KVKK Privacy Notice

This notice has been prepared by Alone AI Teknoloji Ltd. Şti. ("UPPU") as data controller under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

1. Data controller

Legal name: Alone AI Teknoloji Ltd. Şti.
Registered address: Cumhuriyet Mah. Kartal Cad. No:65/1, Kartal / İstanbul, Türkiye
Email: kvkk@uppu.net

2. Who this notice covers

This notice describes the processing for which UPPU itself is the data controller: visitors to our website; people who email us and people who send us a KVKK application or data deletion request; users of the UPPU panel; representatives of the businesses that are our customers; users who connect a Meta account to UPPU; and everyone who connects to our platform servers (including visitors to pages on businesses' websites where the chat widget is loaded).

If you wrote to a business on WhatsApp, Messenger, Instagram or web chat, the business concerned is the data controller of that conversation, and UPPU acts as a data processor on its behalf. The business's own privacy notice applies, and you should contact the business first. We forward any requests we receive to the business concerned without delay (section 7).

3. Data processed, purposes and legal grounds

3.1. Website visitors

Data categories: Transaction security: IP address, date and time, requested page (including the campaign code in the address), browser details, referring address.
Purposes: Delivering and securing the site; measuring, in aggregate and by the campaign codes (ref) in our addresses, which pages and campaigns bring visits and sign-ups. No one is tracked individually.
Legal ground: KVKK Art. 5/2-f (legitimate interest: operating the site securely and measuring our promotion in aggregate). The hosting provider also keeps these logs under its own statutory obligation as a hosting provider.
Collection method: Automatically, through the hosting provider's server logs. Our site uses no cookies, tracking code or similar technologies.
Recipients: Hosting provider; competent public authorities on request.
Retention: 30 days

3.2. People who email or call us (including prospective customers)

Data categories: Identity (name), contact (email address and phone, if given), request (message content), and your company and title, if given.
Purposes: Answering your question, preparing and sending quotes, providing support, carrying out communication.
Legal ground: KVKK Art. 5/2-c (directly related to concluding or performing a contract) and Art. 5/2-f (legitimate interest).
Collection method: By email or phone, partly automated.
Recipients: Email service provider (mail.uppu.net); if your request concerns a business, that business.
Retention: 2 years

3.3. Panel users (owner, admin, agent, auditor)

Data categories

Identity (name); contact (email address); customer transaction (company membership, role, invitations, availability); transaction security (password hash, two-factor and passkey data, session data, IP address, browser details, audit logs).

Purposes and legal grounds

Creating the account, authentication and providing the service; team management (invitations, roles, availability); sending service emails (verification, password reset, invitations, alerts): for the user who creates the company and accepts the agreement, Art. 5/2-c (conclusion and performance of a contract); for users who join the team by invitation or through the company's email domain, Art. 5/2-f (legitimate interest: providing the service to the team of the business that is our customer).
Information security and preventing abuse (session data, limits on login attempts, security logs): Art. 5/2-ç (legal obligation: the data security measures of KVKK Art. 12) and Art. 5/2-f (legitimate interest).
Evidence in possible disputes (audit logs): Art. 5/2-e (establishment, exercise or protection of a right).

Collection method

Through panel forms and automatically while the service is used.

Recipients

Email service provider (for service emails); authorized people of the company the user belongs to (team data); competent public authorities on request.

Retention

Until the account is deleted. Accounts whose email was never verified are deleted after 72 hours. Security and audit logs are kept for at least 3 years and are not deleted automatically today; after the account is deleted, your email address and the IP address and browser details of each action remain in these logs next to the actions you performed. Deleted data remains for at most 7 days in database backups and at most 14 days in the database change logs.

3.4. Representatives and billing details of customer businesses

Data categories

Identity and contact details of company representatives; billing name and tax number (personal data for sole proprietors); the accepted contract version and time of acceptance; usage counts.

Purposes and legal grounds

Concluding and performing the contract, invoicing: Art. 5/2-c (conclusion and performance of a contract).
Meeting tax and accounting obligations: Art. 5/2-ç (legal obligation: Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102).
Keeping the customer list required by Meta's terms for technology providers and giving it to Meta if Meta asks: Art. 5/2-f (legitimate interest: being able to keep offering the Meta channels).

Collection method

Through the panel, email and contracting, by automated and non-automated means.

Recipients

Competent public authorities; Meta companies abroad if Meta asks (legal name and representatives' contact details; section 4).

Retention

For the term of the contract and afterwards 10 years (Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102). These records are not deleted when a closed company is purged; there is no automatic destruction job today, and they will be destroyed when the period has passed.

3.5. Users who connect a Meta account to UPPU

Data categories: A SHA-256 hash of the Facebook user ID (pseudonymized; used to match Meta's deletion requests); permissions granted by Meta; the identity of the connecting user; identifiers of business assets and encrypted access tokens; connection diagnostics.
Purposes: Setting up and maintaining WhatsApp, Messenger and Instagram channels; handling deletion and access removal notices from Meta.
Legal ground: KVKK Art. 5/2-f (legitimate interest: setting up and maintaining the channel connection requested by the business that is our customer); where the connecting person is a party to the agreement, also Art. 5/2-c (performance of a contract).
Collection method: Automatically, through Meta's connection flows (Embedded Signup, Facebook Login for Business).
Recipients: Meta Platforms (abroad; section 4). When the panel's connection pages are opened, the Facebook JavaScript SDK is loaded from Meta's servers, and Meta receives your IP address and browser details.
Retention: When the channel is disconnected, the PIN is deleted; the access token is deleted when the disconnection completes, unless another connected channel uses the same Meta account. When UPPU's partner access is removed from a WhatsApp Business account, the tokens are deleted on Meta's notification. Removing UPPU from a Facebook Page or Instagram on Meta's side invalidates the token; the stored token is deleted when the channel is disconnected in the panel or when the company's data is purged. The connection record (hash of the Facebook user ID, permissions granted, connecting user and asset identifiers) is kept while the company account remains open, so that the company can reconnect and Meta's deletion requests can be matched. It is deleted 365 days after the company is closed. Diagnostics are kept for 90 days.

3.6. People who make a KVKK application or data deletion request

Data categories: Identity (name; T.C. identity number, or nationality and passport number); contact (email, phone, address for notifications); signature on written applications; the content of the request and the business and conversation it concerns.
Purposes: Concluding the application; if the request concerns a business's conversations, forwarding it to that business; evidence of the application process.
Legal ground: KVKK Art. 5/2-ç (legal obligation: KVKK Art. 13 and the Communiqué on the Procedures and Principles of Application to the Data Controller) and, for evidence of the application, Art. 5/2-e.
Collection method: Through written applications, KEP or email, by non-automated means.
Recipients: If the request concerns a business, that business; email service provider (mail.uppu.net); competent public authorities on request.
Retention: 3 years after the application is closed

3.7. Platform server logs

Who: Everyone who connects to the panel (app.uppu.net), the customer API (messaging.uppu.net), the chat widget (cdn.uppu.net) and the webhook domains; visitors to pages on businesses' websites where the chat widget is loaded, even if the widget is never opened.
Data categories: Transaction security: IP address, browser details, time of the request and requested address.
Purposes: Operating the platform securely, preventing abuse (including short-lived rate-limit records) and troubleshooting.
Legal ground: KVKK Art. 5/2-f (legitimate interest).
Collection method: Automatically, through the access logs of UPPU's servers.
Recipients: Competent public authorities on request.
Retention: 14 days; rate-limit records are short-lived and expire by themselves.

Your personal data is not processed for marketing without your explicit consent. We do not intend to process special categories of personal data (KVKK Art. 6) and ask you not to send us such data.

4. Transfers of personal data, including abroad

Your personal data is transferred only to the recipients listed for each group above, only for the stated purposes and in accordance with Articles 8 and 9 of the KVKK. We store platform data in our own data center in Istanbul. Data is transferred abroad in these cases:

When a Meta account is connected, the connection data is passed to Meta companies abroad.
When the panel's connection pages are opened, the Facebook JavaScript SDK is loaded from Meta's servers, and Meta receives your IP address and browser details.
If Meta asks, the legal names and representatives' contact details of customer businesses may be transferred to Meta companies abroad.

Transfers abroad are made on the basis of the appropriate safeguards provided in Article 9 of KVKK (standard contractual clauses).

5. Your rights (KVKK Art. 11)

With regard to your personal data you have the right to:

a) learn whether your personal data is processed,
b) request information about it if it is,
c) learn the purpose of processing and whether it is used for that purpose,
ç) know the third parties in Türkiye or abroad to whom it is transferred,
d) request its correction if it is incomplete or inaccurate,
e) request its erasure or destruction under the conditions of Article 7 of the KVKK,
f) request that actions taken under (d) and (e) be notified to the third parties the data was transferred to,
g) object to a result against you that arises solely from the analysis of the data by automated systems,
ğ) claim compensation if you suffer damage because of unlawful processing.

6. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your request in Turkish through one of the following channels:

In writing: a petition with your wet signature, delivered by hand to Cumhuriyet Mah. Kartal Cad. No:65/1, Kartal / İstanbul, Türkiye, through a notary, or by registered mail with return receipt.
With a secure electronic signature or mobile signature: by sending your signed application to kvkk@uppu.net.
From your email address registered with us: by writing to kvkk@uppu.net from an email address you have previously given UPPU and that is registered in our systems (for example, the email address of your panel account).

What the application must contain

your name and surname and, for written applications, your signature;
for citizens of the Republic of Türkiye, your T.C. identity number; for foreigners, your nationality, passport number or identity number, if any;
your residential or business address for notifications;
your email address, phone and fax number for notifications, if any;
the subject of your request and any supporting information and documents.

Application template

To make applying easier you can copy and fill in the text below (in Turkish, as applications must be in Turkish). Using the template is optional.

Konu: KVKK kapsamında başvuru
Veri sorumlusu: Alone AI Teknoloji Ltd. Şti.

Adı soyadı:
T.C. kimlik no (yabancılar için uyruk ve pasaport no):
Tebligat adresi:
E-posta ve telefon:

UPPU ile ilişkim:
( ) Panel kullanıcısıyım
( ) Müşteri işletme yetkilisiyim
( ) Web sitesini ziyaret ettim / e-postayla yazdım
( ) Bir işletmeye UPPU üzerinden yazdım (işletmenin adı: ...)
( ) Diğer: ...

Talebim:
( ) Kişisel verilerimin işlenip işlenmediğini öğrenmek
( ) İşlenen verilerim hakkında bilgi almak
( ) Verilerimin düzeltilmesi
( ) Verilerimin silinmesi veya yok edilmesi
( ) Diğer: ...

Açıklama:

Yanıtı almak istediğim yol: ( ) e-posta  ( ) KEP  ( ) posta

Tarih:
İmza (yazılı başvurularda):

How applications are handled

We answer your application as quickly as its nature allows and within 30 days at the latest, free of charge. If the action involves an additional cost, the fee set in the tariff of the Personal Data Protection Board may be charged.
We may ask for additional information to verify your identity. Do not include passwords, API keys or unnecessary personal data in your application.
We either accept your request or refuse it with reasons, and reply in writing or electronically.
If your application is refused, you find the answer insufficient or no answer is given in time, you may complain to the Personal Data Protection Board within 30 days of learning of the answer and in any case within 60 days of the application date.

7. If you wrote to a business through UPPU

Businesses conduct their conversations with customers through UPPU. The business concerned is the data controller of these conversations; the duty to inform you and to answer your applications lies with the business. Contacting the business directly is the quickest route: the business can export or erase your data in the panel. If you send your request to us, we inform the business without delay and help it fulfill the request. Details: Data Deletion Instructions.

8. Updates

We update this notice when our processing changes; the current version is always at this address. For more detail, see our Privacy Policy.