central Document System for supported document storage, classification, access control, metadata, processing, retention and deletion.

Travel documents, customer records, seller compliance documents, product documents and other document categories may use the same underlying system with category-specific permissions and workflows.

Separate duplicate document databases should not be created for individual Suffle features where the central Document System can support the requirement.

4. Types of Documents

Depending on the feature, users may store identity-related documents, travel documents, booking confirmations, invoices, receipts, warranties, product documents, return evidence, customization files, seller compliance documents, business documents and other supported records.

The availability of a document category depends on the relevant feature and the user's permissions.

5. User-Uploaded Documents

Users may upload files where Suffle provides a document-upload feature.

The uploader is responsible for ensuring that the file is lawful, relevant to the stated purpose and does not knowingly contain malicious or unauthorised material.

Users should not upload documents belonging to another person unless they have the necessary authority or lawful purpose.

6. Seller Compliance Documents

Sellers may be required to upload documents for seller verification, category eligibility, product compliance or re-verification.

Examples may include GST, PAN, business registration, address/business proof, FSSAI or category-specific licences/certifications where applicable.

Not every seller or product requires every document. Requirements should be dynamically determined by the central seller/category/compliance configuration.

7. Product Documents

Sellers may upload product-related certificates, authorisations, specifications, invoices, declarations or other supporting documents where required by Suffle's category and compliance rules.

Super AI may assist with identifying likely document requirements or extracting information, but Super Admin retains final verification authority where the workflow requires administrative approval.

Seller approval and product approval remain distinct processes.

8. Customer Customisation Files

Customers may upload photographs, artwork, designs, logos, text files or other materials for customised products.

These files are private to the relevant customization request/order and must not automatically become public product media.

The seller may access the relevant file only to the extent necessary to review, approve and fulfil the customization request.

9. Travel and Booking Documents

Where supported, Suffle may store travel confirmations, tickets, vouchers, hotel confirmations and other booking-related documents.

Documents imported from authorised email or connected services may be associated with an existing booking or trip through the central Document and Record systems.

Document association should avoid creating duplicate bookings, trips or records.

10. Upload Sources

Documents may originate from direct upload, authorised email import, connected services, PDFs, screenshots, provider websites or other supported sources.

The source should be recorded where reasonably possible so that users can distinguish a directly uploaded document from an imported or AI-detected record.

11. File Formats and Size

Suffle may limit permitted file formats, file sizes, page counts, image dimensions or other technical characteristics according to the relevant feature.

Actual production limits should be maintained in central system configuration rather than represented by this Policy as fixed technical values unless separately published.

Files that do not meet the configured requirements may be rejected before processing.

12. Malware and File Security

Uploaded files should be subjected to appropriate security controls, including malware scanning or other file-safety checks where technically applicable.

Suspicious, corrupted or unsafe files may be rejected, quarantined, restricted or removed.

Users must not intentionally upload malware, malicious code or files designed to compromise Suffle or another person's device or account.

13. Document Metadata

Suffle may maintain metadata such as document type, source, upload date, associated account, order/booking reference, processing status, file size and other information necessary to manage the document.

Metadata should be limited to what is reasonably necessary for the stated purpose.

14. AI Document Processing

Suffle AI or automated systems may extract, classify, summarise or organise information from supported documents.

Examples include identifying document type, dates, reference numbers, names, amounts, order information, booking information or likely expiry dates.

AI extraction may be incorrect. Important information should be checked against the original document.

15. Confidence-Based Document Processing

Where automated extraction is used, Suffle may assign an internal confidence level.

High-confidence information may be used for permitted automated record creation or updates; medium-confidence information may require confirmation; low-confidence information should not automatically create or materially change important records.

Confidence is an internal processing signal and is not a guarantee of accuracy.

16. Document-to-Record Matching

The central Document System may match a document with an existing customer, seller, order, booking, trip, product, return or other record using permitted identifiers and contextual information.

Matching is intended to avoid duplicate records.

If matching is uncertain, Suffle should avoid silently attaching a document to an unrelated record.

17. Document Search and Universal Search

Authorised users may be able to find documents through the central Document System or Universal Search.

Universal Search is customer-scoped and must return only information the authenticated user is authorised to access.

A user must not gain access to another customer's, seller's or administrator's private documents through search.

18. AI Access to Documents

Suffle AI may access a document only where the user, feature permissions and applicable connection scope authorise that access.

A request to summarise a document does not authorise access to unrelated documents.

AI responses must be based on the actual accessible document and must not fabricate document contents.

19. Document Sharing

Where Suffle provides document sharing, the owner or authorised user controls the intended recipient and purpose subject to platform rules.

Sharing should use access-controlled mechanisms rather than exposing a document through an unrestricted public URL where the document is private.

Users should review the recipient and content before sharing.

20. Seller and Customer Access Isolation

Seller compliance and business documents must remain private to the relevant seller and authorised Suffle personnel.

Customer personal documents must remain private to the relevant customer and authorised personnel.

Seller access to customer documents should be limited to documents necessary for a legitimate transaction or service, such as a customization file or return evidence.

21. Administrator Access

Super Admin and authorised Suffle personnel may access documents where necessary for verification, moderation, support, security, dispute resolution, compliance, fraud prevention or legal obligations.

Administrative access should be role-based, logged and limited according to least-privilege principles.

22. Document Editing and Replacement

Where supported, users may replace, update or delete documents subject to the relevant workflow.

Compliance documents may require re-verification after replacement.

Historical records may need to preserve the document version or relevant metadata for audit, dispute or legal purposes.

23. Document Versioning

Where versioning is required, Suffle may retain previous versions or version metadata so that an authorised reviewer can understand which document was used for a particular decision.

Version retention should follow the applicable purpose and retention rules.

24. Document Expiry and Re-Verification

Some documents may have an expiry date, renewal date or validity period.

Automated processing may identify potential expiry dates and create reminders through the central Reminder Engine.

An AI-detected expiry date should not be treated as authoritative when the original document or authorised source does not support it.

25. Documents and Seller Verification

Seller compliance documents may be reviewed by AI-assisted checks and human Super Admin review.

AI may identify missing information, possible inconsistencies or likely document requirements, but final approval, rejection or suspension decisions remain with the designated administrative workflow.

False, altered or misleading compliance documents may result in rejection, suspension or other appropriate action.

26. Documents and Marketplace Products

Product compliance documents may support category eligibility and product approval.

Only documents required by the applicable category/product configuration should be requested.

Suffle should not display private compliance documents publicly on a seller storefront or product page unless a specific lawful/public disclosure is intended and appropriately configured.

27. Documents and Orders / Returns

Customers or sellers may provide invoices, photographs, delivery evidence, damage evidence, return evidence or other files during an order dispute, return or refund process.

Such files should be attached to the relevant central order/return/refund record and access-controlled.

Document evidence does not automatically establish that a claim is true; it is one input to the applicable review process.

28. Documents and Payments

Payment-related documents such as receipts or invoices may be stored where supported.

Payment confirmation must rely on verified payment records, not solely on a customer-uploaded screenshot or document.

Suffle must not request or intentionally store prohibited payment secrets such as UPI PIN, CVV, ATM PIN or banking password in documents.

29. Documents and Email

Where Gmail or another email account is connected through an authorised mechanism, relevant attachments may be imported into the Document System where the feature and user permissions allow it.

Email processing is governed by the Gmail / Email Data Policy.

Imported attachments should not be treated as authentic or verified merely because they came from email.

30. Documents and Connected Services

Documents obtained through connected services must be processed within the permissions granted by the user and the provider's applicable authorisation.

Disconnecting a service should stop future access according to the connection state, while previously lawfully imported documents may remain subject to retention rules.

31. Privacy and Sensitive Documents

Documents may contain personal, financial, identity, business or other sensitive information.

Suffle should apply data minimisation, purpose limitation, access control, security and retention safeguards consistent with the Privacy Policy and applicable law.

Users should avoid uploading unnecessary sensitive information.

32. Document Retention

Documents may be retained for as long as reasonably necessary for the purpose for which they were collected, account/service operation, customer support, compliance, security, dispute resolution or legal obligations.

Different categories may have different retention periods.

Retention and deletion are governed by the Privacy Policy and Account Deletion & Data Retention Policy.

33. Document Deletion

Where a deletion function is provided, users may delete eligible documents subject to applicable technical, legal, transactional or compliance limitations.

Deletion of a document may not automatically delete records or audit information that Suffle is legally or operationally required to retain.

Where deletion is restricted, Suffle should communicate the applicable limitation where reasonably practicable.

34. Account Deletion

Account deletion may trigger deletion or de-identification of eligible documents according to the Account Deletion & Data Retention Policy.

Documents necessary for legal compliance, fraud prevention, security, dispute resolution, financial reconciliation or other lawful purposes may be retained for the applicable period.

35. Document Security

Suffle should protect documents through appropriate encryption, authentication, authorisation, access logging, secure storage, malware controls, backups and other safeguards.

Document access should be based on least privilege and the actual business purpose.

36. Document Incidents and Breaches

Suspected unauthorised access, disclosure, loss or compromise of documents should be handled under Suffle's Data Security & Protection Policy and incident-response procedures.

Where applicable, Suffle will follow legal and regulatory requirements concerning personal-data breaches and security incidents.

37. Intellectual Property in Documents

Users and sellers retain intellectual-property rights they own in documents and files, subject to applicable licences and law.

Uploading a document does not transfer ownership to Suffle.

Users must have the necessary rights or permissions to upload and use documents, including customer customization artwork and seller product materials.

38. Prohibited Documents and Content

Users must not upload unlawful content, malware, stolen documents, forged certificates, fraudulent invoices, deceptive records or content that infringes another person's rights.

Suffle may restrict or remove prohibited files and may take account or seller action where appropriate.

39. AI and Document Authenticity

AI can assist with extraction and checks but cannot by itself certify that a document is genuine, legally valid, issued by a particular authority or currently effective.

Where authenticity or legal validity is important, Suffle may require appropriate human or source verification.

40. Third-Party Providers

Suffle may use third-party infrastructure or specialised providers for secure storage, OCR, malware scanning, AI processing, analytics or other document-related functions.

Such providers should be subject to appropriate contractual, privacy and security controls.

Suffle should not disclose more document information to a provider than is reasonably necessary for the enabled service.

41. User Responsibilities

Users are responsible for uploading accurate and appropriate documents, protecting their account credentials, checking shared recipients and promptly reporting unauthorised access or incorrect records.

Users should not rely solely on AI extraction for important legal, financial, travel or compliance decisions.

42. Relationship with Other Policies

This Policy should be read with the Terms & Conditions, Privacy Policy, Data Security & Protection Policy, Connected Apps & Accounts Policy, Gmail / Email Data Policy, Suffle AI Terms, AI Tracking / Automated Processing Notice, Intellectual Property Policy, Grievance Redressal Policy and Account Deletion & Data Retention Policy.

Specialised policies may provide additional rules for seller compliance documents, customization files, reviews, payments, refunds or other document categories.

43. Policy Updates

Suffle may update this Policy as document features, AI processing, security controls, storage architecture or legal requirements change.

The current effective version should be maintained through Suffle's central legal/policy management system.

44. Legal and Implementation Note

This Policy describes Suffle's intended document-management framework. The live implementation should match actual file limits, storage providers, processing systems, access roles, retention schedules and deletion controls.

Applicable processing should comply with Indian data-protection, consumer-protection, intellectual-property, information-technology and other applicable requirements.

This Policy should be reviewed by qualified Indian privacy, technology and e-commerce counsel before publication and periodically thereafter.

Critical Document Rules

·       Use one central Document System; do not create duplicate document databases for separate Suffle features.

·       Customer customization files are private to the relevant request/order and must not become public product media automatically.

·       Seller compliance documents are private and must not be exposed publicly on storefronts or product pages unless specifically authorised and lawfully intended.

·       AI may extract or classify document information, but AI output is not proof of authenticity, legal validity or accuracy.

·       High-confidence automated processing may be used where appropriate; uncertain information should require confirmation or human review.

·       Documents must be protected through appropriate access control, security, retention and deletion controls.

·       Users must not upload malware, forged documents, stolen documents, fraudulent records or content they are not authorised to use.

Related Suffle Policies

·       Terms & Conditions

·       Privacy Policy

·       Data Security & Protection Policy

·       Connected Apps & Accounts Policy

·       Gmail / Email Data Policy

·       Suffle AI Terms

·       AI Tracking / Automated Processing Notice

·       Intellectual Property Policy

·       Grievance Redressal Policy

·       Account Deletion & Data Retention Policy

Document Governance Requirement

The production system should maintain central document metadata, source information, category, ownership/access scope, processing status, version information where applicable, retention rules, deletion status and audit history. All document access and material processing should be traceable to an authorised account, role or system function.