Terms of Service and Data Processing Annex

These terms govern the service relationship between Alone AI Teknoloji Ltd. Şti. and a business using the UPPU platform. Annex 1, the Data Processing Annex (called the "data processor annex" on the company creation screen), at the end of this page is an integral part of the agreement and is accepted together with it when a company is created.

1. Parties and acceptance

1.1. These Terms of Service (the "Agreement") are made between Alone AI Teknoloji Ltd. Şti. ("UPPU") and the legal entity, trader or tradesperson that creates a company on the UPPU platform (the "Customer").

1.2. The Agreement is concluded when the box "Hizmet sözleşmesini ve veri işleyen ekini kabul ediyorum" ("I accept the service agreement and its data processing annex.") is ticked on the company creation screen. The annex named in the box is Annex 1, the Data Processing Annex, on this page. The person accepting declares that they are authorized to represent and bind the Customer. The accepted version and the time of acceptance are recorded on the company.

1.3. UPPU is intended only for businesses acting for commercial or professional purposes; the service is not offered to consumers. The Customer confirms that it uses the service for its commercial or professional activity.

1.4. If the parties have signed a separate quote, order form or contract, that document prevails where it conflicts with this Agreement.

2. Definitions

Platform: UPPU's panel at app.uppu.net, the chat widget, the customer API (API v1), webhooks (webhook v1) and the infrastructure that runs them.
Channel: A web chat, WhatsApp Business Platform number, Facebook Page (Messenger) or Instagram professional account connected to the Platform.
Person: A natural person who writes to the Customer through a channel or to whom the Customer sends messages.
User: A person invited to the Platform by the Customer who uses the Platform on the Customer's behalf (owner, admin, agent, auditor).
Customer Data: Messages, media, person identifiers, consent records and related information that reach the Platform through the Customer's channels or are sent from it.
Meta: The Meta Platforms companies that provide the WhatsApp, Messenger and Instagram services.

3. The service

3.1. UPPU is a software service that gathers messages from the Customer's channels in a team inbox, lets Users answer them and allows the Customer's own systems to connect to the Platform through an API and webhooks. The current scope of the service is described on the Services and Developers pages of the website.

3.2. The Customer sets up the web chat channel itself. WhatsApp, Messenger and Instagram channels and API access are enabled for the Customer by UPPU on request. UPPU may decide not to enable such access because of a risk of abuse, Meta's rules or technical reasons.

3.3. UPPU may change features to improve the service. Changes that materially restrict a feature the Customer uses are announced reasonably in advance. New fields, events and endpoints may be added to API v1; the Customer's systems must ignore fields they do not recognize. Changes that break existing behavior are made in a new API version or announced in advance.

3.4. The service is provided without any committed uptime percentage. The parties may agree a separate service level in writing.

4. Accounts, users and security

4.1. Opening an account requires a verified email address and an age of at least 18.

4.2. The Customer is responsible for inviting Users, setting their roles and for the actions of its Users on the Platform. The Customer ensures that its Users comply with this Agreement.

4.3. Passwords, two-factor authentication tools, API keys and webhook secrets must be kept confidential. If the Customer becomes aware of unauthorized use, it revokes the key concerned and informs UPPU without delay. UPPU recommends that Users turn on two-factor authentication.

5. Trial use

5.1. UPPU may offer new companies a free, time-limited trial. The trial period and quotas are shown in the panel and on the Pricing page.

5.2. When the trial ends, the company becomes read-only until paid use begins: messages can be read and people's data exported, but new messages cannot be sent. Data is not deleted because the trial ended; the retention periods continue to run as usual.

5.3. Trial use is provided as is; no fees arise during the trial.

6. Fees, invoicing and payment

6.1. The scope, fee and period of paid use are set out in the quote given to the Customer. Unless stated otherwise, fees exclude VAT and other statutory taxes.

6.2. UPPU collects fees by invoice. Unless agreed otherwise, invoices are payable within 7 days of their date.

6.3. A Customer whose payment is late receives a written notice. If payment is not made within 15 days of the notice, the company may be made read-only. The retention and termination provisions of this Agreement apply to the deletion of data.

6.4. Meta's WhatsApp Business Platform fees are not included in UPPU's fees. Meta charges them according to its current price list to the payment method the Customer has set on its WhatsApp Business account. Adding a valid payment method to the WhatsApp Business account is the Customer's responsibility.

6.5. If UPPU wishes to change its fees, it announces the change at least 30 days before it takes effect. If the Customer does not accept the change, it may terminate the Agreement before the effective date in the manner set out in clause 17.

7. Meta channels and third-party terms

7.1. The Customer connects its WhatsApp Business account, phone numbers, Facebook Page and Instagram account with its own Meta account and by accepting Meta's terms. These assets belong to the Customer and are held in Meta's systems. The Customer declares that it has the necessary authority over these assets.

7.2. The Customer complies with Meta's current terms, in particular the WhatsApp Business Terms, the WhatsApp Business Messaging Policy and Commerce Policy, the Meta Platform Terms and the Messenger Platform and Instagram policies. In particular, the Customer:

obtains opt-in permission in the form Meta requires before messaging people on WhatsApp, and honors requests to opt out;
uses only templates approved by Meta outside the 24-hour customer service window;
offers people a way to reach a human if it uses automated replies or a bot;
keeps its business profile information accurate and up to date;
does not message about products and services that Meta prohibits or restricts;
does not use data obtained through the channels for any purpose other than what messaging with those people requires; does not build profiles of people, enrich this data with other data or use it to train AI models (exceptions permitted by Meta excepted);
when linking an Instagram account to a Facebook Page, informs the account owner that Page administrators can see the Instagram messages.

7.3. Meta may restrict, suspend or charge for accounts, numbers, templates or messaging under its own rules. Such decisions by Meta and interruptions of Meta's services are outside UPPU's control.

7.4. If Meta asks for a Customer's access to be cut off, or if the Customer's use violates Meta's terms, UPPU may disconnect the channel concerned. If the Customer removes UPPU's partner access from its WhatsApp Business account (Meta's PARTNER_REMOVED notification), UPPU deletes the access tokens concerned and closes the channel. Removing UPPU from a Facebook Page or Instagram on Meta's side invalidates the token at Meta; the encrypted token stored in UPPU is deleted when the channel is disconnected in the panel or when the company's data is purged.

7.5. Notices and requests that Meta sends to UPPU about the Customer are passed on to the Customer. Under Meta's terms for technology providers, UPPU keeps an up-to-date list of customers containing the Customer's legal name and contact details and may give this information to Meta if Meta asks.

8. Customer obligations and acceptable use

8.1. The Customer uses the Platform in accordance with applicable law, this Agreement and Meta's terms. In particular, it is prohibited to:

send unsolicited bulk messages or marketing messages without permission;
send content that is unlawful, deceptive, threatening, hateful, infringes the rights of others or contains malware or phishing;
impersonate another person;
test or try to bypass the security of the Platform, circumvent rate limits or reverse engineer the Platform (except where the law allows it);
resell or rent the Platform to third parties without UPPU's written permission.

8.2. Commercial electronic messages. The Customer is responsible for obtaining the consents required under Law No. 6563 and its regulation for the commercial electronic messages it sends to people, for meeting its registration and checking obligations in the Message Management System (İYS), and for honoring refusals. The Platform's consent records do not replace these obligations; UPPU has no İYS integration.

8.3. Personal data. The Customer is the data controller of the data relating to people. Informing people, relying on an appropriate legal ground, obtaining explicit consent where necessary and answering people's applications are the Customer's responsibility. The web chat channel cannot be activated without the address of the Customer's own privacy notice. The Customer processes special categories of personal data only where there is a basis under Article 6 of the KVKK, only to the extent necessary and after assessing in advance the adequate measures determined by the Board under Article 6(4) (Annex 1, clause E.2).

8.4. The Customer is responsible for the security of its API and webhook integrations, for the data transferred to its own systems by webhook and for the processing of that data in its own systems.

9. UPPU's obligations, support and maintenance

9.1. UPPU provides the service with due care and applies the technical and organizational measures listed in Annex 1.

9.2. Support is provided at info@uppu.net on weekdays from 09:00 to 18:00 (Türkiye time).

9.3. Planned maintenance is announced in advance where possible. Urgent security work may be carried out without prior notice.

10. Personal data

10.1. For Customer Data, the Customer is the data controller and UPPU is the data processor. UPPU processes this data only on the Customer's behalf and in accordance with Annex 1, the Data Processing Annex.

10.2. UPPU is the data controller for Users' account data, contract and billing details and security logs. This processing is described in the Privacy Policy and the KVKK Privacy Notice.

10.3. The Customer can set the retention period for conversations in the panel to anything between 30 and 730 days; if it does not, the Platform's default (365 days) applies. The period runs from the conversation's last activity.

11. Intellectual property

11.1. The rights in the Platform, software, interface, documentation and the UPPU brand belong to UPPU or its licensors. The Customer is granted a non-transferable, non-exclusive right of use for the term of the Agreement and for its own business purposes only.

11.2. Customer Data belongs to the Customer. The Customer authorizes UPPU to process this data only to provide the service.

11.3. UPPU may use the Customer's suggestions and feedback about the service to improve it, without incurring any obligation towards the Customer.

12. Confidentiality

The parties use information learned under the Agreement that is marked confidential or is confidential by nature (including prices, technical details and Customer Data) only to perform the Agreement and do not disclose it to third parties. Legal obligations are reserved. This obligation continues after the Agreement ends.

13. Suspension

UPPU may suspend the service in whole or in part in the event of a serious breach of the Agreement or of Meta's terms, unlawful use, situations that threaten the security of the Platform or other customers, a request from competent authorities, or late payment (clause 6.3). Where possible, suspension is announced in advance with reasons; the service is restored once the cause is removed.

14. Liability

14.1. UPPU is not liable for damage arising from interruptions and decisions of Meta or other third-party services, problems in the internet infrastructure, the Customer's own systems, or actions taken in accordance with the Customer's instructions.

14.2. Except where liability cannot be limited by law and except for intent and gross negligence, UPPU's total liability under this Agreement is limited to the fees paid by the Customer to UPPU in the 12 months before the event causing the damage. UPPU is not liable for indirect damage or loss of profit.

14.3. The Customer indemnifies UPPU against damage arising from claims and sanctions brought against UPPU because of the Customer's use in breach of this Agreement, Meta's terms or the law.

15. Term and termination

15.1. The Agreement takes effect when the company is created and continues for an indefinite period. For paid use, the period stated in the quote applies.

15.2. The Customer can end the Agreement at any time by closing the company in the panel ("Firmayı sil", delete company); this closure serves as notice of termination (clause 17). Connected channels must be disconnected first. Refunds of fees paid in advance are subject to the terms of the quote.

15.3. UPPU may terminate the Agreement with 30 days' notice given in the manner set out in clause 17, or immediately in the event of a material breach by the Customer.

15.4. Before the Agreement ends, the Customer can export people's data from the panel, one person at a time, as JSON; if API access is enabled, it can retrieve messages and media through API v1. For a bulk export the Customer writes to UPPU, and UPPU provides it in JSON format within 30 days. The data of a closed company is permanently deleted, all at once, 365 days after closure; individual or earlier deletion is not possible during this period. The Customer can erase people's data in the panel before closing the company. Clause E.12 of Annex 1 applies to the company record, legal records and audit logs.

16. Changes to the Agreement

16.1. UPPU may change this Agreement. Changes are notified to company owners by email at least 30 days before they take effect and published on this page with a new version number.

16.2. If the Customer does not accept a change, it may terminate the Agreement before the effective date in the manner set out in clause 17. Changes required by law or for security reasons may take effect at shorter notice.

16.3. The version of the Agreement accepted by each company is recorded. Earlier versions are kept accessible in this page's archive.

17. Notices

UPPU's notices are sent to the company owner's email address registered in the panel. The Customer's notices to UPPU are sent to info@uppu.net. Closing the company in the panel under clause 15.2 serves as the Customer's notice of termination and is recorded in the audit log. Other notices of termination and formal notices are given through a notary, by registered letter or by KEP, as required by Article 18(3) of the Turkish Commercial Code No. 6102.

18. Evidence agreement

The parties agree that, in disputes arising from this Agreement, the electronic records kept in UPPU's systems (including audit logs, contract acceptance records and delivery records) constitute evidence under Article 193 of the Code of Civil Procedure No. 6100; the right to submit counter-evidence is reserved.

19. Governing law and jurisdiction

This Agreement is governed by the laws of the Republic of Türkiye. Where the Customer is a trader or a public legal entity, the Istanbul Anatolian Courts and Enforcement Offices have jurisdiction over disputes under Article 17 of the Code of Civil Procedure No. 6100; in all other cases the general rules of jurisdiction apply.

20. Miscellaneous

20.1. Neither party is liable for obligations affected by force majeure (such as natural disasters, epidemics, war, widespread infrastructure outages or decisions of competent authorities).

20.2. The Customer may not assign its rights and obligations under the Agreement without UPPU's written consent.

20.3. If a provision of the Agreement is invalid, the remaining provisions are not affected.

20.4. The Agreement is drawn up in Turkish. The English translation is for information; in the event of a conflict the Turkish text prevails.

Annex 1: Data Processing Annex

This annex is also published on its own page: Data Processing Annex.

This annex sets out, under Article 12 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the terms for processing in which the Customer is the data controller and UPPU the data processor. It is the document called the "data processor annex" in the box on the company creation screen. Terms not defined in this annex have the meaning given in the Agreement and in the KVKK.

E.1. Subject, duration and purpose

UPPU processes Customer Data for the term of the Agreement and until the deletion periods in clause E.12 of this annex expire, solely to provide the service to the Customer: receiving, storing and showing messages to Users; delivering the Customer's replies and templates; tracking delivery; applying Meta's messaging rules; and passing data to the integrations defined by the Customer.

E.2. Data subjects and data categories

Data subjects: people who write to the Customer through the channels or to whom the Customer sends messages; web chat visitors; third parties whose details appear in shared content (for example people in contact cards).
Data categories: channel identifiers (WhatsApp BSUID and phone number, Messenger PSID, Instagram IGSID, web visitor ID); name and display name; message contents; media files; shared locations and contact cards; delivery, read and error details; conversation, tag and assignment details; consent and withdrawal records; raw copies of messages.
Special categories: the Platform is not designed to process special categories of personal data. Message contents, media files and backups are not separately encrypted at rest, and backups are not kept off the server. If people send such data, the Customer is responsible for the existence of a legal basis. If the Customer is going to process special categories of data, it assesses in advance whether these measures are adequate under Article 6(4) of the KVKK and the Board's decision on adequate measures.
Server access logs: the IP address and browser details of visitors to pages where the chat widget is loaded are written to the access logs of UPPU's servers, even if the widget is never opened. UPPU keeps these logs as data controller for its own security (KVKK Privacy Notice); the Customer mentions this in its own privacy notice.

E.3. Processing on instructions

UPPU processes Customer Data only on the Customer's instructions. The Agreement, the Customer's settings in the panel (channels, retention period, webhook and API settings) and its written requests are the Customer's instructions. If UPPU considers an instruction to be unlawful, it informs the Customer and may decline to carry it out. If other processing is required by a legal obligation, the Customer is informed in advance unless the law prohibits this.

E.4. Deletion requests made directly by people

Meta's terms require data obtained through Meta channels to be deleted at the request of the person concerned. When a deletion request reaches UPPU directly, UPPU reasonably verifies the requester's identity and then forwards the request to the Customer within 3 business days at the latest. Within 10 business days the Customer either fulfills the request with the erasure tool in the panel or notifies UPPU, with reasons, of a statutory retention obligation or another legal obstacle. UPPU tells the person the outcome and any reasons; the parties observe these periods so that the person can be answered within 30 days at the latest. If the Customer's API access is enabled, the erasure is reported to the Customer's systems with the contact.erased event. Individual erasure is not possible in a closed company; its data is deleted all at once when the period in clause E.12 expires.

E.5. Confidentiality and personnel

UPPU binds its employees and assistants who may access Customer Data to confidentiality and limits access to those who need it for their work. Platform administrator accounts have no implicit access to company data. This obligation continues after the end of their duties and of the Agreement (KVKK Art. 12/4).

E.6. Technical and organizational measures

To ensure an appropriate level of security under Article 12 of the KVKK, UPPU applies at least the following measures:

keeping data in UPPU's data center in Istanbul, on servers managed by UPPU;
isolating each company's data with a mandatory company filter; tying permissions to roles and explicit rights; showing phone numbers masked to agents;
TLS on all connections; encrypting Meta access tokens, WhatsApp PINs, webhook addresses and secrets with AES-256-GCM using a rotatable key ring separate from the application's general encryption key (APP_KEY), with each encrypted value bound to its company and record;
storing only the SHA-256 digest of API keys; scope, channel, IP range and expiry limits;
signed webhooks and checks that prevent target addresses from pointing into internal networks;
two-factor authentication and passkeys; mandatory two-factor authentication for platform administrators; limits on login attempts; password confirmation for sensitive actions;
logging of data changes and security events in an audit log; passwords, codes and tokens are never logged;
a firewall, mandatory access control (SELinux), administrative access by key only and from restricted addresses, and automatic security updates on the servers;
nightly database backups kept for 7 days, with restores tested every month;
automatic nightly deletion of data whose retention period has expired, documented by destruction records.

UPPU may update these measures in line with technological developments; an update may not lower the level of protection.

E.7. Sub-processors

UPPU processes Customer Data in its own data center and does not use a cloud or hosting provider to host this data. Service emails (verification, invitation and alert emails) are sent through mail.uppu.net; these emails do not contain people's names or message contents. UPPU informs the Customer at least 30 days before using a new sub-processor that will access Customer Data; if the Customer objects on reasonable grounds, it may terminate the Agreement.

E.8. Meta channels and transfers abroad

UPPU stores Customer Data in Türkiye. On the WhatsApp, Messenger and Instagram channels connected by the Customer, messages pass through Meta's systems abroad because that is how these channels work. The Customer connects these channels with its own Meta account and by accepting Meta's terms directly; Meta processes this data under the terms between the Customer and Meta and is not a sub-processor of UPPU. Informing people about the use of these channels and the obligations under Article 9 of the KVKK are the Customer's responsibility; UPPU provides the necessary information on the Customer's request.

E.9. Assistance with data subject requests

The panel lets the Customer export a person's data in JSON format and erase it permanently; if the Customer's API access is enabled, the erasure is reported to the Customer's systems with the contact.erased webhook event. UPPU forwards requests it receives directly to the Customer within 3 business days at the latest and reasonably assists the Customer in answering them. Clause E.4 applies to deletion requests.

E.10. Data breach notification

When UPPU becomes aware of a data breach affecting Customer Data, it informs the Customer without undue delay and within 48 hours at the latest. The notification includes, as far as then known, the nature of the breach, the categories of data and data subjects affected, the likely consequences and the measures taken or proposed. UPPU assists the Customer in meeting its obligation to notify the Personal Data Protection Board and the people concerned.

E.11. Information and audits

UPPU answers the Customer's reasonable requests for information and documents showing compliance with this annex. With reasonable prior notice, subject to confidentiality and at its own cost, the Customer may carry out an audit, or have one carried out by an independent auditor, at most once a year. Audits are conducted so as not to endanger the confidentiality of other customers' data or the security of the Platform.

E.12. Retention, return and deletion

Conversations and messages are deleted automatically at the end of the period chosen by the Customer, counted from the conversation's last activity (30 to 730 days; 365 days if not chosen); incoming media files 90 days after receipt; raw copies of messages after 90 days (or the Customer's retention period, if shorter). The periods for other records (such as webhook events, the API log, uploaded media and records of messages that could not be processed) are in the retention table of the Privacy Policy.
Before the Agreement ends, the Customer can export people's data from the panel, one person at a time, as JSON; if API access is enabled, it can retrieve messages and media through API v1. For a bulk export the Customer writes to UPPU, and UPPU provides it in JSON format within 30 days.
The Customer Data of a closed company is permanently deleted, all at once, 365 days after closure; individual or earlier deletion is not possible during this period. The Customer can erase people's data in the panel before closing the company.
The company record (name), billing name, tax number, accepted contract version and setup steps are kept for 10 years (Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102), and audit logs for at least 3 years and at most 10 years; these records are not deleted when a closed company is purged and are destroyed when their period has passed.
Deleted data remains in backups for at most 7 days and in database change logs for at most 14 days.
Each automatic deletion is documented by a destruction record containing only counts. On request, the deletion is confirmed to the Customer in writing.

E.13. Obligations arising from Meta

For data obtained through Meta channels, UPPU also: processes the data only on the Customer's behalf and on its instructions; keeps each customer's data separate; contractually prohibits the Customer from processing this data in breach of Meta's terms (clause 7.2); cuts off access at Meta's request; deletes the access tokens when the Customer removes UPPU's partner access from its WhatsApp Business account, and for Facebook Page and Instagram channels deletes the stored token when the channel is disconnected or when the company's data is purged; and does not use the data for profiling, enrichment or training AI models.

E.14. Liability and term

The parties' liability under this annex is subject to clause 14 of the Agreement; joint responsibility for data security measures under Article 12(2) of the KVKK is reserved. This annex remains in force after the Agreement ends until the Customer Data has been deleted.