Laqao

Laqao Privacy Policy

Effective date: October 26, 2026

Who we are

Laqao is operated by Lopaso Holdings, LLC, a limited liability company formed in Delaware, United States ("we", "us"). Our address is c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Lopaso Holdings, LLC decides how and why the personal data described in this policy is used (in Philippine law, the "personal information controller"; in GDPR terms, the "controller").

Data Protection Officer: privacy@laqao.online. Contact our Data Protection Officer about anything in this policy.

General support: support@laqao.online

What Laqao does

Laqao is an audio travel guide. You tap a place on the map, tap Speak, and hear a short narration about it, written by AI. Laqao works on our website, laqao.online, and in the Laqao apps for iPhone and Android. Unless a section says otherwise, this policy covers the website and the apps.

You can look around the map without an account. To hear stories, you need a free account.

Data we collect and how we use it

Your account

  • You can create an account with an email address and password, or sign in with Google. On iPhone you can also use Sign in with Apple. Sign-in is handled by Google Firebase Authentication. We never see your password.
  • If you sign in with Google, Google shares your name, email address and profile picture link with Firebase Authentication. Laqao saves your name and email address in your profile. Firebase Authentication also keeps your Google profile picture link in your sign-in record.
  • If you sign in with Apple, Apple shares your email address with Firebase Authentication. If you choose to hide your email, Apple shares a private relay address instead. Laqao saves the email address it receives in your profile.
  • Your profile also stores your app settings: theme, app language, narration language, voice speed, the travel alerts switch, whether you finished the welcome screens, and when your profile was created and last updated.
  • We use this data to run your account and keep your settings the same on each device.

Location

Laqao asks for your device's location. It is optional. You can tap any spot on the map without it.

We use your location only:

  • to center the map on you and show "You are here";
  • when you tap Center on me, or use your location to pick a place to hear (then those coordinates are sent to our server as the place to narrate; see "Narrations" below);
  • to keep the map moving with you while a story plays, if you turn on Follow me. Follow me stops when the story stops or the Speak sheet closes.

Laqao does not collect your location in the background.

The only locations we store are the points described below: the places you heard, your saved places and, if you recorded trips before, the paths and photo locations from those trips.

Places you hear and save

  • Places you've heard: when you hear a place, we store a record in your account. It holds the place's identifier, its coordinates, the narration language, the narration text and the time. This record lets you replay a place from History or Saved without using a pin. It also means your account holds a list of places you've heard.
  • Weekly pins: for Free accounts we store which week it is and how many pins you've used that week.
  • Natural-voice narrations: for Free accounts we store which narrations (place and language) used your 3 free Google Cloud voice narrations, so the count is shared between laqao.online and the Laqao app. It stays until you delete your account.
  • Saved places: when you save a place, we store its coordinates, its title or place name, and the time you saved it.
  • If you are not signed in, your settings and saved places are kept only in your browser on that device.

Earlier trips

Laqao doesn't record your path, and new trips can't be started. Trips you recorded earlier stay in your account until you delete them. Each one holds when it started and ended, its path (map points with a time, recorded while the trip ran and Laqao was open), the places you heard during it and any photos you added. To delete them, tap Clear all history on the Profile screen, or delete your account.

Photos

  • You choose which photos to add, from your camera or your photo library. Laqao gets only the photo you pick.
  • Before a photo leaves your device, Laqao re-saves it as a smaller JPEG image. This removes hidden details stored in the photo file, such as GPS location and camera information.
  • Photos are stored privately in your account in Google Firebase Storage. Only your signed-in account can view them in Laqao. As with any hosted service, our authorised administrators and Google, as our host, can technically access stored files. We access them only to run or support the service or where the law requires.
  • A photo you add to a place under Places you heard (or, for older photos, to a place in a trip) is linked to that place in your History. We don't look up your location for it.
  • Photos you added to a trip earlier may include the location where you took them, so they could be shown on the trip map. They stay until you delete them.
  • If your Premium plan ends, your photos stay. We do not delete photos automatically.
  • Photos stay in your account until you tap Clear all history or delete your account.

Narrations (AI): OpenAI

Laqao's narrations are written by AI from OpenAI, using OpenAI's API. OpenAI is a third-party AI provider. Here is exactly what happens when you tap Speak:

  1. Place lookup. Our server looks up the name and address of the point you chose using OpenStreetMap's Nominatim service. We send Nominatim only the coordinates and the language.
  2. Stored narration first. If we already have a narration for that place and language, we use it and nothing is sent to OpenAI.
  3. What we send to OpenAI. If there is no stored narration, our server (not your device) sends OpenAI one request containing only:
    • the place name: from OpenStreetMap or, if you tapped a Popular place, the name shown for it, which comes from Google Places;
    • the place address: from OpenStreetMap, when one exists;
    • the coordinates of the point you chose, to 5 decimal places;
    • the narration language (for example "Portuguese", not your device's region);
    • our fixed instructions for the guide (the same for everyone);
  4. What we never send to OpenAI: your name, email address, account ID, IP address, device information, History, photos, saved places, or anything you type. The request comes from our server, so OpenAI does not receive your IP address.
  5. What comes back. OpenAI returns the narration text. We save it in a shared store that is not linked to your account, so the next person who hears the same place gets the same text. The shared copy keeps the map coordinates of the place it describes, from OpenStreetMap, but not who asked or where you were. Your own "Places you've heard" record is described above.

Coordinates can be personal data. If you used your location (for example Center on me) to pick the place, the coordinates sent to OpenAI are your own position at that moment.

OpenAI processes these requests for us as our service provider. OpenAI may keep API requests and responses for up to 30 days to detect and prevent abuse, and may keep them longer only where the law requires it or where needed to protect its services or others from harm. It then deletes them. OpenAI may process this data in the United States and other countries.

Narration voice

  • Free: your first 3 narrations (once per account, shared between laqao.online and the Laqao app) are read by a Google Cloud Text-to-Speech voice, the same way as Premium below. After that, the narration is read aloud by your device's built-in voice. Some browsers and devices use an online voice service for this; if yours does, that happens under your browser's or device maker's terms.
  • Premium: the narration is read by a Google Cloud Text-to-Speech voice. Our server sends Google Cloud the narration text, the language, the voice and the speed. We do not send your account details. Audio clips are saved in a shared store that is not linked to your account.

Map images

On the website, your browser loads the map images directly from OpenStreetMap's tile servers. Like any website, those servers receive your IP address and the map area you are viewing, under the OpenStreetMap Foundation's own policies. On Android, the Laqao app uses Google Maps. Google may collect your IP address, a device or SDK identifier and diagnostic information through its Maps SDK, under Google's Privacy Policy (policies.google.com/privacy). On iPhone, the Laqao app uses Apple Maps. Apple may receive your IP address and the map area you are viewing, under Apple's Privacy Policy (apple.com/legal/privacy).

Reporting a narration

You can tap Report on the Speak sheet, or on a replay in your History, to flag a narration as offensive, harmful, false or something else. A report stores the place's identifier, the narration language, the narration style, the reason you picked, your account ID and the time. There is no free-text box. We use reports to review and fix narrations.

Payments

  • Premium is paid through Stripe Checkout. Stripe collects your payment details and contact details under its own privacy policy. We do not see or store your full card number.
  • We send Stripe your Laqao account ID and the plan you chose. For Monthly and Yearly subscriptions, we receive and store your Stripe customer ID. For every plan, we store your plan and when your Premium access ends. We also keep a record of each payment event we process (event ID, event type, account ID and time).
  • Stripe makes the payment record, including the email, name and the last four digits of your card, available to us in our Stripe account.

Security and fair use

  • To prevent abuse and control costs, we keep usage counters. They are linked to your account ID and, for some requests, to a keyed one-way hash of your IP address (we don't store the address itself in these counters). They hold only counts and times. We are setting them to be deleted automatically; until then we delete them on request and when you delete your account.
  • Our hosting provider, Google Cloud, keeps standard server logs. They can include your IP address, your browser or device type, the time, and the web address requested, which for place lookups includes the map coordinates you tapped. We use logs only for security, debugging and abuse prevention, and keep them for about 30 days. Laqao's own app log lines don't include your account ID, email address or IP address; where an error needs to tell accounts apart, it uses a one-way hash of the account ID.

On your device

Your browser stores your sign-in session, your settings and local copies of narration text and audio. Profile → Settings → Clear narration cache removes the local narration copies from that device. It does not delete your History, Saved places or free replays.

What we don't do

  • We don't sell your personal data.
  • We don't use analytics or advertising trackers, and there are no ads on laqao.online.
  • We don't access your contacts and we don't send push notifications.

If we add a tool that changes this list, we will update this policy first.

Legal bases

Where the law requires a legal basis (for example the Philippine Data Privacy Act, sec. 12, and the GDPR, art. 6), we rely on:

  • Providing the service you asked for (contract): your account, settings, narrations (including sending the place details to OpenAI, Nominatim and, for Premium voices and the 3 free natural-voice narrations, Google Cloud), places you've heard, saved places, History (including earlier trips), photos, and Premium.
  • Your permission: access to your device's location and camera/photo library, which you control in your device settings. Withdrawing permission doesn't affect what was done before.
  • Legal obligations: payment and tax records, and responding to lawful requests.
  • Legitimate interests: keeping Laqao secure and affordable (usage limits, abuse prevention, server logs), handling reports about narrations, and replying to your messages. You can object to these (see "Your rights").

We do not make decisions about you based only on automated processing that have legal or similarly significant effects.

Who we share data with

  • Google (Firebase and Google Cloud): sign-in (Firebase Authentication, including Sign in with Google), database (Cloud Firestore), photo storage (Cloud Storage), web hosting and server logs (App Hosting / Cloud Run, Cloud Logging), and Premium voices and the 3 free natural-voice narrations (Cloud Text-to-Speech). On Android, Google also receives the data its Maps SDK collects to show the map (see "Map images").
  • Google Places: the name shown for a Popular place.
  • Apple: Sign in with Apple on iPhone (Apple shares your email address, or a private relay address, with Firebase Authentication when you use it), and map images in the iPhone app (Apple Maps).
  • OpenAI: writes the narrations. We send it only the place name, place address, coordinates, narration language and our fixed instructions (see "Narrations (AI): OpenAI").
  • OpenStreetMap Foundation: place names and addresses (Nominatim, from our server) and map images (tile servers, from your device).
  • Stripe: payments. Stripe acts as our payment processor and, for some purposes such as fraud prevention and legal compliance, as an independent controller under its own privacy policy.
  • Our email hosting provider: stores the emails you send us so we can read and answer them.
  • Your browser or device's voice service: reads Free narrations aloud after your 3 natural-voice narrations (see "Narration voice").
  • People you share a link with: the Share button creates a link that contains the place's coordinates and name. Anyone with the link can open that spot on the map. If you share a spot you picked with your own location, the link reveals that location.
  • Authorities, or a buyer: if the law requires it, or if Lopaso Holdings, LLC's business is sold or merged, in which case this policy continues to apply to your data.

Our service providers may use your data only to provide their services to us, except where this policy says a provider also acts under its own policy (such as Stripe). Where a provider offers data processing terms, we accept them.

Where your data is stored

Lopaso Holdings, LLC is based in the United States, and our Data Protection Officer is in the Philippines. Our web servers run on Google Cloud in Singapore (asia-southeast1). Your account data is stored in Google Cloud's database in Singapore (asia-southeast1), and your photos are stored in Google Cloud Storage in Singapore (asia-southeast1). OpenAI, Stripe, Google and our other providers may process data in the United States and other countries. So if you use Laqao from the Philippines, elsewhere in Southeast Asia, the EU/UK or anywhere else, your data will be transferred to other countries whose laws may differ from yours.

We remain responsible for your data when a provider processes it for us, as the Philippine Data Privacy Act (sec. 21) requires. We protect transfers with our providers' data processing agreements where the provider offers them. Where the GDPR or UK GDPR applies, these include the European Commission's Standard Contractual Clauses (and the UK addendum) or the provider's certification under the EU-U.S. Data Privacy Framework. You can ask us for more information about these safeguards.

Shared places

When you share a place, anyone with the link can see its name and the photos and videos you add. We never include your exact location or the location data in your photos and videos, and we remove that data from your files before they're stored. Shared pages are hidden from search engines. A shared place stops working after 90 days, and its files are deleted within about a day after that. You can delete a share anytime, and deleting your account deletes all your shares.

Retention and deletion

  • Your account data, profile, saved places, places you've heard, History and photos stay until you delete them or delete your account.
  • You can clear all History or remove a saved place at any time.
  • Photos stay in your account until you tap Clear all history or delete your account.
  • Usage counters: they hold only counts and times. We are setting them to be deleted automatically; until then we delete them on request and when you delete your account.
  • Server logs: kept by Google Cloud for about 30 days.
  • Payment records: the record of payment events we processed (event ID, type, account ID and time), and the invoices and receipts Stripe holds for us (such as the amount, date, and the email, name and last four card digits shown on them), kept for up to 7 years after the end of the tax year for tax, accounting and dispute purposes. When you delete your account, we delete your Stripe customer ID from our database, remove your name, email and address from your customer records in our Stripe account, and remove your saved cards. Invoices and receipts already issued keep the details shown on them. Stripe also keeps its own records under its own policy.
  • Reports about narrations: kept for 180 days from the report, or until you delete your account, if sooner.
  • Emails you send us: kept for 2 years from our last reply.
  • Deleting your account: when you ask us to delete your account, we complete the deletion within 30 days of confirming your request. When the deletion runs, it's usually finished within a few minutes. We keep only the records listed under "What we may keep" on https://laqao.online/delete-account, for the periods stated there, including payment records for up to 7 years after the end of the tax year. Deleted data, including a deleted account, can remain in our backup and recovery storage for up to 7 days after it is deleted, and is then erased automatically.
  • Narration text, audio clips and place lookups in our shared stores are not linked to you and are kept. Some include the coordinates of the spot requested.

To delete your account, see https://laqao.online/delete-account.

Your rights

Depending on where you live, including under the Philippine Data Privacy Act of 2012 and laws like the EU and UK GDPR, Singapore's PDPA, Thailand's PDPA and Malaysia's PDPA, you can:

  • be told how we use your data (this policy);
  • get access to your personal data and a copy of it;
  • get your data in a structured, commonly used, machine-readable format (for example JSON), and have it sent to another service where technically possible (data portability);
  • have inaccurate data corrected;
  • have your data deleted or blocked;
  • object to processing based on our legitimate interests, and ask us to restrict processing;
  • withdraw your permission at any time (for example location), without affecting what we did before;
  • be compensated for damage caused by a breach of your rights, where the law provides for it.

To make a request, email our Data Protection Officer at privacy@laqao.online. We may need to confirm it's you, for example by emailing you at the email address on your account. We don't charge for requests, unless the law allows a reasonable fee for requests that are clearly unfounded, excessive or repeated.

We will reply by email without undue delay and within one month of receiving your request. If a request is complex or we receive many, we may extend this by up to two more months where the law allows, and we will tell you why within the first month.

If you're not satisfied, you can complain to your data protection authority. In the Philippines, that is the National Privacy Commission (privacy.gov.ph). We'd appreciate the chance to help first.

Security

We use reasonable organisational, physical and technical measures to protect your data, including:

  • encrypted connections (HTTPS) between your device and our servers;
  • storage with Google Cloud, which encrypts data at rest by default;
  • database and storage rules that let a signed-in account read only its own History, saved places and photos;
  • verified payment notifications from Stripe;
  • rate limits and spending caps to prevent abuse;
  • server secrets kept in a managed secret store;
  • access to production data limited to the people who run Laqao and the tools they authorise.

No method of transmission or storage is completely secure, so we can't guarantee absolute security. Please use a strong, unique password.

If a personal data breach is likely to put you at real risk of serious harm, we will notify the relevant data protection authority and you as the law requires. For users in the Philippines, that is the National Privacy Commission and you, within 72 hours of our becoming aware of it. We'll tell you what happened, what data was involved, what we are doing, and what you can do.

Children

Laqao is not meant for children. You must be at least 16 to create an account or use Laqao. If you're under 18 (or the age of majority where you live), you may buy Premium only with a parent or guardian's permission. We don't knowingly collect personal data from anyone under the minimum age. If you believe someone under that age has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy. When we do, we will change the effective date at the top. If a change is significant, we will also tell you on the website. If we change our AI provider, or add new kinds of personal data to what we send to it, we will update this policy before the change applies to you.

Contact

Lopaso Holdings, LLC
c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States
Support: support@laqao.online
Data Protection Officer: privacy@laqao.online