Suffle Online

Operated by Naucera Travel Private Limited

1. Purpose and Scope

This Gmail / Email Data Policy explains how Suffle Online may access, receive, process, organise, extract, store, display and protect email information when a customer voluntarily connects an email account or provides email content to Suffle.

It applies to Gmail and other supported email sources, including authorised email connections, imported emails, forwarded emails, email files, PDFs, screenshots and manually provided email information.

This Policy supplements the Suffle Online Privacy Policy, Connected Apps & Accounts Policy, Data Security & Protection Policy, Suffle AI Terms and AI Tracking / Automated Processing Notice.

2. Company and Contact

Suffle Online is operated by Naucera Travel Private Limited.

Website: www.suffleonline.com

General Support / Grievance Email: info@flyshoppy.com

Grievance Officer: Mr. Roopal Jain, Managing Director

Grievance Officer Mobile: 9707669981

Grievance Officer Email: info@flyshoppy.com

Address: 707, N. T. Road, Nalbari-781435 (Assam), India.

3. Voluntary Email Connection

Connecting an email account is optional. A customer may use supported Suffle features without connecting an email account, subject to the functionality available for that feature.

Where an email connection is offered, the customer should be informed about the relevant permissions and purposes before authorisation.

Where OAuth is supported, Suffle should use the provider-supported authorisation flow rather than asking for the customer's Gmail password.

4. Authorisation and Permissions

Suffle may request permissions necessary for the enabled email feature. The requested scope should be limited to what is reasonably required.

The customer may review permissions presented by the email provider before authorising access.

Suffle must not treat an email connection as permission to access unrelated external accounts.

5. Gmail OAuth and Credentials

Where Gmail OAuth is used, authentication is handled through the provider's authorised flow.

Suffle should not request or store the customer's Gmail password when an authorised OAuth flow is available.

OAuth tokens, refresh tokens, session credentials and other authentication secrets must be protected as confidential security material and must not be exposed to customers, sellers, AI prompts or unauthorised personnel.

6. What Email Data May Be Accessed

Depending on the permissions granted and the enabled feature, Suffle may access email metadata and/or message content such as sender, recipient, subject, date/time, message body, attachments and related information.

The exact data available depends on the provider, permissions, account configuration and technical implementation.

Suffle will not claim to have access to information that the authorised connection does not actually provide.

7. Purpose of Email Processing

Email data may be processed to help the customer organise and manage information already present in their email account.

Supported purposes may include identifying relevant travel bookings, transport records, hotel reservations, shopping orders, deliveries, returns, refunds, invoices, bills, recharges, subscriptions, movies, events, activities, documents, reminders and related records.

Email processing is intended to provide the customer with Suffle features and should not be used for unrelated purposes merely because the data is technically accessible.

8. Data Minimisation

Suffle should apply data minimisation to email processing and use only the information reasonably necessary for the enabled purpose.

Where a feature can operate using metadata or limited content, Suffle should avoid unnecessary processing of unrelated message content.

Unrelated personal, private or confidential emails should not be unnecessarily exposed to Suffle personnel or AI.

9. Automated Email Classification

Suffle may use automated processing to identify emails that appear relevant to supported Suffle services.

Possible categories include travel, transport, shopping, delivery, return, refund, invoice, bill, recharge, subscription, document, movie, event, activity and similar records.

Automated classification may be inaccurate. Where confidence is insufficient, Suffle should not automatically create or modify important records.

10. Confidence-Based Processing

Suffle may use confidence levels when extracting information from email.

High-confidence information may be used to automatically create or update an appropriate Suffle record where the feature permits it.

Medium-confidence information may require customer confirmation before creating or materially changing a record.

Low-confidence information should generally not be used to automatically create or materially modify a record.

11. Creating and Updating Suffle Records

Where email processing identifies a relevant booking, order, delivery, document, subscription, reminder or similar record, Suffle should attempt to associate it with an existing central Suffle record where appropriate.

Suffle should avoid creating duplicate bookings, orders, documents, reminders or tracking records.

Customer confirmation may be requested where the extracted information is ambiguous, incomplete or potentially consequential.

12. Email and Universal Search

Relevant authorised email information may be made available through Suffle's customer-scoped Universal Search where the feature is enabled.

Universal Search must respect customer account boundaries and authorisation.

If no verified information is found in connected services and Suffle records, Suffle should state that no verified information was found rather than inventing an answer.

13. Email Data and Suffle AI

Suffle's central Super AI / Universal AI may process relevant email information when necessary for an enabled feature and permitted by the applicable authorisation.

AI access must be controlled by backend permissions and must remain within the customer's authorised data boundary.

Email data must not be exposed to another customer, seller or unauthorised administrator.

14. AI Accuracy and No Fabrication

AI may summarise or extract information from email, but it must not invent booking details, prices, availability, payment status, refunds, tracking events, balances, provider status or other factual account information.

If an email is ambiguous, incomplete, outdated or unavailable, Suffle should clearly communicate the limitation.

AI-generated interpretation must not be represented as provider-confirmed information unless it has been independently verified.

15. Email Attachments

Where technically supported, Suffle may process relevant email attachments such as invoices, tickets, booking confirmations, shipping documents or other files.

Attachments may be subject to file-type validation, size limits, malware scanning and access controls.

Sensitive attachments should not be made public or accessible to sellers unless the customer intentionally and lawfully provides them for a relevant transaction or support purpose.

16. PDFs, Screenshots and Forwarded Emails

If a direct email connection is unavailable, Suffle may support customer-provided PDFs, screenshots, forwarded emails or manual entry.

These materials are treated as customer-provided information and may be processed for the feature for which they were supplied.

AI-assisted extraction from such material does not automatically make the extracted information provider-verified.

17. Email Sending

Email access for reading or organising information does not automatically grant permission to send email.

If Suffle offers an email-sending feature, it must be separately authorised and subject to the relevant product permissions, security controls and applicable laws.

Suffle must not claim that an email was sent successfully unless the sending system provides appropriate confirmation.

18. Sellers and Email Data

Seller accounts do not receive access to a customer's connected Gmail or personal email account merely because the customer purchases from or communicates with that seller.

Sellers may receive only order, fulfilment, support or other information legitimately required for an authorised marketplace transaction.

Customer email content unrelated to the seller's transaction must remain private.

19. Administrative Access

Super Admin and internal access to email-derived data should be role-based and limited to legitimate operational, security, compliance or support requirements.

Administrative access should be auditable where appropriate and should not be treated as unrestricted access to every connected mailbox.

Personnel must not browse customer email for unrelated personal purposes.

20. Third-Party Email Providers

Gmail and other email providers have their own terms, privacy policies, security controls and service limitations.

Suffle depends on the provider's supported authentication, APIs and service availability.

Provider changes, outages, permission changes or account restrictions may interrupt email synchronisation.

21. Revocation and Disconnecting Email

A customer may disconnect a supported email connection using the available Suffle controls, subject to technical and legal requirements.

The customer may also revoke Suffle's authorisation directly through the email provider where such controls are available.

After disconnection or revocation, Suffle should stop using the connection for new synchronisation, except for limited processing or retention required for lawful purposes such as security, accounting or dispute handling.

22. Re-Authentication

An email connection may require re-authentication when a token expires, permissions change, the provider revokes access, a security event occurs or other provider conditions require renewed authorisation.

Until the connection is restored, Suffle should not represent that new email information is being successfully synchronised.

23. Security of Email Data

Email-derived information and credentials are protected under the Suffle Data Security & Protection Policy.

Security controls should include least-privilege access, secure credential/token handling, appropriate encryption, audit logging and incident-response procedures.

Raw passwords, OTPs, payment PINs, banking passwords and similar authentication secrets must not be stored as ordinary email-derived data or exposed to AI.

24. Email Data Sharing

Suffle does not sell a customer's connected email content as a standalone commercial product.

Email-derived information may be disclosed or processed by service providers where necessary to operate the requested Suffle feature, subject to appropriate safeguards and applicable law.

Disclosure to sellers is limited to information necessary for authorised marketplace transactions and does not include unrelated mailbox content.

25. Retention and Deletion

Email data should be retained only for as long as necessary for the relevant feature, lawful purpose, security, accounting, dispute resolution or other applicable requirement.

Disconnecting an email account does not automatically delete information already lawfully stored in Suffle.

Customers may request deletion or exercise applicable data rights in accordance with the Privacy Policy and Account Deletion & Data Retention Policy.

26. Security Incidents and Breaches

If Suffle detects a suspected compromise involving connected email access, it may revoke tokens, disable the connection, require re-authorisation, investigate the event and take other protective measures.

Personal-data breach handling and legally required notifications will follow applicable law and Suffle's Data Security & Protection Policy.

27. Customer Responsibilities

Customers should connect only email accounts they own or are authorised to control.

Customers should review permissions, protect authentication devices and promptly revoke access if they suspect compromise.

Customers should not upload or forward passwords, OTPs, UPI PINs, ATM PINs, CVV, banking passwords or similar security secrets to Suffle.

28. Prohibited Uses

Suffle must not be used to gain unauthorised access to another person's mailbox.

Customers must not use Suffle to circumvent provider security controls, CAPTCHA, MFA, OTP verification, rate limits or access restrictions.

Customers must not use email-derived data to violate law, third-party rights or provider terms.

29. No Guarantee of Continuous Synchronisation

Suffle does not guarantee continuous, real-time or uninterrupted email synchronisation.

Email data may be delayed, unavailable, incomplete, filtered by the provider, affected by permissions or changed after Suffle last synchronised it.

Suffle must not describe stale or unavailable email information as current or live.

30. Policy Changes

Suffle may update this Policy as its email features, technology, security practices, provider requirements or legal obligations change.

The current effective version should be maintained in Suffle's central legal/policy management system.

31. Legal and Implementation Note

This Policy describes the intended governance and handling framework for Gmail and email data. Actual processing must remain limited to features and permissions that are technically implemented and legitimately authorised.

Before enabling Gmail API or other email integrations, Suffle should verify applicable provider requirements, permissions, user-facing disclosures, security controls and any platform-specific restricted-use requirements.

This Policy should be reviewed by qualified Indian legal counsel and, where appropriate, an information-security professional before publication and before enabling material new email-processing capabilities.

Critical Gmail / Email Rules

·       Use OAuth or another legitimate provider-authorisation flow where available; do not ask for a Gmail password when OAuth is available.

·       Request only the permissions necessary for the enabled feature.

·       Never expose Gmail credentials, OAuth tokens, OTPs, UPI PINs, ATM PINs, CVV, payment PINs or banking passwords to Suffle AI, sellers or unauthorised personnel.

·       Do not automatically create or materially modify records from low-confidence email extraction.

·       Do not expose a customer's connected email content to sellers or other customers.

·       Do not claim email sending, booking, payment, refund or tracking actions are successful without appropriate confirmation.

Related Suffle Policies

·       Privacy Policy

·       Data Security & Protection Policy

·       Connected Apps & Accounts Policy

·       Suffle AI Terms

·       AI Tracking / Automated Processing Notice

·       Document Policy

·       Account Deletion & Data Retention Policy

·       Terms & Conditions

Regulatory / Drafting Reference

This Policy is designed to operate alongside the Digital Personal Data Protection Act, 2023, applicable rules and information-technology requirements, together with the terms and restricted-use requirements of the relevant email provider and any applicable developer/API programme.