TRIPLAH PRIVACY NOTICE

Effective date: 8 Aug 2026
Last updated: 30 Aug 2026

This Privacy Notice explains how TripLah collects, uses, discloses, stores and protects personal data when you use the TripLah website, applications, accounts, AI chat, trip-planning tools and related services.

This Privacy Notice is intended to constitute TripLah's personal data protection notice for the purposes of the Malaysian Personal Data Protection Act 2010 [Act 709], as amended from time to time, where that Act applies.

1. Who is responsible for your personal data

TripLah is operated by TRIPLAH SERVICES, a business registered in Malaysia under registration number 202603189247 (MA0349799-D) registered in Malaysia.

For most processing described in this Notice, TripLah is the data controller or equivalent entity responsible for determining why and how personal data is processed.

Contact details:
Privacy matters: privacy@triplah.com.my
General support: support@triplah.com.my
Website: https://www.triplah.com.my

2. Scope of this Notice

This Notice applies when you:

• visit the TripLah website or application;
• create or manage an account;
• set travel preferences;
• create, save or edit a trip plan;
• use TripLah’s AI chat or recommendation features;
• communicate with TripLah;
• click a referral or affiliate link; or
• otherwise interact with the Service.

This Notice does not govern a third-party travel provider after you leave TripLah. Airlines, hotels, online travel agencies, activity providers and other linked services process personal data under their own privacy notices.

TripLah does not control personal data you submit directly to a third-party provider during a booking or transaction.

3. Personal data we collect

The information collected depends on the features you use.

3.1 Account and identity information

This may include:

• name;
• email address;
• username;
• password hash;
• profile image;
• account identifier;
• authentication-provider identifier;
• account creation and verification status; and
• account settings.

TripLah does not store passwords in readable form.

3.2 Travel preferences

This may include:

• home airport or departure location;
• preferred currency and language;
• destinations of interest;
• preferred travel pace;
• budget ranges;
• accommodation preferences;
• food and activity interests;
• preferred transport;
• accessibility preferences;
• crowd, weather or climate preferences; and
• other travel-personality or planning settings.

3.3 Trip plans and saved content

This may include:

• destinations;
• travel dates and trip duration;
• itineraries;
• saved attractions or activities;
• accommodation or flight options you save;
• notes;
• estimated budgets;
• travelling-party information;
• places added, removed or reordered;
• packing and expense-planning information; and
• previous versions of a trip plan.

A saved item or itinerary is not a confirmed booking.

3.3A Trip Room collaboration

When you join or create a Trip Room, authenticated room participants may see the exact shared itinerary and collaboration content according to their role. This may include your display name, membership role, group-chat messages, replies, reactions, contextual sticky notes, activity records, and who is currently online, typing or viewing a particular itinerary day. Private Ask TripLah conversations are described separately in Section 3.4 and are not shared room content.

TripLah creates the initial itinerary before collaboration begins. Viewers may use group chat, replies, reactions, contextual notes and Ask TripLah advice, but cannot change the shared itinerary. Owners and editors may change the itinerary. Only owners may manage invitations, change a member's role, remove a member, moderate content or delete the room. Owners may invite people with Can view or Can edit access and revoke or rotate an invitation link. An invitation link expires after seven days, but a person who has already accepted remains a member until the owner removes them or the trip is deleted.

Supabase Realtime processes short-lived authentication claims, room and object identifiers, synchronization cursors, and ephemeral presence information. Realtime broadcasts do not contain itinerary snapshots, chat text, note text or private Ask TripLah text. Participants retrieve shared content through TripLah's authenticated application interfaces; private Ask TripLah history is not distributed through Realtime.

3.4 AI chat and prompt information

When you use AI features, TripLah may process:

• prompts and questions;
• AI-generated responses;
• instructions and preferences included in a prompt;
• chat history;
• feedback on AI responses;
• actions taken following an AI recommendation; and
• technical information needed to operate and secure the AI feature.

AI conversations may be sent to one or more third-party AI providers as explained in Section 8.

Each Trip Room member's Ask TripLah conversation is private to that member and is not posted to the room's shared messages or made available to other room participants through Trip Room history. TripLah stores up to 100 prompt and response text messages in that browser's local storage, each with a 30-day expiry. Expired messages are excluded and removed when Ask TripLah is next loaded. They may be removed earlier if browser site data is cleared, and the history does not automatically follow the member to another browser or device.

To answer a new Trip Room request, TripLah may process the current prompt, relevant authoritative itinerary information and up to four recent private text messages. Structured recommendation records, proposed or applied commands and provider schedules are not written to this browser history. If an owner or editor applies an Ask TripLah change, the resulting itinerary change and activity record become part of the shared trip, while the private conversation remains private. Viewers cannot apply itinerary changes.

3.5 Information about other travellers

You may enter information relating to a travel companion, family member or other person.

This may include:

• age range;
• relationship to you;
• travel preferences;
• accessibility or dietary requirements; and
• other information relevant to the trip.

You must have permission or another lawful basis to provide another person’s information. You should avoid entering unnecessary identifying details about companions.

3.6 Sensitive information

Travel prompts, preferences or trip details may reveal or allow inferences about health, disability, dietary requirements, religion, nationality or other characteristics that may be treated as sensitive personal data under applicable law.

You should provide sensitive personal data only where it is genuinely necessary for the TripLah feature you are using and should avoid including unnecessary sensitive or confidential information in AI chat.

Where TripLah processes sensitive personal data:

• it will be used only for the relevant requested feature or another disclosed and lawful purpose;
• access will be limited where reasonably appropriate;
• it will not be used for unrelated advertising;
• consent or another legally valid basis will be obtained where required; and
• appropriate safeguards will be applied according to the nature and risk of the processing.

Do not enter passport numbers, national identification numbers, complete medical records, payment-card information, passwords or other confidential authentication credentials into AI chat.

Important AI notice: TripLah's current AI provider, DeepSeek, states in its published privacy materials that its services are not designed or intended to process sensitive personal data and advises users not to provide such information. If you nevertheless include sensitive personal data in an AI prompt, that information may be transmitted to DeepSeek as part of the prompt unless TripLah has technically removed or excluded it before transmission. You should therefore avoid including sensitive personal data in AI chat.

Where the Malaysian Personal Data Protection Act 2010 applies, TripLah will process sensitive personal data only in circumstances permitted by applicable law, including obtaining explicit consent where required.

3.7 Device, technical and usage information

This may include:

• IP address;
• device and browser type;
• operating system;
• language and time zone;
• device identifiers;
• pages and features used;
• clicks and navigation paths;
• date and time of access;
• referring website;
• approximate location derived from IP address;
• error reports;
• session and authentication logs;
• security events; and
• performance information.

3.8 Location information

With your permission, TripLah may process precise or approximate device location to provide nearby suggestions, maps or location-aware planning.

You can disable device-location permission through your device or browser. Some location-based features may then be unavailable.

TripLah may still infer an approximate region from your IP address for security, language or localisation purposes.

3.9 Communications and support information

This may include:

• emails and support messages;
• complaint details;
• survey responses;
• feedback;
• records of privacy requests; and
• information supplied when reporting an issue.

3.10 Affiliate and referral information

TripLah currently uses or may use affiliate links to refer users to independent third-party travel providers.

When you click an affiliate link, TripLah, the affiliate network or the third-party provider may process:

• the offer or link clicked;
• date and time of the click;
• referral identifier;
• affiliate or campaign identifier;
• originating TripLah page;
• approximate location or region;
• browser and device information;
• cookie or attribution identifier;
• whether a qualifying transaction later occurred;
• the general category of the purchased service; and
• commission or conversion status reported by the provider.

TripLah may receive a commission or referral fee if you complete an eligible transaction.

TripLah does not currently:

• collect payment for the third-party travel booking;
• receive your complete payment-card number;
• issue the provider’s ticket, voucher or booking confirmation;
• control the provider’s checkout process; or
• become a party to your booking contract.

Depending on the affiliate programme, TripLah may receive limited transaction-attribution information, but may not receive your complete booking details.

Affiliate partners and travel providers may independently process information under their own privacy notices.

3.11 Cookies and similar technologies

TripLah uses cookies and similar technologies for functions such as authentication, security, session management and user preferences.

TripLah also currently uses Google Analytics 4, provided by Google LLC, to understand website usage, measure performance and record selected interaction events, including interactions with affiliate content. Google Analytics may receive information such as page or screen information, browser and device information, approximate location derived from network information, referral information and event metadata.

Google Analytics' gtag.js implementation uses first-party analytics cookies by default, including cookies such as _ga and _ga_<container-id>, to distinguish users and maintain session state.

TripLah also uses Vercel Web Analytics, provided by Vercel Inc., to measure aggregated page views and understand information such as referral sources, browser and device categories and approximate geographic location. Vercel Web Analytics does not use cookies and is configured to load independently of the optional Google Analytics preference. It provides aggregate traffic measurement even when Google Analytics is declined. TripLah removes query strings and redacts share, invitation and Trip Room identifiers from event URLs before they are sent.

The optional analytics preference controls Google Analytics only. Google Analytics is not loaded unless you allow it; Vercel Web Analytics remains active for cookie-free aggregate traffic measurement.

Analytics cookies are non-essential. Where consent is required by applicable law, TripLah will request the required consent before using non-essential analytics cookies or similar identifiers and will provide an appropriate way to change or withdraw that choice.

TripLah does not create a separate proprietary affiliate-tracking cookie or store affiliate-click records in its own backend solely for affiliate attribution. However, selected affiliate interactions may be recorded as Google Analytics events before your browser opens the third-party provider's affiliate URL.

Third-party travel providers and affiliate networks may place their own cookies or similar technologies after you visit their websites. Their use of those technologies is governed by their own privacy and cookie notices.

TripLah may update its cookie practices as the Service changes. Where a material change requires notice, consent or additional controls, TripLah will provide them as required by applicable law.

4. Sources of personal data

TripLah may collect information:

1. directly from you;
2. automatically from your browser or device;
3. from an authentication provider, such as Google, where you choose third-party sign-in;
4. from service providers operating TripLah infrastructure;
5. from affiliate or referral partners;
6. from public or licensed travel-data sources;
7. from another traveller who is authorised to plan on your behalf; or
8. from third-party integrations you choose to connect.

Where TripLah receives information from another source, it will process it only as permitted by law and applicable agreements.

5. Why TripLah uses personal data

TripLah may use personal data for the following purposes.

5.1 Providing the Service

This includes:

• registering and authenticating accounts;
• storing preferences;
• creating and saving trip plans;
• generating itineraries and recommendations;
• providing maps and location-aware features;
• synchronising information across devices;
• responding to requests; and
• maintaining user settings.

Where applicable, the legal basis is performance of a contract or taking steps at your request before entering into a contract.

5.2 AI and personalisation

This includes:

• interpreting prompts;
• generating conversational responses;
• personalising destination and activity suggestions;
• inferring planning preferences;
• ranking options;
• adapting itineraries; and
• evaluating the usefulness of generated output.

Depending on the circumstances and applicable law, the legal basis may be performance of the Service, consent or TripLah’s legitimate interest in providing relevant planning functionality.

5.3 Security and fraud prevention

This includes:

• protecting accounts;
• detecting abuse and suspicious activity;
• enforcing rate limits;
• investigating incidents;
• maintaining logs;
• protecting TripLah’s systems and users; and
• enforcing the Terms of Service.

The legal basis may be legitimate interests, contractual necessity or compliance with legal obligations.

5.4 Service improvement and analytics

This includes:

• understanding feature usage;
• diagnosing errors;
• measuring performance;
• testing improvements;
• conducting aggregated analysis;
• evaluating recommendation quality; and
• developing new features.

Where required, TripLah will obtain consent for non-essential analytics.

5.5 Communications

This includes:

• sending account and security notices;
• responding to support requests;
• notifying you of material service or policy changes;
• sending requested trip information; and
• providing marketing communications where permitted.

You may unsubscribe from marketing messages. Service, security and legal notices may still be sent where necessary.

5.6 Affiliate attribution and commercial operations

This includes:

• tracking referral links;
• attributing eligible commissions;
• detecting affiliate fraud;
• reconciling partner reports;
• measuring the performance of offers; and
• maintaining tax, accounting and business records.

5.6A Current free-service model

TripLah’s current consumer trip-planning service is provided without a subscription charge payable directly to TripLah unless a feature is expressly identified as paid.

TripLah does not currently need to collect payment-card information merely for you to:

• create a TripLah account;
• save preferences;
• create or save trip plans;
• use currently free planning features; or
• follow a third-party affiliate link.

TripLah may generate revenue through affiliate commissions or other clearly disclosed commercial arrangements with third-party providers.

Affiliate revenue does not give TripLah access to all information you provide directly to the third-party provider.

5.6B Future paid services

TripLah may introduce additional features or services in the future, including paid services, subscriptions, developer tools or API services.

Before TripLah collects or processes personal data for a materially new purpose associated with such services, TripLah will update this Privacy Notice or provide an appropriate supplemental privacy notice. Where required by applicable law, TripLah will provide notice and obtain any necessary consent before the new processing begins.

The inclusion of possible future services in TripLah's Terms of Service does not authorise TripLah to collect or process additional categories of personal data before those services are introduced.

5.7 Legal and compliance purposes

This includes:

• complying with laws and lawful requests;
• responding to regulators or courts;
• protecting legal rights;
• resolving disputes;
• handling privacy requests;
• maintaining required records; and
• notifying affected persons or regulators of qualifying data breaches.

6. Information you must provide

Some information is necessary to create and secure an account, such as an email address and authentication information.

Travel preferences and trip details are generally voluntary, but TripLah may be unable to produce a useful plan without relevant information.

You are not required to provide precise location, sensitive information or marketing consent to use basic planning functions unless a specific feature genuinely requires that information.

7. Lawful bases

Where laws such as the EU or UK GDPR apply, TripLah relies on one or more of the following bases:

• Contract: processing necessary to provide requested TripLah features.
• Consent: processing based on a clear choice, such as optional cookies, precise location, certain sensitive information or marketing.
• Legitimate interests: operating, securing and improving the Service, provided those interests are not overridden by your rights.
• Legal obligation: processing necessary to comply with applicable law.
• Legal claims: establishing, exercising or defending legal rights.
• Vital interests: processing necessary to protect a person in an emergency, where applicable.

You may withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully.

8. Third-party AI providers

Certain TripLah features use third-party artificial intelligence services to interpret user requests and generate conversational responses, recommendations or explanations.

Current AI provider: Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (DeepSeek). TripLah currently uses the DeepSeek API for AI-powered features. The specific model used may change as TripLah updates the Service.

When you use an AI-powered feature, TripLah may send DeepSeek only the information reasonably necessary to process the request. This may include:

• your prompt or message;
• relevant travel preferences;
• relevant parts of your current itinerary or trip plan;
• limited recent conversation context;
• instructions supplied by TripLah to operate the feature; and
• limited technical information necessary to operate, secure and monitor the request.

TripLah does not intentionally send passwords, complete payment-card numbers or government identification numbers to DeepSeek. You should not include such information in an AI prompt.

AI provider safeguards

TripLah takes reasonable steps to assess the privacy and security practices of AI providers and to apply appropriate contractual, technical and organisational safeguards where those providers process personal data for the Service.

DeepSeek's published materials state that personal data associated with its services may be processed and stored in the People's Republic of China. Accordingly, use of TripLah's AI features may involve a transfer of prompt and contextual information from Malaysia or your country of residence to China. Section 14 explains TripLah's approach to international transfers.

DeepSeek's published privacy materials also state that personal data may be used to develop, train and improve its technology and that a right to opt out of use for model training or technology optimisation may be available. TripLah will use available provider controls and contractual arrangements to limit use of identifiable TripLah inputs and outputs for unrelated model training where reasonably available and appropriate. TripLah does not represent that every provider-side retention or processing activity can be disabled.

DeepSeek may retain information for service delivery, security, abuse prevention, legal compliance, technology improvement or other purposes permitted under its applicable terms and policies.

AI model training by TripLah

TripLah does not use identifiable AI-chat content to train a TripLah-owned general-purpose AI model unless that use is separately disclosed and a valid legal basis exists.

If TripLah proposes to materially change how identifiable AI conversations are used for TripLah's own model training or development, TripLah will provide appropriate notice and obtain consent where required by applicable law.

Changes to AI providers

TripLah may change AI providers from time to time. Where a change materially affects how personal data is processed, TripLah will update the applicable privacy information and provide any notice or obtain any consent required by law.

9. Automated recommendations and profiling

TripLah may automatically analyse preferences and trip information to:

• rank destinations;
• predict relevance;
• recommend activities;
• arrange itinerary order;
• estimate suitability;
• personalise content; and
• infer likely travel interests.

These processes are intended to assist planning. They do not normally produce legal or similarly significant effects.

TripLah does not use solely automated processing to determine a person’s eligibility for credit, insurance, employment, immigration status or another decision carrying comparable legal effect.

You can:

• change your preferences;
• edit or reject an itinerary;
• ask for another recommendation;
• remove saved information; or
• contact TripLah for an explanation or human review where applicable law provides that right.

Recommendation logic may consider stated preferences, travel dates, estimated budget, distance, weather, popularity, data availability, ratings and similar planning factors.

10. How TripLah shares personal data

TripLah may disclose personal data to the following categories.

10.1 Hosting and infrastructure providers

TripLah uses third-party hosting and infrastructure service providers to operate the Service, host applications and websites, store data, and support databases, files, logs, backups and related infrastructure.

Current providers include:

Exabytes Network Sdn. Bhd. — domain, web hosting and/or related infrastructure services. Vercel Inc. — application hosting, deployment, content delivery and related infrastructure services. Supabase Inc. — database, storage, private Realtime Broadcast and Presence, and related backend infrastructure services.

These providers may process personal data on TripLah's behalf to the extent necessary to provide their respective services. Their processing may occur in Malaysia or other countries depending on the provider, service configuration and infrastructure used.

TripLah takes reasonable steps to ensure that appropriate contractual, technical and organisational safeguards apply where these providers process personal data on TripLah's behalf.

10.2 Authentication providers

TripLah may allow you to sign in using a third-party authentication provider.

If you choose third-party sign-in, the authentication provider may provide TripLah with information necessary to authenticate your account, such as your name, email address, profile information and a unique account identifier, depending on the permissions you grant and the provider's configuration.

Current provider:

Google LLC — optional Google account sign-in.

Google processes information associated with its authentication services in accordance with its own privacy terms.

You are not required to use Google sign-in where TripLah provides another account-registration method.

10.3 AI providers

AI providers process prompts and context as described in Section 8.

10.4 Maps, weather and travel-data providers

TripLah may use third-party providers to supply maps, geolocation, weather forecasts, places, transport, pricing, reviews and other travel-related information. Where necessary to provide these features, TripLah may send limited information such as a destination, location coordinates, travel dates or search query to those providers.

These providers may process information in accordance with their own privacy terms where they act independently, or on TripLah's behalf where they act as service providers or processors.

10.5 Analytics, security and support providers

TripLah may use third-party providers to monitor application performance, identify errors, maintain security, provide customer support and understand how the Service is used.

Current analytics providers:

• Google LLC — Google Analytics 4: used for website and application analytics, performance measurement and selected interaction events. This may include events relating to affiliate content, such as product, destination, placement and target-URL metadata associated with a user interaction.
• Vercel Inc. — Vercel Web Analytics: used for cookie-free and aggregated page-view analytics independently of the optional Google Analytics preference. TripLah removes query strings and redacts share, invitation and Trip Room identifiers from event URLs before transmission.

Google may receive technical and usage information through Google Analytics, including cookie or browser identifiers and other event data, in accordance with the applicable service configuration and Google's terms.

Vercel may receive limited technical and usage information used to produce aggregated website statistics, in accordance with the applicable service configuration and Vercel's terms.

TripLah does not currently operate its own cross-site behavioural advertising system. If TripLah introduces advertising, remarketing or other materially different tracking uses in the future, this Privacy Notice will be updated and any notice, consent or opt-out controls required by applicable law will be provided.

10.6 Affiliate partners and travel providers

When you click an affiliate link, TripLah may send referral and campaign information to the provider.

The provider is generally an independent controller for its website, account, booking and transaction processing.

10.7 Professional advisers

TripLah may disclose information to lawyers, accountants, auditors, insurers and other advisers where reasonably necessary.

10.8 Authorities and legal recipients

TripLah may disclose information where reasonably believed necessary to:

• comply with law or a valid legal process;
• respond to a regulator;
• protect a person’s safety;
• investigate fraud or security incidents;
• enforce legal rights; or
• defend a legal claim.

10.9 Business transfers

Information may be transferred as part of:

• formation of the planned TripLah partnership;
• incorporation of the TripLah business;
• financing;
• reorganisation;
• sale of assets;
• merger; or
• acquisition.

A recipient must use the information consistently with this Notice unless it provides a new notice and obtains any legally required consent.

11. Third-party travel websites

When you follow a link to a third-party travel provider:

• the provider may receive referral information;
• the provider may know that you came from TripLah;
• the provider may place its own cookies;
• information entered on its website is collected by that provider; and
• its privacy notice and terms govern the transaction.

TripLah does not receive or control all information provided to the third party.

Review the third party’s privacy information before entering personal or payment information.

12. Sale, sharing and targeted advertising

TripLah does not sell personal data for monetary payment.

TripLah currently uses Google Analytics and Vercel Web Analytics for analytics and measurement as described in Sections 3.11 and 10.5. The optional analytics choice controls Google Analytics only; cookie-free aggregate measurement through Vercel Web Analytics remains active. Depending on the applicable law and the way an analytics or advertising service is configured, certain disclosures or uses may be treated as a “sale”, “sharing”, targeted advertising or similar regulated activity even where no money is paid for the personal data.

TripLah does not intend to use sensitive personal data for personalised advertising.

Where applicable law gives you a right to opt out of a regulated sale, sharing, targeted advertising or profiling activity, TripLah will provide the required mechanism and will honour legally recognised preference signals where required.

Affiliate referral tracking is used to measure referrals and eligible commissions and is not intended by TripLah to create a general behavioural profile of your activities across unrelated services. Third-party providers and affiliate networks may have their own tracking practices, which are governed by their own notices.

13. Supplemental privacy terms

Certain future services may be subject to supplemental privacy terms, including:

• a Data Processing Agreement;
• an enterprise privacy schedule;
• API data-processing terms;
• a cookie or tracking notice;
• a payment-processor notice;
• feature-specific consent wording; or
• jurisdiction-specific privacy terms.

Supplemental privacy terms apply only to the relevant service or processing activity.

Where supplemental privacy terms conflict with this general Privacy Notice, the supplemental terms will control for the specific processing activity they govern, unless applicable law requires otherwise.

Supplemental terms do not reduce any privacy right that cannot lawfully be waived or excluded.

TripLah may require separate consent or acceptance before carrying out a new processing activity where required by law.

14. International transfers

TripLah is established in Malaysia and may use providers located in Malaysia and other countries.

Your personal data may therefore be processed outside your country of residence, including in countries that may have different data-protection laws.

In particular, when you use TripLah's AI features, prompt and contextual information may be transferred to and processed by DeepSeek in the People's Republic of China, as described in Section 8.

Where required, TripLah will use appropriate safeguards, which may include:

• contracts requiring suitable data protection;
• recognised standard contractual clauses;
• adequacy regulations or decisions;
• transfer risk assessments;
• consent in limited circumstances;
• security and access controls; and
• other legally recognised transfer mechanisms.

Information about relevant provider locations and safeguards may be requested through privacy@triplah.com.my.

Transfers from Malaysia

Where personal data is transferred from Malaysia to a country or territory outside Malaysia, TripLah will comply with the requirements of section 129 of the Personal Data Protection Act 2010 [Act 709], as amended, and applicable guidelines issued by the Personal Data Protection Commissioner. TripLah will take reasonable steps to ensure that an applicable legal basis or transfer condition is satisfied and that appropriate protection applies to the transferred personal data.

Where required, TripLah will inform you of the relevant category of overseas recipient and the purpose of the transfer and obtain consent where consent is relied upon as the applicable transfer condition.

15. Retention

TripLah retains personal data only for as long as reasonably necessary for the purposes described in this Notice, taking into account the nature and sensitivity of the information, the reason it was collected, whether you maintain an active account, security and fraud-prevention needs, legal and regulatory obligations, dispute-resolution requirements and the technical operation of backups and service providers.

TripLah does not apply one fixed retention period to every category of personal data. Depending on the information and purpose:

• account information may be retained while your account remains active and for a reasonable period afterwards where necessary for security, legal compliance or dispute handling;
• travel preferences, saved trips and other user-created content may be retained while you choose to keep them in the Service and may be removed when you delete them or close your account, subject to lawful exceptions;
• Trip Room chat, notes, replies, reactions, activity and membership records may remain with the shared trip until an authorised author or owner removes the relevant content, the owner removes a member, or the trip is deleted; TripLah does not promise an automatic fixed deletion period that the Service does not technically enforce;
• TripLah's in-product history for private Trip Room Ask TripLah text remains in that browser's local storage with a 30-day expiry for each message; expired messages are excluded and removed when Ask TripLah is next loaded, and clearing browser site data may remove them earlier;
• AI prompts and responses may be processed for the requested functionality, security and support, while an AI provider may retain information in accordance with its own applicable contractual and legal obligations;
• authentication, security and technical logs may be retained for a reasonable period needed to secure the Service, investigate incidents and prevent abuse;
• support, complaint, consent and privacy-request records may be retained for as long as reasonably necessary to resolve the matter, demonstrate compliance or establish, exercise or defend legal claims;
• affiliate and analytics information may be retained according to the relevant measurement, fraud-prevention, accounting and provider settings; and
• backup copies may remain for a limited period after information is removed from active systems and will be overwritten or deleted through the ordinary backup lifecycle unless retention is required for security, disaster recovery or legal reasons.

Where applicable law requires a specific retention period, TripLah will comply with that requirement.

When personal data is no longer reasonably required, TripLah will take reasonable steps to delete, anonymise or otherwise cease active processing of it, subject to lawful exceptions.

Information that has been irreversibly anonymised so that it no longer identifies an individual may be retained for analytics, research, security or service-improvement purposes.

16. Security

TripLah uses reasonable technical and organisational safeguards appropriate to the nature and risk of the information.

Measures may include:

• encryption in transit;
• password hashing;
• access controls;
• authentication protections;
• rate limiting;
• input validation;
• logging and monitoring;
• vulnerability and dependency management;
• backup controls;
• restricted staff and contractor access;
• confidentiality obligations;
• incident-response procedures; and
• vendor-security review.

No internet or storage system is completely secure. TripLah cannot guarantee absolute security.

You should protect your account with a unique password and promptly report suspected unauthorised access.

17. Personal-data breaches

TripLah maintains procedures to assess and respond to personal-data breaches.

Where a breach is likely to result in legally relevant harm or risk, TripLah will notify the appropriate regulator and affected individuals within the period required by applicable law.

Notices may describe:

• what happened;
• the categories of information involved;
• likely consequences;
• measures taken;
• recommended protective steps; and
• contact information.

18. Your privacy rights

Depending on where you live and applicable law, you may have the right to:

• know whether TripLah processes your personal data;
• obtain access to your data;
• receive a copy of certain data;
• correct inaccurate or incomplete data;
• delete data;
• restrict or prevent certain processing;
• withdraw consent;
• object to processing;
• opt out of direct marketing;
• obtain data portability;
• opt out of sale, sharing or targeted advertising;
• request information about automated processing;
• seek human review of certain automated decisions;
• complain to a privacy regulator; and
• receive equal service without unlawful discrimination for exercising a right.

Rights may be subject to lawful exceptions.

Submit a request through email: privacy@triplah.com.my

TripLah may verify your identity before acting on a request. TripLah will respond within the period required by applicable law.

An authorised agent may submit a request where permitted, but TripLah may require evidence of authority and identity verification.

19. Malaysia privacy rights

Where Malaysia’s Personal Data Protection Act 2010 applies, you may request:

• access to personal data;
• correction of inaccurate, incomplete, misleading or outdated data;
• withdrawal of consent, subject to legal or contractual restrictions;
• prevention of processing likely to cause damage or distress where applicable;
• prevention of processing for direct marketing;
• data portability where applicable; and
• information about TripLah’s processing.

You may contact TripLah first or make a complaint to the Personal Data Protection Commissioner where legally available.

Withdrawal of information required for an account may mean TripLah can no longer provide the relevant feature.

20. EEA, United Kingdom and Switzerland supplement

Where applicable, individuals in the European Economic Area, United Kingdom or Switzerland may have rights to:

• access;
• rectification;
• erasure;
• restriction;
• portability;
• objection;
• withdrawal of consent;
• information about international transfers; and
• protection concerning certain solely automated decisions.

You may complain to the supervisory authority where you live, work or believe an infringement occurred.

21. California and other United States privacy rights

If a US state privacy law applies to TripLah and to you, you may have rights to:

• know or access categories and specific pieces of personal information;
• correct information;
• delete information;
• receive portable information;
• opt out of sale, sharing, targeted advertising or certain profiling;
• limit certain uses of sensitive personal information; and
• appeal a denied request.

TripLah will honour legally recognised browser-based opt-out preference signals where required.

TripLah will not discriminate against you for exercising an applicable privacy right.

The categories described in Section 3 are the categories TripLah may have collected during the preceding 12 months. The purposes and recipient categories are described in Sections 5 and 10.

TripLah does not knowingly sell or share personal information belonging to individuals under 18.

22. Canada supplement

Where Canadian privacy law applies, you may request access to and correction of your personal information and may withdraw consent subject to legal or contractual limitations.

You may challenge TripLah’s compliance through privacy@triplah.com.my and, where applicable, complain to the relevant Canadian privacy authority.

23. Australia and New Zealand supplement

Where applicable law provides, you may request access to or correction of your personal information and complain about TripLah’s handling of it.

TripLah will respond to a privacy complaint within a reasonable period and explain escalation options where required.

24. Brazil supplement

Where Brazil’s data-protection law applies, you may have rights to:

• confirmation of processing;
• access;
• correction;
• anonymisation, blocking or deletion;
• portability;
• information about sharing;
• withdrawal of consent;
• review of certain automated decisions; and
• complaint to the competent authority.

TripLah will identify any legally required local representative or data-protection contact in this Notice.

25. Marketing communications

TripLah may send marketing only where permitted by law.

You can opt out through the unsubscribe link or by contacting privacy@triplah.com.my.

Opting out of marketing does not stop necessary messages concerning:

• account security;
• privacy requests;
• material Service changes;
• saved-trip functionality; or
• legal notices.

TripLah will not provide sensitive information to advertisers for personalised advertising.

26. Children

TripLah is intended for adults aged 18 or older.

TripLah does not knowingly allow a child to create an account or knowingly collect personal data directly from a child.

An adult may include limited information about a child traveller when planning a family trip, but should provide only what is necessary and must have authority to do so.

If you believe a child has created an account or submitted personal data without appropriate authority, contact privacy@triplah.com.my. TripLah will investigate and delete the information where required.

27. Account and data deletion

You may delete individual trips or preferences through available account controls where those controls are provided.

You may request complete account deletion by contacting: support@triplah.com.my.

After verifying the request, TripLah will take reasonable steps to:

• disable or close the account;
• delete or anonymise personal data from active systems where it is no longer required;
• request deletion from relevant processors where applicable and reasonably available;
• retain only information that TripLah or a provider is lawfully permitted or required to retain; and
• allow residual backup copies to expire through the applicable backup lifecycle.

Deletion will be carried out within the period required by applicable law and otherwise within a reasonable period having regard to the nature of the systems involved.

Account deletion may not immediately remove information from security logs, backups or third-party provider systems where temporary retention is necessary for security, fraud prevention, legal compliance, dispute resolution or the provider's lawful retention obligations.

Deletion from TripLah does not delete information held independently by a third-party travel provider that you visited or used.

28. Changes to this Notice

TripLah may update this Notice to reflect changes in:

• the Service;
• providers;
• AI processing;
• data practices;
• law;
• security requirements; or
• business structure.

The updated Notice will state its effective date.

TripLah will provide prominent notice, email notice or renewed consent where a material change requires it.

TripLah may archive previous versions of this Notice and make them available where reasonably practicable.

29. Business restructuring, assignment and change of controller

TripLah is currently operated as a Malaysian sole proprietorship and may later transition to a partnership, limited liability partnership, company or other registered business structure.

TripLah may also undergo:

• restructuring;
• incorporation;
• financing;
• merger;
• acquisition;
• sale of assets;
• transfer of the business; or
• succession by another lawful entity.

As part of such a transaction, personal data may be disclosed or transferred to advisers, potential transaction parties and the resulting business successor where reasonably necessary and permitted by law.

TripLah will take reasonable steps to ensure that:

• access during negotiations is appropriately restricted;
• confidentiality obligations apply;
• only necessary information is disclosed;
• the successor assumes relevant data-protection obligations;
• processing remains consistent with this Notice unless lawfully changed;
• vendor and processor agreements are updated; and
• security protections continue during the transition.

TripLah will notify users where:

• the identity of the data controller changes;
• applicable law requires notice;
• the transfer materially changes how personal data is used;
• new purposes are introduced; or
• renewed consent is required.

A successor may continue processing personal data for the purposes described in this Notice.

A successor may not rely solely on the business transfer to use personal data for a materially unrelated purpose. Where a new purpose requires notice, consent or another legal basis, the successor must satisfy those requirements before beginning the new processing.

You may request account deletion before or after a transfer, subject to applicable legal, security and record-retention obligations.

30. Languages

This Privacy Notice will be made available in Bahasa Malaysia and English.

Additional translations may be provided for users in other countries.

31. Contact and complaints

For questions, requests or complaints about privacy, contact:

TripLah

Legal operator: TRIPLAH SERVICES
SSM registration number: 202603189247 (MA0349799-D)
Registered in: Malaysia
Privacy email: privacy@triplah.com.my
Support email: support@triplah.com.my
Website: https://www.triplah.com.my

Please include enough information for TripLah to identify your account and understand the request. Do not send passwords or complete identity-document details by ordinary email.