1.Introduction

Loka is a location-based travel discovery service for Malaysia. It helps you explore nearby attractions and points of interest, view interactive maps, build and save itineraries and bucket lists, browse tours, and chat with an AI travel assistant.

This Policy applies to the Loka mobile app and to loka.my. The data practices described below reflect the Loka app in particular; where a practice applies only to a specific website feature, we note it. Undefined terms used here have the same meaning as in our Terms and Conditions.

We have prepared this Policy to be compliant in substance with Malaysia’s Personal Data Protection Act 2010, as amended (including by the Personal Data Protection (Amendment) Act 2024) (the “PDPA”) and to align with the data-disclosure expectations of the Apple App Store and Google Play.

You can browse much of Loka as a guest. Some features - the AI travel assistant and syncing your saved content to your account - require you to sign in. Where a feature is available only to signed-in users, the data described below for that feature is processed only when you choose to use it.

↑ Back to top

2.Personal data we collect

We collect only the categories of data described below, which reflect what Loka actually handles. We are explicit about whether each category stays on your device only or is transmitted off your device to our backend or a service provider.

(a) Account & identity data

When you create an account or sign in, we process:

• Your email address and, where applicable, a password (handled and stored by our authentication provider, Firebase Authentication - we do not see or store your raw password ourselves);
• A display name and profile photo, if you provide them;
• A Firebase User ID (UID) - a unique identifier assigned to your account, used to associate your saved content and chat history with you;
• If you sign in with Google Sign-In, the basic Google account information you authorise (such as your email address and name) that Google returns to us through the OAuth flow.

This data is transmitted off your device to Firebase and to the Loka backend.

(b) Location data

To power nearby discovery and map features, the app can access your device location. At the system level the app requests approximate (“coarse”) location on Android (ACCESS_COARSE_LOCATION); on iOS, location is requested for use while you are using the app (“when in use”). When you grant permission, your coordinates and accuracy are used to find attractions and tours near you and to render maps. Your location is sent to our backend with the relevant request (for example, when searching nearby places or asking the AI assistant a location-aware question) and to our maps provider to display and search the map. If you do not grant location permission, location-dependent features will be limited, but you can still use the rest of Loka.

(c) AI chat & itinerary content

When you use the AI travel assistant or itinerary planner, the content you submit - your prompts, messages, travel preferences and questions, together with relevant location context - is transmitted to our backend AI/LLM endpoint to generate responses. Your conversation history may be stored on our backend so you can return to past conversations.

(d) Saved content

Content you choose to save - your bucket list, saved tours, and saved itineraries - is stored to let you return to it. Saved itineraries and bucket-list items associated with your account are synced to our backend. Saved tours (bookmarks) are stored locally on your device so they survive app restarts; they are deliberately device-local and are not synced to, or deleted from, a backend when you sign out.

(e) Device & technical data

To operate and troubleshoot the Services, we process basic device and technical data, such as device/OS type and version, the Firebase authentication token attached to your requests, and in-app/diagnostic logs generated during use. In-app debug logs are generated for development purposes and are device-side; technical metadata necessarily accompanies requests that reach our backend so they can be authenticated and served.

↑ Back to top

3.How we collect it

• Directly from you - when you register, sign in, complete your profile, send messages to the AI assistant, build itineraries, or save content.
• Automatically from your device - when, with your permission, the app reads your location, and when your device generates the technical metadata (device/OS info, auth token, logs) needed to serve and secure your requests.
• Via Google Sign-In - when you choose to sign in with Google, we receive the basic account information you authorise through Google’s OAuth flow.

↑ Back to top

4.How we use your data

We use the data above to:

• Provide discovery & map features - show attractions, tours and points of interest near you, and render and search interactive maps;
• Power the AI assistant & itinerary planner - process your prompts and preferences (with location context) to generate travel recommendations and itineraries;
• Maintain your account & saved content - authenticate you, keep you signed in, and store and sync your bucket list, saved tours and itineraries;
• Security & integrity - authenticate requests, detect and prevent abuse, and keep the Services secure;
• Operate, maintain and improve the service - troubleshoot issues and improve the reliability and quality of Loka.

We do not use your data for third-party advertising, and we do not sell your personal data (see Section 6).

↑ Back to top

5.Legal basis & consent under the PDPA

Under the PDPA (as amended), we process your personal data on the basis of your consent and where processing is necessary for the performance of, or in connection with, the services you request (a recognised basis under the PDPA). By using Loka, creating an account, and granting the permissions the app asks for (such as location), you consent to the collection and use of your personal data as described in this Policy.

Some data is necessary to deliver core functionality - without it, we may not be able to provide all the features you request (for example, the AI assistant cannot answer without receiving your message, and nearby discovery cannot work without location access). You may withdraw your consent or limit processing as described in Section 12, recognising that doing so may limit certain features.

As required by the PDPA’s Notice and Choice Principle, this Policy describes the personal data we collect, the purposes for which it is processed, the parties to whom it may be disclosed, and how you can request access to and correction of your data. We do not process sensitive personal data (as defined by the PDPA) through the Loka app.

↑ Back to top

6.Disclosure & sharing

We share personal data only with the service providers (data processors) needed to operate Loka, and only to the extent necessary for the purposes described above:

• Google / Firebase - provides authentication (sign-up, sign-in, account identity / Firebase UID) and supporting backend infrastructure. Your account and identity data are processed by Firebase.
• Mapbox - provides maps and geocoding. To render and search maps, your location and map/search queries are sent to Mapbox using our access token.
• Our backend AI/LLM provider - the Loka backend receives your AI chat and itinerary inputs (with location context) to generate responses. Where our backend relies on a third-party large-language-model provider to produce those responses, your inputs may be processed by that provider on our behalf.
• Hosting & infrastructure - our backend API is served over a content-delivery / cloud infrastructure layer; requests carry a Firebase authentication token and the technical metadata needed to route and secure them.

We may also disclose personal data where required by law, regulation, legal process, or enforceable governmental request, or to protect the rights, safety, or property of Loka, our users, or the public.

↑ Back to top

7.Third-party services & SDKs

Loka integrates the following third-party services. Each is governed by its own privacy policy; we encourage you to review them:

Loka does not currently include third-party analytics, advertising, attribution, or crash-reporting SDKs in the app (see Section 15).

↑ Back to top

8.Device permissions

The Loka app asks for the following device permission:

• Location - used to show nearby attractions, render maps, and give the AI assistant location-aware context. On Android the app requests approximate (coarse) location; on iOS it requests location while you are using the app. The system prompt explains this as: “Allow Loka to use your location to show nearby attractions.”

You can change or revoke the location permission at any time in your device’s settings (iOS: Settings → Privacy & Security → Location Services; Android: Settings → Apps → Loka → Permissions). If you revoke location access, nearby discovery, map-centred features, and location-aware AI responses will be limited or unavailable, but you can continue to use the rest of the app.

The app does not currently request push-notification access or other sensitive device permissions. If we add new permissions in future, we will update this Policy and request your consent through the system permission prompt.

↑ Back to top

9.Data retention

We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by law:

• Account & identity data is retained while your account is active and until you ask us to delete it (see Section 13).
• AI chat history and saved content (itineraries, bucket list) synced to your account is retained so you can access it, and until you delete the relevant items or request account deletion.
• Saved tours (bookmarks) stored on your device are retained on that device until you remove them or uninstall the app; signing out does not delete them.
• Location data is used at the time of your request and is not retained as a persistent location history by Loka beyond what is needed to serve that request and the resulting content.
• Device & technical metadata / logs are retained for a limited period for security, troubleshooting, and service-operation purposes.

When data is no longer needed, we delete it or de-identify it. Note that third-party providers (Section 7) retain data according to their own retention policies.

↑ Back to top

10.Data security

We take reasonable steps to protect your personal data:

• Data transmitted between Loka and our backend and service providers is sent over encrypted (HTTPS/TLS) connections.
• Authentication uses Firebase ID tokens attached to requests as bearer tokens; sessions that are revoked cause the token refresh to fail and sign you out.
• Signing out clears your locally cached session and user-scoped data on the device.

Personal data breach notification. In line with the PDPA (as amended), if a personal data breach affecting your personal data occurs, we will notify the Personal Data Protection Commissioner as soon as practicable after becoming aware of it and, where the breach is likely to cause you significant harm, we will notify you without unnecessary delay.

↑ Back to top

11.International data transfers

Loka is based in Malaysia, but some of the service providers we rely on - including Google/Firebase, Mapbox, and our cloud/hosting and AI infrastructure - operate globally. As a result, your personal data may be processed, stored, or transferred to servers located outside Malaysia. Where data is transferred internationally, we take reasonable steps so that it remains protected consistent with this Policy and applicable law, including the PDPA’s requirements for cross-border transfers. By using Loka, you consent to such transfers where necessary to provide the service.

↑ Back to top

12.Your rights under the PDPA

Subject to the PDPA (as amended), you have the right to:

• Access the personal data we hold about you;
• Correct personal data that is inaccurate, incomplete, or out of date;
• Withdraw your consent to our processing of your personal data;
• Limit or object to certain processing of your personal data, including processing for direct marketing;
• Data portability - request that personal data you have provided to us be transferred to you or, where technically feasible and compatible with the data format, to another data controller, in accordance with the PDPA (as amended);
• Request deletion of your personal data and account (see Section 13).

You can update much of your profile and saved content directly in the app. To exercise any of these rights, contact our Data Protection Officer at faizal@loka.my (see Section 18). We may need to verify your identity before acting on your request, and we will respond within the timeframe required by applicable law. Withdrawing consent or limiting processing may mean certain features no longer work. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

↑ Back to top

13.Account & data deletion

If you prefer, you can also request deletion by emailing our Data Protection Officer at faizal@loka.my from the email address linked to your Loka account (or otherwise allow us to verify your identity), with the subject line “Account Deletion Request.” We handle deletion in line with the Apple App Store and Google Play account-deletion requirements and the PDPA.

Please note that saved tours stored locally on your device are device-local and are not held on our backend; you can remove them in-app or by uninstalling the app. Data held by third-party providers is subject to their own deletion processes.

Signing out of the app clears your locally cached session and user-scoped data on the device, but does not by itself delete your account or backend-stored data - use the deletion request route above for that.

↑ Back to top

14.Children's privacy

Loka is not directed at children. Consistent with our Terms and Conditions, you must be at least 18 years of age, or possess the legal capacity to enter into a binding contract in your jurisdiction, to create an account. We do not knowingly collect personal data from children below the applicable age. If you believe a child has provided us with personal data, please contact us at faizal@loka.my and we will take reasonable steps to delete it.

↑ Back to top

15.Analytics, cookies & advertising

The Loka app does not currently use any third-party analytics, advertising, attribution, or crash-reporting SDKs. We do not build advertising profiles, and we do not track you across other companies’ apps or websites. If we introduce analytics or crash-reporting in future, we will update this Policy, update our App Store / Google Play data disclosures, and where required obtain your consent.

Cookies and similar technologies. The Loka mobile app does not use advertising or analytics cookies. When you use the loka.my website, we may use strictly necessary cookies that are required for the site to function (for example, to keep you signed in or to remember your preferences). If we introduce non-essential, analytics, or advertising cookies on the website, we will provide notice and, where required by law, obtain your consent before doing so.

↑ Back to top

16.App stores: Apple & Google

Because the Loka app is distributed through the Apple App Store and Google Play, the following applies:

• Store data disclosures. The practices described in this Policy are reflected in our Apple App Store privacy “nutrition” label and our Google Play Data safety form. The summary in Section 19 is provided to align with those disclosures. If a difference ever arises, the detailed sections of this Policy govern, and we will correct the store disclosures.
• Apple as a third-party beneficiary. If you downloaded the app from the Apple App Store, you acknowledge that Apple Inc. and its subsidiaries are third-party beneficiaries of the terms governing your use of the app and may enforce them, but Apple has no obligation to provide any maintenance or support for the app and is not responsible for addressing any claims relating to the app, including privacy claims. Privacy questions should be directed to us using the contact details in Section 18, not to Apple or Google.
• Account deletion. Apple and Google require apps that support account creation to also let users initiate account and data deletion. As described in Section 13, you can delete your account and associated data directly in the app, and may also request deletion by email.

↑ Back to top

17.Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the Services, our practices, or legal requirements. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide a more prominent notice in the app. Your continued use of Loka after an update takes effect constitutes acceptance of the revised Policy. We encourage you to review this Policy periodically.

↑ Back to top

18.Contact us & Data Protection Officer

If you have questions about this Policy, wish to exercise your PDPA rights, or want to request account deletion, please contact us:

• Entity: Planet Loka Global (operator of Loka / Loka.my)
• Business registration no.: 202503074701 (PG0568558-M)
• Data Protection Officer (DPO): Faizal Abd Kadir, appointed in accordance with the PDPA (as amended) - faizal@loka.my
• General enquiries: hello@loka.my
• Registered address: P02-K01, Level P2, The Gardens, Lingkaran Syed Putra, Mid Valley City, Kuala Lumpur 59200, Wilayah Persekutuan Kuala Lumpur

This Policy and your use of the Services are governed by the laws of Malaysia, and any related legal matters will be resolved in the Malaysian courts.

↑ Back to top

19.Data-safety summary (Apple & Google)

For quick reference, and to align with Apple App Store and Google Play disclosures, here is a plain-language summary of the Loka app’s data practices. The detailed sections above govern in case of any difference.

Data sold? No. Used for tracking across other apps/sites? No. Used for third-party advertising? No.

↑ Back to top