Data Deletion Instructions

UPPU is software that lets businesses manage their WhatsApp, Messenger, Instagram and web chat messages in one inbox. This page explains how to have the data UPPU holds about you deleted. Choose the section that fits you.

• I wrote to a businessOn WhatsApp, Messenger, Instagram or through a chat window on a website
• I connected my accountI am a business user who connected a WhatsApp Business account, Facebook Page or Instagram account to UPPU
• I have a UPPU accountI want to delete my user account in the panel

1. If you wrote to a business through UPPU

When you write to a business on WhatsApp, Messenger, Instagram or through the chat window on its website, your messages are stored in that business's UPPU inbox. The business concerned is the data controller of this data; UPPU acts as a data processor on its behalf. The deletion itself is carried out by authorized people at the business with the erasure tool in the UPPU panel.

Option 1: Ask the business (the quickest way)

1. Write to the business, on the channel you used or through its contact details, and say that you want your data deleted.
2. An authorized person at the business opens your conversation in the UPPU panel and uses "Ziyaretçinin verisini sil" (erase visitor data) in the "Kişisel veriler (KVKK)" (personal data) section of the contact panel. If you wish, they can first share a copy of your data with you ("Ziyaretçinin verisini indir", download visitor data).
3. The deletion takes effect immediately.

Option 2: Write to us

1. Send an email with the subject "Data Deletion Request" to kvkk@uppu.net.
2. Include:
   • the name of the business you wrote to and the channel you used: on WhatsApp, the phone number you wrote from; on Messenger, the Facebook Page you wrote to; on Instagram, the business account you wrote to; for web chat, the address of the website where you chatted;
   • the text of a message you sent to the business with its approximate date and time, or a screenshot of the conversation;
   • how we can reach you.
3. Once we have reasonably verified your identity, we forward your request to the business concerned without delay. The business carries out the deletion with the erasure tool in the panel: under its contract with us, it either fulfills the request or notifies, with reasons, a statutory retention obligation or another legal obstacle. We tell you the outcome, and any reasons, by email within 30 days at the latest of your request reaching us.

Why we ask for this: today UPPU does not receive people's names or usernames on Messenger and Instagram, and if you use the WhatsApp username feature, your phone number may not be visible to the business either. The business therefore finds your conversation by the text and time of a message. If needed, we ask you to send the business a short verification word that we give you, on the same channel. We never ask for your password or for verification codes sent to you by WhatsApp, Facebook or Instagram; do not send them.

What is deleted

All conversations and messages with you; media files you sent and received; your channel identifiers (phone number and WhatsApp, Messenger, Instagram or web chat IDs); your name; raw copies of the messages; your consent records and the related webhook events.

If the business has connected its own systems to UPPU through the API, the deletion is reported to those systems with the contact.erased event: if the business has defined a webhook address, the event is sent there; the event can also be read from the API for 7 days.

If the business has left UPPU: if the business has closed its company in UPPU, your data cannot be erased individually. All data of a closed company is permanently deleted, all at once, 365 days after closure. In that case we record your request and tell you when your data will be deleted.

What remains outside UPPU

• Your messages also exist in your WhatsApp, Messenger or Instagram app and in Meta's systems. You can delete them in your own app and with Meta's tools.
• The business may have transferred your messages to its own systems through the API or webhooks. Deleting those copies is the business's responsibility; if the business's systems are connected, the deletion is reported to them with the contact.erased event described above.

2. Businesses that connected a Facebook, Instagram or WhatsApp account

When a user connects a WhatsApp Business account, Facebook Page or Instagram professional account to UPPU, we store: the connecting user's UPPU identity; a SHA-256 hash of the Facebook user ID (pseudonymized; used to match Meta's deletion requests); the permissions granted by Meta; identifiers and settings of the business assets; message templates and encrypted access tokens. Incoming and outgoing messages are stored in the company's inbox.

Step 1: Disconnect the channel in UPPU

1. Sign in at app.uppu.net as the company owner or an admin.
2. In the channels section, open the WhatsApp, Messenger or Instagram channel and confirm "Kanalın bağlantısını kes" (disconnect channel).
3. UPPU stops receiving new messages on the channel and deletes the stored WhatsApp PIN. It removes our app's subscription from your WhatsApp Business account or Page if UPPU made that subscription and the account or Page is not used by another connected channel in UPPU. The access token is deleted when the disconnection completes, unless another connected channel uses the same Meta account.

This step does not delete the conversation history; it stays for your company's retention period and comes back if the same company reconnects the channel. The connection record also stays: the hash of the Facebook user ID, the permissions granted, the connecting user and the asset identifiers are kept while the company account remains open, so that the company can reconnect the channel and Meta's deletion requests can be matched. This record is deleted 365 days after the company is closed. To delete the history as well, go to step 3.

Step 2: Remove UPPU on Meta's side

• WhatsApp Business account: in Meta Business Suite, go to Business settings › Accounts › WhatsApp accounts, select the account and remove UPPU's access from the list of partners. Meta notifies us; UPPU then deletes the access tokens automatically and closes the channel.
• Facebook Login permissions (all three channels): WhatsApp, Messenger and Instagram connections are made with Facebook Login for Business. Whichever channel you connected, to withdraw the permissions you granted, go to Settings & privacy › Settings › Business integrations on Facebook and remove UPPU.
• Facebook Page and Instagram: this removal ends UPPU's access to your Page and Instagram account and invalidates the stored token on Meta's side. UPPU is not notified of the removal, and it does not by itself delete the data stored in UPPU: the stored token is deleted when the channel is disconnected in the panel or when the company's data is purged. To have the data deleted, also follow steps 1 and 3.

Menu names may look different depending on Meta's interface and your language settings.

Step 3: Delete the stored data

• Data of specific people: "Ziyaretçinin verisini sil" (erase visitor data) in the "Kişisel veriler (KVKK)" section of the contact panel. The company owner and admins can do this; it also works in a read-only company whose trial has ended. It does not work in a closed company.
• Shortening the retention period: the company owner can lower the period to as little as 30 days in the data retention setting; expired conversations are deleted automatically every night.
• The whole company: after disconnecting the connected channels, the company owner uses "Firmayı sil" (delete company) in the company settings. The data of a closed company is permanently deleted, all at once, 365 days after closure. During this period individual erasure is not possible, and there is no way to delete it earlier today; erase people's data before you close the company.
• Help: write to kvkk@uppu.net from the email address registered as your company's owner. We answer within 30 days at the latest.

Records that are not deleted

• The company record and legal records: the company name, billing name, tax number, accepted contract version and the company's setup steps are not deleted when a closed company is purged. They are kept indefinitely today and will be destroyed when the retention period required by tax and commercial law has passed.
• Security and audit logs: kept for at least 3 years and not deleted automatically today. These logs show who performed which action and when, with the IP address and browser details of the action; they do not contain message contents.
• Deleted data remains in backups for at most 7 days and in database change logs for at most 14 days.

What stays at Meta

Your WhatsApp Business account, phone numbers, approved templates, Facebook Page and Instagram account are held in Meta's systems and belong to you; deleting data in UPPU does not affect them. You can manage them in Meta Business Suite (business.facebook.com). Data held by Meta is subject to Meta's own terms.

3. Deleting your UPPU panel account

1. Sign in at app.uppu.net and open the Profile page under Settings.
2. Confirm the action in the "Hesabı sil" (delete account) section. If you own companies, you must close them first ("Firmayı sil"). The panel has no tool for handing ownership over to another user today; if you want to delete your account without closing the company, or to hand ownership over, write to kvkk@uppu.net.

When your account is deleted, your name, email address, password, two-factor data, passkeys and company memberships are deleted. In the security and audit logs, your email address and the IP address and browser details of each action remain next to the actions you performed for at least 3 years. Accounts whose email was never verified are deleted automatically after 72 hours.

If you cannot sign in, write to kvkk@uppu.net from your account's email address.

4. Timelines

5. Your rights

Under Article 7 and Article 11(e) and (f) of the Turkish Personal Data Protection Law No. 6698, you have the right to request the erasure of your personal data and to have the erasure notified to the third parties to whom the data was transferred. Applications are free of charge and are answered within 30 days at the latest. Other ways to apply and your other rights are in the KVKK Privacy Notice; more detail is in our Privacy Policy.

We do not use Meta's automatic data deletion callback today; we receive deletion requests through the ways described on this page.