Legal Documents

Privacy Policy

Last updated: June 4, 2026

At Laksana, we respect your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and the Personal Data Protection Act 2010 (PDPA). This Privacy Policy explains how DELYVA SDN. BHD. collects, uses, stores, and protects your information when you use the Laksana platform.

1. Service Provider

Laksana is a product of DELYVA SDN. BHD. (Company No. 202001005761 / 1362081-M), a company incorporated in Malaysia. For privacy enquiries, please contact us at hello@laksana.ai.

2. Information We Collect

We collect personal data that you provide directly when creating an account, setting up an workspace, or using the platform. This includes: your name, email address, phone number, and workspace details; photos and videos submitted via WhatsApp or the portal (which may contain GPS coordinates and timestamps); device information and IP address for security and geolocation; subscription and billing details (processed securely by Stripe); and operational data such as work updates, issues, inspections, patrol check-ins, and asset records created by your team.

3. How We Use Your Data

We use your data to: authenticate users and manage access; provide and improve the Laksana platform and its features; process subscription billing via Stripe; send notifications via email, WhatsApp, or push alerts; run operational workflow calculations; generate reports and analytics for your team; and detect fraud, abuse, or security threats. We do not sell your personal data to third parties.

4. AI Processing & Privacy Controls

Laksana includes optional AI-powered features for inbox message classification and compliance descriptions. Your workspace has full control over AI data processing consent in Workspace Settings. When consent is enabled, Personally Identifiable Information (PII) — including email addresses, phone numbers, and common name patterns — is automatically scrubbed and masked before transmission to any remote AI endpoint. When consent is disabled, all remote AI processing is bypassed entirely and local keyword classification is used instead.

5. Data Storage & Security

Your data is stored on AWS Lightsail Managed PostgreSQL databases, which are encrypted at rest using AWS Key Management Service (KMS). All data in transit is protected by TLS/HTTPS encryption. Files such as photos, avatars, and evidence attachments are stored in Amazon S3 with server-side encryption enabled. We apply role-based access controls to restrict data access within our team.

6. Data Retention & Deletion

We retain operational records (audit trails, incoming messages, routine logs) based on your subscription tier: Start plan (30 days), Basic (90 days), Standard (180 days), Advanced (365 days), Enterprise (730 days). Records are automatically and permanently pruned after the applicable period. Workspace administrators may request full account deletion — including all user profiles, operational records, and uploaded files (logos, avatars, and evidence attachments) — by contacting hello@laksana.ai. Deletion is carried out by our superadmin team and results in permanent removal from the database and S3 storage.

7. Data Export & Portability

You may request an export of your personal data at any time via the Settings page in the Laksana portal (Settings > Data Control > Request Data Export). We will email you a structured JSON package containing your account profile, session history, and associated operational records within 5 business days.

8. Third-Party Services

Laksana integrates with the following third-party services to deliver its features: Stripe (subscription billing — subject to Stripe's privacy policy); WhatsApp Business API via Meta (messaging — subject to Meta's data policy); Google Cloud AI / Gemini API (optional AI classification — only used when your workspace has enabled AI consent, subject to Google's privacy policy). On the marketing website (laksana.ai) only, and only after you accept in the cookie banner, we also use Google Analytics (traffic measurement — subject to Google's privacy policy) and the Meta Pixel (advertising measurement and retargeting on Facebook and Instagram — subject to Meta's data policy). Neither runs inside the Laksana platform itself, and neither is loaded at all unless you accept. We do not share your data with any third party beyond what is required to operate these integrations.

9. Cookies & Session Data

The Laksana platform (the admin console and the public booking portals) uses session cookies strictly necessary for authentication and operation. It sets no analytics or advertising cookies.

The marketing website (laksana.ai) can load two non-essential tools: Google Analytics, to understand which pages are read, and the Meta Pixel, which measures our Facebook and Instagram advertising and can be used to show you our ads again elsewhere. Both are off by default. Neither is requested until you choose Accept in the banner shown on your first visit; choosing Decline means the requests are never made. Your choice is stored in your own browser and you can change it at any time by clearing this site's data, which brings the banner back.

You can also disable cookies in your browser settings, though on the platform this may affect functionality that depends on staying signed in.

The Academy and News sections (laksana.ai/academy and laksana.ai/news) set one additional first-party cookie, lk_ft. It stores a single page path — the first Academy or News page you landed on — and nothing else: no identifier, no profile, no browsing history. Its only purpose is so that if you later choose to submit a form, we can tell which article brought you. It is never read by any third party, is never used for advertising, expires after 90 days, and you can delete it with your browser's site data at any time. Because it is used only to attribute a form you choose to submit, it is treated as strictly necessary and is not part of the Accept/Decline choice above.

9a. Newsletter Subscriptions

If you subscribe to the Academy newsletter, we collect your email address and the page path described above. We use them only to send occasional notifications when we publish new guides, and to understand which content leads people to subscribe. We do not sell, rent or share subscriber lists.

Subscriber details are stored and processed by Brevo (Sendinblue SAS, France), our email service provider, acting as a data processor on our behalf. Brevo's own privacy notice is available at brevo.com/legal/privacypolicy.

Every email we send includes an unsubscribe link, and unsubscribing removes you from the list. You may also request removal at any time by contacting hello@laksana.ai. Subscribing is entirely optional: every guide, tool, template and news item on this site is fully usable without it, and nothing on the Academy is placed behind a signup.

10. Your Rights (GDPR & PDPA)

Depending on your jurisdiction, you have the following rights regarding your personal data: (a) Right to Access — request a copy of the data we hold about you; (b) Right to Rectification — request correction of inaccurate or incomplete data; (c) Right to Erasure ("Right to be Forgotten") — request deletion of your personal data; (d) Right to Data Portability — receive your data in a structured, machine-readable format via the Data Export feature; (e) Right to Restrict Processing — request that we limit how we use your data; (f) Right to Object to AI Processing — disable AI processing via Workspace Settings at any time; (g) Right to Lodge a Complaint — under PDPA, you may contact the Personal Data Protection Commissioner (PDPC) of Malaysia; under GDPR, you may contact your local data protection authority. To exercise any of these rights, contact us at hello@laksana.ai.

11. Contact Us

If you have any questions about this Privacy Policy or our GDPR/PDPA compliance, please contact DELYVA SDN. BHD. at hello@laksana.ai. Our registered address is in Malaysia. This policy was last updated on September 19, 2026.