Privacy Policy

Last updated: March 14, 2026

1. Who We Are

Uptake Agency ("we", "us", "our") is a digital agency based in Turkey that builds and operates marketing automation and customer relationship management (CRM) platforms for businesses. Our primary product, ARU, is a SaaS platform that helps businesses manage customer communications through the WhatsApp Business Platform.

Data Controller: Uptake Agency
Contact Email: [email protected]
Website: https://uptakeagency.com

2. What Data We Collect

We collect and process the following categories of personal data through our platform:

  • Customer contact information: Phone numbers, names, and email addresses provided by our client businesses
  • Appointment and service data: Appointment dates, service types, visit history
  • Product purchase data: Products purchased, purchase dates
  • Communication data: WhatsApp message delivery statuses (sent, delivered, read, failed), message timestamps
  • WhatsApp Business Account data: Business phone numbers, account IDs, template information, and business profile data managed through the WhatsApp Business API
  • Usage data: Platform login activity, feature usage by business users

We do not store the content of WhatsApp messages after delivery. Message templates are pre-approved by Meta and sent via the WhatsApp Cloud API. We only retain delivery status metadata.

3. How We Collect Data

  • From our client businesses: Customer data is entered or imported into our platform by the businesses we serve
  • From the WhatsApp Business API: Message delivery statuses, webhook events, and account information via Meta's Graph API
  • From platform usage: Authentication and usage logs generated when business users interact with our platform

4. Why We Process Data (Purposes)

We process personal data for the following specific purposes:

  • Appointment reminders: Sending automated WhatsApp reminders before scheduled appointments (24 hours and 2 hours prior)
  • Service follow-up: Notifying customers when it may be time for their next service visit
  • Product replenishment: Reminding customers when purchased products may need replenishing
  • Birthday and promotional campaigns: Sending personalized greetings and special offers
  • Customer re-engagement: Reaching out to customers who have not visited in a while
  • Message delivery tracking: Monitoring delivery statuses to ensure reliable communication
  • WhatsApp Business Account management: Managing phone numbers, message templates, and business profiles on behalf of our client businesses

5. Legal Basis for Processing

We process personal data based on the following legal grounds:

  • Consent: End customers of our client businesses provide consent to receive WhatsApp messages. Our client businesses are responsible for obtaining valid opt-in consent before adding customers to communication campaigns.
  • Legitimate interest: Processing data to provide CRM and communication services as contracted by our client businesses.
  • Contractual necessity: Processing data necessary to fulfill our service agreements with client businesses.

6. Data Sharing and Third Parties

We share personal data with the following categories of third parties, strictly for the purposes described above:

  • Meta Platforms / WhatsApp: Phone numbers and message content are transmitted through the WhatsApp Business Cloud API to deliver messages. Meta's privacy policy applies to data processed on their platform.
  • Google (Gemini API): We use Google's Gemini AI to generate personalized message templates. Only anonymized context (service type, timing) is sent to the AI; no personally identifiable customer information is shared with Google for message generation.
  • Client businesses: Customer data and communication reports are accessible to the business that owns the customer relationship.
  • Infrastructure providers: Our platform is hosted on self-managed infrastructure. Database backups are encrypted.

We do not sell, rent, or license personal data to any third party. We do not use personal data for advertising, profiling, or purposes unrelated to the services described above.

7. International Data Transfers

Personal data may be transferred to and processed in countries outside of Turkey as part of using Meta's WhatsApp Business API and Google's Gemini API. These transfers are subject to appropriate safeguards as required by applicable data protection laws, including the Turkish Personal Data Protection Law (KVKK).

8. Data Retention

  • Customer data: Retained as long as the client business maintains an active subscription with our platform. Deleted within 30 days of account closure or upon request.
  • Message delivery logs: Retained for up to 12 months for reporting and troubleshooting purposes, then automatically deleted.
  • WhatsApp Business Account data: Retained as long as the business relationship with our client is active.
  • Backup data: Database backups are retained for up to 30 days and then permanently deleted.

9. Data Security

We implement appropriate technical and organizational measures to protect personal data, including:

  • HTTPS encryption for all data in transit
  • Encrypted database connections
  • JWT-based authentication with secure session management
  • Role-based access control (admin, manager, staff)
  • Regular encrypted database backups
  • Webhook signature verification for all incoming Meta API calls

10. Your Rights

Under applicable data protection laws (including KVKK and GDPR where applicable), you have the following rights:

  • Right of access: Request information about what personal data we hold about you
  • Right to rectification: Request correction of inaccurate personal data
  • Right to erasure: Request deletion of your personal data (see Section 11)
  • Right to restrict processing: Request that we limit how we use your data
  • Right to data portability: Request your data in a structured, machine-readable format
  • Right to object: Object to processing of your data, including opting out of marketing messages

To exercise any of these rights, contact us at [email protected].

11. How to Request Data Deletion

You can request deletion of your personal data in the following ways:

  • Reply STOP: Reply "STOP" to any WhatsApp message to opt out of future communications
  • Email: Send a request to [email protected] with the subject "Data Deletion Request"
  • Data Deletion Page: Visit uptakeagency.com/data-deletion for detailed instructions

We will process deletion requests within 30 days and send confirmation upon completion.

12. Opt-In and Opt-Out

All WhatsApp marketing messages require explicit prior consent from the recipient. Our client businesses are required to obtain clear, affirmative opt-in consent before adding any customer to WhatsApp communication campaigns.

Recipients can opt out at any time by:

  • Replying "STOP" to any WhatsApp message
  • Contacting the business directly
  • Emailing us at [email protected]

13. Cookies and Tracking

Our web platform uses essential cookies for authentication and session management only. We do not use third-party tracking cookies, advertising pixels, or analytics tools that track individual users.

14. Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.

15. Contact Us

If you have questions about this privacy policy or our data practices, please contact us:

Uptake Agency
Email: [email protected]
Website: https://uptakeagency.com