Privacy Policy

Last updated: September 29, 2026

1. Who We Are

Uptake Agency ("we", "us", "our") is a digital agency based in Turkey that builds and operates marketing automation and customer relationship management (CRM) platforms for businesses. Our primary product, ARU, is a SaaS platform that helps businesses manage customer communications through the WhatsApp Business Platform.

Data Controller: Uptake Agency
Contact Email: privacy@uptakeagency.com
Website: https://uptakeagency.com

2. What Data We Collect

We collect and process the following categories of personal data through our platform:

  • Customer contact information: Phone numbers, names, and email addresses provided by our client businesses
  • Appointment and service data: Appointment dates, service types, visit history
  • Product purchase data: Products purchased, purchase dates
  • Communication data: WhatsApp message delivery statuses (sent, delivered, read, failed), message timestamps
  • WhatsApp Business Account data: Business phone numbers, account IDs, template information, and business profile data managed through the WhatsApp Business API
  • Usage data: Platform login activity, feature usage by business users

We do not store the content of WhatsApp messages after delivery. Message templates are pre-approved by Meta and sent via the WhatsApp Cloud API. We only retain delivery status metadata.

3. How We Collect Data

  • From our client businesses: Customer data is entered or imported into our platform by the businesses we serve
  • From the WhatsApp Business API: Message delivery statuses, webhook events, and account information via Meta's Graph API
  • From platform usage: Authentication and usage logs generated when business users interact with our platform

4. Why We Process Data (Purposes)

We process personal data for the following specific purposes:

  • Appointment reminders: Sending automated WhatsApp reminders before scheduled appointments (24 hours and 2 hours prior)
  • Service follow-up: Notifying customers when it may be time for their next service visit
  • Product replenishment: Reminding customers when purchased products may need replenishing
  • Birthday and promotional campaigns: Sending personalized greetings and special offers
  • Customer re-engagement: Reaching out to customers who have not visited in a while
  • Message delivery tracking: Monitoring delivery statuses to ensure reliable communication
  • WhatsApp Business Account management: Managing phone numbers, message templates, and business profiles on behalf of our client businesses

5. Legal Basis for Processing

We process personal data based on the following legal grounds:

  • Consent: End customers of our client businesses provide consent to receive WhatsApp messages. Our client businesses are responsible for obtaining valid opt-in consent before adding customers to communication campaigns.
  • Legitimate interest: Processing data to provide CRM and communication services as contracted by our client businesses.
  • Contractual necessity: Processing data necessary to fulfill our service agreements with client businesses.

6. Data Sharing and Third Parties

We share personal data with the following categories of third parties, strictly for the purposes described above:

  • Meta Platforms / WhatsApp: Phone numbers and message content are transmitted through the WhatsApp Business Cloud API to deliver messages. Meta's privacy policy applies to data processed on their platform.
  • Google (Gemini API): We use Google's Gemini AI to generate personalized message templates. Only anonymized context (service type, timing) is sent to the AI; no personally identifiable customer information is shared with Google for message generation.
  • Google (Google Analytics): If, and only if, you give consent on this website, Google Analytics 4 receives website usage data about your visit. See Section 13 for exactly what is collected and how to withdraw consent.
  • Google (Google Fonts): This website loads its typefaces from Google's font servers, so your IP address and basic browser information reach Google on every page view. No cookie is set and no profile is built. See Section 13.4.
  • Formspree: The name, email address, message, and the optional company size and topic of interest you enter in this website's contact form, together with the page you came from before opening the form, are processed by Formspree so that they can be forwarded to us by email. Formspree is based in the United States.
  • Cloudflare: This website is hosted on Cloudflare, which also adds a cookie-free measurement script to pages for aggregate traffic statistics. See Section 13.3.
  • Client businesses: Customer data and communication reports are accessible to the business that owns the customer relationship.
  • Infrastructure providers: Our platform is hosted on self-managed infrastructure. Database backups are encrypted.

We do not sell, rent, or license personal data to any third party. We do not use personal data for advertising, profiling, or purposes unrelated to the services described above.

7. International Data Transfers

Personal data may be transferred to and processed in countries outside of Turkey as part of using Meta's WhatsApp Business API, Google's Gemini API, Google Fonts (see Section 13.4), Formspree for messages sent through the contact form, and, where you have consented to it, Google Analytics (see Section 13). These transfers are subject to appropriate safeguards as required by applicable data protection laws, including the Turkish Personal Data Protection Law (KVKK).

8. Data Retention

  • Customer data: Retained as long as the client business maintains an active subscription with our platform. Deleted within 30 days of account closure or upon request.
  • Message delivery logs: Retained for up to 12 months for reporting and troubleshooting purposes, then automatically deleted.
  • WhatsApp Business Account data: Retained as long as the business relationship with our client is active.
  • Backup data: Database backups are retained for up to 30 days and then permanently deleted.

9. Data Security

We implement appropriate technical and organizational measures to protect personal data, including:

  • HTTPS encryption for all data in transit
  • Encrypted database connections
  • JWT-based authentication with secure session management
  • Role-based access control (admin, manager, staff)
  • Regular encrypted database backups
  • Webhook signature verification for all incoming Meta API calls

10. Your Rights

Under applicable data protection laws (including KVKK and GDPR where applicable), you have the following rights:

  • Right of access: Request information about what personal data we hold about you
  • Right to rectification: Request correction of inaccurate personal data
  • Right to erasure: Request deletion of your personal data (see Section 11)
  • Right to restrict processing: Request that we limit how we use your data
  • Right to data portability: Request your data in a structured, machine-readable format
  • Right to object: Object to processing of your data, including opting out of marketing messages

To exercise any of these rights, contact us at privacy@uptakeagency.com.

11. How to Request Data Deletion

You can request deletion of your personal data in the following ways:

We will process deletion requests within 30 days and send confirmation upon completion.

12. Opt-In and Opt-Out

All WhatsApp marketing messages require explicit prior consent from the recipient. Our client businesses are required to obtain clear, affirmative opt-in consent before adding any customer to WhatsApp communication campaigns.

Recipients can opt out at any time by:

13. Cookies and Tracking

Our SaaS platform (ARU) uses essential cookies for authentication and session management only. The rest of this section describes the uptakeagency.com website you are reading right now.

13.1 Google Analytics 4, loaded only with your consent

We use Google Analytics 4 (GA4) to understand how this website is used. GA4 is loaded only after you explicitly accept it. Until you choose "Accept" in the cookie banner, no request is sent to Google Analytics, no Google Analytics code is downloaded, and no analytics cookie is created. If you choose "Reject", or if you simply ignore the banner, no Google Analytics code is loaded and nothing is sent to Google Analytics. (This is about analytics only. The site loads its fonts from Google Fonts on every page regardless of your choice; see 13.4.) If you accepted earlier and later change your answer to "Reject", the GA4 cookies are deleted and the page is reloaded without any Google Analytics code, so none of your interactions from that point on are measured by Google Analytics. The cookie-free aggregate counting by Plausible and Cloudflare runs independently of this choice (see 13.2 and 13.3).

If you accept, GA4 collects the following about your visit to this website:

  • Page views: which pages of this site you open, and when
  • Approximate location: country and region level, derived from your IP address
  • Device and browser information: device type, operating system, browser, screen size, language
  • Referring source: the website, search engine, or campaign link that brought you here
  • GA4's automatic interaction measurement: scrolling to the bottom of a page, clicks on links that lead away from this site, file downloads, and starting or submitting a form. These measurements record only that the action happened; what you type into form fields is not sent.
  • Two events we defined ourselves: a successful contact form submission (generate_lead) and a click on an email link (contact_email_click). These events record only that the action happened and on which page of the site. The name, email address, and message you type into the form are not passed to GA4; only the fact that the form was submitted successfully is recorded.

With your consent, GA4 stores the following cookies in your browser:

  • _ga: distinguishes one browser from another so that returning visits are not counted twice. Expires 2 years after it is set.
  • _ga_<measurement id>: keeps the analytics session state for this specific property. Expires 2 years after it is set.

How long GA4 keeps the data. In Google Analytics, user level and event level data is retained for at most 14 months and then deleted automatically. Aggregate reports, which contain no individual level data, are not subject to that limit.

No advertising. We do not run ads, and we do not use advertising cookies, remarketing tags, advertising pixels, Google Signals, or ad personalisation. In Google's consent settings, advertising storage, advertising user data, and ad personalisation are kept at "denied" at all times, including after you accept analytics. Accepting only turns on analytics storage.

Service provider and international transfer. The analytics service provider is Google (Google LLC and its affiliates). Data collected by GA4 may be transferred to and processed on servers outside Turkey and outside the European Economic Area, subject to the safeguards described in Section 7.

Legal basis. Your explicit consent, under the Turkish Personal Data Protection Law (KVKK) and, where applicable, Article 6(1)(a) of the GDPR. Consent is the only basis on which we load GA4, and withdrawing it costs you nothing.

Withdrawing consent. Use the "Cookie preferences" link in the footer of the site's pages. It reopens the consent banner so you can change your answer at any time. If you switch from accept to reject, the _ga and _ga_<measurement id> cookies are deleted from your browser and the page is reloaded without any Google Analytics code. From that moment on, none of your interactions are measured by Google Analytics and GA4 is not loaded again on any page you visit afterwards. To be precise about one detail: interactions you had already made while your consent was still valid may have finished being sent to Google Analytics before the reload.

13.2 Plausible Analytics, no cookies and no personal tracking

This website also uses Plausible Analytics for aggregate traffic statistics. Plausible sets no cookies and stores nothing on your device. To count unique visitors, it computes a hash from your IP address and browser information together with a key that changes every day. Your IP address itself is not stored. Because the hash changes the next day, your visits on different days cannot be linked, and you cannot be followed across websites. It produces counts, not profiles, which is why it runs without a consent prompt.

13.3 Cloudflare Web Analytics, no cookies and no personal tracking

This website is hosted on Cloudflare. To produce aggregate traffic and page performance statistics, Cloudflare adds a small measurement script to pages served from this site. This script sets no cookies, stores nothing on your device, and does not track you across websites or sessions, which is why it is not tied to the cookie banner.

13.4 Google Fonts

This website loads its typefaces (Inter and JetBrains Mono) from Google's font servers on every page. To deliver the font files, your browser connects to fonts.googleapis.com and fonts.gstatic.com, and in doing so it passes your IP address and basic browser information to Google. No cookie is set by this, and no analytics or advertising profile is built from it. Because the fonts are needed to render the page itself, this is not tied to the cookie banner and happens whatever your analytics choice is.

13.5 What we do not use

We do not use advertising pixels, remarketing or conversion tags for ad networks, cross-site tracking cookies, or any tool that builds a profile of you as an individual, on this website or on our platform.

14. Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.

15. Contact Us

If you have questions about this privacy policy or our data practices, please contact us:

Uptake Agency
Email: privacy@uptakeagency.com
Website: https://uptakeagency.com