This policy explains how personal data is processed on the uppu.net website and the UPPU platform operated by Alone AI Teknoloji Ltd. Şti. ("UPPU", "we"). Our formal notice under the Turkish Personal Data Protection Law (KVKK) is the KVKK Privacy Notice; cookies are covered in the Cookie Policy and deletion steps in the Data Deletion Instructions.
1. In short
- The uppu.net website uses no cookies and loads no analytics or tracking code, advertising tags or third-party content.
- We have two roles on the platform. For account, contract, billing and security data we are the data controller. For the conversations between businesses and their customers we are a data processor acting for the business; the business concerned is the data controller.
- Platform data is stored in our own data center in Istanbul. WhatsApp, Messenger and Instagram messages also pass through Meta's systems.
- We do not sell personal data, and we do not use it for advertising, profiling or training AI models.
- You can ask for your data to be deleted at any time: Data Deletion Instructions · kvkk@uppu.net
2. Scope and definitions
This policy covers:
- Website: uppu.net and www.uppu.net.
- Panel: the management and inbox application at app.uppu.net.
- Chat widget: the web chat that businesses add to their own websites, loaded from cdn.uppu.net.
- Customer API and webhooks: API v1 at messaging.uppu.net and the webhook v1 events sent to businesses' systems.
- Meta connections: the WhatsApp Business accounts, Facebook Pages and Instagram professional accounts that businesses connect to UPPU.
In this text, "business" means the company or organization using UPPU; "user" means a person who signs in to the panel on behalf of a business (owner, admin, agent, auditor); "person" means someone who writes to a business on WhatsApp, Messenger, Instagram or web chat, or to whom the business sends messages.
3. Our roles
3.1. Where we are the data controller
We decide the purposes and means of processing for:
- technical logs of website visitors;
- access logs of our platform servers (requests to the panel, API, chat widget and webhook domains);
- correspondence with people who email us, and KVKK applications;
- account and security data of panel users;
- contract and billing details of businesses;
- connection details of users who connect Meta accounts to UPPU.
The purposes, legal grounds and retention periods of these activities are set out one by one in the KVKK Privacy Notice.
3.2. Where we are a data processor
When a business uses UPPU, we process the messages, media, identifiers and consent records of the people it talks to, on the business's behalf and on its instructions. The business is the data controller of this data: it decides why the data is processed, how people are informed and how long the data is kept. This relationship is governed by the Terms of Service and its Data Processing Annex.
If you wrote to a business and have a request about your data, contact that business first. If you write to us, we forward your request to the business without delay and help it fulfill it (details).
4. What data we process
4.1. Website
uppu.net is a static site: it uses no cookies or tracking code and contains no forms. The servers of the hosting provider that delivers the pages keep technical logs for each request, such as the IP address, date and time, requested address, browser details and referring page. Some links on the site carry a campaign code (ref) in the address; we use these codes to measure, in aggregate, which pages and campaigns bring visits and sign-ups, and we don't track anyone individually. If you email or call us, your name, contact details and the content of your request are processed.
4.2. Panel account
- Identity and contact: name and email address.
- Sign-in data: an irreversible hash of the password; the optional two-factor secret and recovery codes; the public key, name and device type of passkeys; a "remember me" token.
- Team data: company memberships and roles, availability, the limit of conversations that can be claimed at once, invitations and join requests.
- Security and audit logs: who did what and when, with the IP address and browser details of the action. Sign-up, sign-in, sign-out, lockouts, password resets and changes, email changes (old and new address), two-factor and passkey actions and account deletion are recorded. Passwords, verification codes, tokens and secrets are never logged.
- Session: the session cookie and technical session data (Cookie Policy).
4.3. Company, contract and billing
Company name, billing name, tax number, the accepted contract version and time of acceptance, records of the company's channels and settings, and the daily usage counts used as the basis for billing.
4.4. API and webhooks
Only the SHA-256 digest of API keys, their scopes and the IP address they were last used from; an API request log (method, route pattern, related record IDs, response code and IP address; request bodies and query strings are not logged); the webhook addresses and signing secrets defined by the business (encrypted) and delivery records.
4.5. Meta account connection
When a user connects a WhatsApp Business account, Facebook Page or Instagram account to UPPU, we store: the connecting user's UPPU identity; a SHA-256 hash of the Facebook user ID (pseudonymized; used to match Meta's deletion requests); the list of permissions granted by Meta; the identifiers of the business assets (WhatsApp Business account, phone number, Page and Instagram account IDs), display name, phone number quality and messaging limit details; message templates and their approval status; and the Page or WhatsApp Business account access token issued by Meta (encrypted). We do not store the Facebook user access token created in the browser during the connection. A diagnostic log of the connection steps (step, error codes and Meta IDs, without codes or tokens) is kept.
We receive this information through Meta's Embedded Signup and Facebook Login for Business flows, with your approval. So that you can choose the account to connect, we read the list of Facebook Pages and Instagram accounts you manage; we do not store the ones you do not choose. You can withdraw the permissions you granted in the Business integrations section on Facebook (steps). Retention periods are in section 9.
4.6. Data we process on behalf of businesses
When you write to a business through a channel connected to UPPU, we process the following on the business's behalf:
- Identifiers: on WhatsApp, the business-scoped user ID (BSUID) and your phone number; on Messenger, the page-scoped ID (PSID); on Instagram, the Instagram-scoped ID (IGSID); on web chat, a randomly generated visitor ID.
- Name: your WhatsApp profile name; on Messenger and Instagram, your name and username where Meta allows it; a display name entered for you by an agent; on web chat, the name you choose to enter.
- Messages: what you write and what is sent to you; button and list replies, reactions, reply context, locations you share (latitude, longitude, place name and address), contact cards you share (which may contain other people's names and phone numbers) and Instagram story replies.
- Media: images, video, audio, documents and stickers you send or receive; file name, type and size.
- Technical data: message IDs; sent, delivered and read times; error codes; a raw, unprocessed copy of the incoming message (for troubleshooting and reprocessing, for at most 90 days).
- Conversation data: status, assigned agent, tags, block status and the version of the privacy notice shown in web chat.
- Consent records: consents and withdrawals recorded by the business for sending you marketing or utility messages; the consent text, source and time.
In web chat we do not write the visitor's IP address or browser details to the database. The IP address and browser details of visitors to pages where the chat widget is loaded are, however, written to the access logs of UPPU's servers, even if the widget is never opened; we keep these logs as data controller for our own security (3.1 and 9). The IP address also appears in short-lived rate-limit records used to prevent abuse. The chat widget stores a visitor key and messages not yet sent in the visitor's browser (Cookie Policy).
5. Data received from Meta platforms
UPPU is software that lets businesses use the WhatsApp Business Platform (Cloud API), the Messenger Platform and Instagram messaging. We process the data received through these channels (what Meta calls "Platform Data") only as follows:
- What we receive: messages and media sent to the business, message statuses (sent, delivered, read, failed), profile names, identifiers and settings of business assets, message templates and quality details (see 4.5 and 4.6).
- Why: only to run the messaging of the business concerned: showing messages in the inbox, delivering the business's replies, tracking delivery, applying Meta's 24-hour and template rules, and passing data to the business's own systems on its instructions.
- What we do not do: we do not sell or rent this data; we do not use it for advertising or marketing targeting; we do not build profiles of people or enrich this data with other data; we do not use it to develop or train AI models; we do not share it with anyone other than the business concerned and the recipients listed in this policy.
- Where we keep it: in our own data center in Istanbul, with access tokens encrypted.
- How long: for the periods in the Retention section. The access token is deleted when the channel is disconnected in the panel (unless another connected channel uses the same Meta account). When UPPU's partner access is removed from a WhatsApp Business account, Meta notifies us, the tokens are deleted and the channel is closed. Removing UPPU from a Facebook Page or Instagram on Meta's side invalidates the token; the stored token is deleted when the channel is disconnected in the panel or when the company's data is purged.
- How to have it deleted: Data Deletion Instructions.
Messages on Meta channels pass through Meta's systems and are subject to Meta's own terms and privacy policy. Web chat data is never sent to Meta.
6. Purposes and legal grounds
For processing where we are the controller, the main purposes and the legal grounds under Article 5 of Law No. 6698 (KVKK) are:
| Data | Purpose | Legal ground (KVKK Art. 5/2) |
|---|---|---|
| Panel account and team data | Opening the account, authentication, providing the service, team management, service emails (verification, password reset, invitations, alerts) | (c) conclusion and performance of a contract (the user who creates the company and accepts the agreement); (f) legitimate interest (invited users: providing the service to our customer's team) |
| Security and audit logs | Information security, preventing abuse, evidence in possible disputes | (ç) legal obligation (the data security measures of KVKK Art. 12); (f) legitimate interest; (e) establishment, exercise or protection of a right |
| Contract and billing data | Performing the contract, invoicing, tax and accounting obligations | (c) contract; (ç) legal obligation (tax and commercial law) |
| Legal names and representatives' contact details of customer businesses | Keeping the customer list required by Meta's terms for technology providers and giving it to Meta if Meta asks | (f) legitimate interest |
| Meta connection data | Setting up and maintaining channel connections; handling Meta's deletion and access removal notices | (f) legitimate interest; (c) contract where the connecting person is a party to the agreement |
| Platform server logs | Operating the platform securely, preventing abuse, troubleshooting | (f) legitimate interest |
| Website server logs | Operating the site securely; measuring in aggregate, by the campaign codes in our addresses, the visits that pages and campaigns bring (no individual tracking). The hosting provider also keeps these logs under its own statutory obligation as a hosting provider | (f) legitimate interest |
| Email and phone correspondence | Answering requests, preparing quotes | (c) directly related to concluding a contract; (f) legitimate interest |
| KVKK applications and deletion requests | Concluding the application, forwarding the request to the business concerned | (ç) legal obligation (KVKK Art. 13); (e) evidence of the application |
We do not use your data for marketing without your consent. Mandatory service notices, such as security notices, contract changes or service interruptions, are not marketing messages.
For data we process on behalf of businesses, the business as data controller determines the purpose and legal ground. Obtaining the consents required for marketing messages and the obligations relating to Türkiye's Message Management System (İYS) are the business's responsibility.
7. Who we share data with
- Meta Platforms: when a business connects a WhatsApp, Messenger or Instagram channel, the messages and media it sends, recipient identifiers, read receipts and template definitions are sent to Meta, and incoming messages are received from Meta. On Messenger and Instagram, the person's ID is sent to Meta when the person's name is requested. In addition, under Meta's terms for technology providers, we may give Meta the names and contact details of the businesses that are our customers if Meta asks. Meta processes this data under its own terms.
- Facebook JavaScript SDK: loaded only on the WhatsApp, Messenger and Instagram connection pages of the panel, for the user who opens these pages. While the SDK loads, Meta receives the user's IP address and browser details; when the Facebook Login window opens, Meta uses its own cookies.
- Email service provider (mail.uppu.net): to send verification, password reset, invitation and alert emails and to receive emails sent to us.
- Website hosting provider: to deliver the uppu.net pages.
- The business's own systems: data sent to the webhook addresses defined by the business and data retrieved with the business's API keys; the business decides the recipient.
- The business concerned: if a KVKK application or deletion request about a business reaches us, it is forwarded to that business so that it can be fulfilled.
- Competent authorities: where required by law and on a duly made request.
We use no third-party analytics, advertising, tracking, error-tracking or CAPTCHA services. Platform data is kept on our own servers, not with a cloud provider.
8. Transfers abroad
Platform data is stored in Türkiye, in our data center in Istanbul. On WhatsApp, Messenger and Instagram, messages pass through the systems of Meta companies abroad, such as Meta Platforms Ireland Ltd. and Meta Platforms, Inc., because that is how these channels work.
- Data we process on our own behalf: for Meta connection data, the customer details Meta asks for, the information the Facebook SDK passes to Meta on the connection pages, and the data processed by our email and website hosting providers, transfers abroad are made on the basis of the appropriate safeguards provided in Article 9 of KVKK (standard contractual clauses).
- Businesses' messages on Meta channels: for these messages, the legal basis of the transfer and informing the people concerned are the responsibility of the business as data controller (Data Processing Annex E.8).
9. Retention
Expired data is deleted automatically every night. Each deletion is documented by a destruction record containing only the number of records deleted.
| Data | Period |
|---|---|
| Conversations and messages | 365 days from the conversation's last activity; the older messages of a conversation that stays active are kept with it. The business can change the period to anything between 30 and 730 days. |
| Contact records with no conversations left | Together with their identifiers, once the person's last activity is older than the retention period |
| Raw copies of messages | 90 days (or the business's retention period, if shorter) |
| Meta notifications not routed to any company (raw) | 7 days |
| Incoming media files | 90 days after receipt |
| Media uploaded by the business for sending | 90 days after its last use; the file's record 30 days after the file is deleted |
| API request log | 30 days |
| Webhook records | Delivery records 30 days; event contents 7 days after delivery completes (at most 30 days); the event skeleton (ID, type and time) 35 days |
Events that can be pulled from the API (GET /v1/events) | 7 days |
| Meta error records | 30 days |
| Meta connection record (hash of the Facebook user ID, permissions granted, connecting user, asset identifiers) | While the company account remains open; deleted 365 days after the company is closed. The PIN is deleted when the channel is disconnected; the access token when the disconnection completes, unless another connected channel uses the same Meta account. |
| Meta connection diagnostics | 90 days |
| Records of incoming messages that could not be processed | 90 days after the problem is resolved |
| Access and application logs of the platform servers (including IP addresses) | 14 days |
| Accounts whose email was never verified | 72 hours |
| Panel account | Until the account is deleted |
| Data of a closed company | Deleted 365 days after closure. The company record (name), billing name, tax number, accepted contract version, setup steps and audit logs are not deleted in this purge; they are kept indefinitely today. The legal records will be destroyed after 10 years (Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102), the audit logs after 10 years. |
| Security and audit logs | At least 3 years; not deleted automatically today (upper limit: 10 years) |
| Invoices and accounting records | 10 years (Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102) |
| Website server logs (at the hosting provider) | 30 days |
| Email and phone correspondence | 2 years |
| KVKK applications and deletion requests | 3 years after the application is closed |
Deleted data remains in database backups for at most 7 days and in the database change logs for at most 14 days, after which it disappears automatically.
10. Security
Our main technical and organizational measures:
- TLS-encrypted connections on all our domains;
- AES-256-GCM encryption of Meta access tokens, WhatsApp PINs, webhook addresses and secrets, using a rotatable key ring separate from the application's general encryption key (APP_KEY); each encrypted value is bound to its company and record;
- storing only digests of API keys; keys that can be limited by scope, channel, IP range and expiry;
- signed webhooks and checks that prevent target addresses from pointing into internal networks;
- two-factor authentication and passkeys; mandatory two-factor authentication for platform administrators; limits on login attempts;
- isolation of each company's data, access based on roles and explicit permissions, and masked phone numbers for agents;
- logging of data changes and security events in an audit log;
- only the necessary ports open on our servers, administrative access by key and from restricted addresses, and automatic security updates;
- nightly database backups and regular restore tests.
No system is perfect. If a breach affects data for which we are the controller, we notify the Personal Data Protection Board and the people concerned under Article 12(5) of the KVKK. For data we process on behalf of businesses, we notify the business concerned without undue delay and help it make its own notification to the Board and to the people concerned (Data Processing Annex E.10).
11. Your rights
Under Article 11 of the KVKK you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether data is used for that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction of incomplete or inaccurate data; to request erasure or destruction; to request that correction and erasure be notified to the third parties the data was transferred to; to object to a result against you that arises solely from automated analysis; and to claim compensation for damage caused by unlawful processing.
How to apply, with an application template, is explained in the KVKK Privacy Notice. Applications are answered free of charge within 30 days at the latest.
Panel users can delete their account themselves in their profile settings. Businesses can export and erase people's data in the panel.
12. Deleting your data
The Data Deletion Instructions explain step by step how to make a deletion request depending on who you are. In short: if you wrote to a business, ask the business or us; if you are a business user, use the panel or ask us. In every case you can write to kvkk@uppu.net.
13. Children
UPPU is a service for businesses. You must be at least 18 years old to open a panel account; our website is not directed at children.
14. Changes
We update this policy when our services or the law change. The date at the top of the page changes with each update. We notify company owners of significant changes by email before they take effect.
15. Contact
Alone AI Teknoloji Ltd. Şti.
Cumhuriyet Mah. Kartal Cad. No:65/1, Kartal / İstanbul, Türkiye
Personal data: kvkk@uppu.net
General: info@uppu.net