TrustPrivacy policy
luup privacy policy
- Scope
- What the luup app collects, how, why, and who processes it — including third-party AI services
- Operated by
- Neuros Technology · info@luup.com.tr
- AI processing
- DeepSeek (China); Anthropic, Vapi, OpenAI, Deepgram, Microsoft Azure (USA)
- Last updated
- 25 September 2026
Short answer
What data does luup collect and who does it share it with?
luup collects the account details you enter, your business profile and the conversations and calls that reach your business through the channels you connect. To write replies, translate, summarise and handle calls, parts of this data are sent to third-party AI services in China (DeepSeek) and the USA (Anthropic, Vapi, OpenAI, Deepgram, Microsoft Azure) — in the mobile app only after you give permission. We do not sell personal data.
01Who we are
luup is business software for handling customer conversations across the phone, WhatsApp, Instagram, Messenger and other channels. It is built and operated by Neuros Technology, a company based in Türkiye, and published at luup.com.tr. You can reach us at info@luup.com.tr.
Two roles apply. For the personal data of a business's own customers — the people who message or call that business — the business using luup is the data controller and Neuros Technology processes that data on its instructions. For the account data of the people who use the luup app and web panel, Neuros Technology is the data controller.
02What data we collect
We collect only what the product needs to run a business's customer conversations.
| Data | Examples | Purpose |
|---|---|---|
| Account and device data | Name, email, sign-in credentials, role, activity log, push notification token, in-app usage events | Signing in, access control, sending notifications, improving the product |
| Business data | Business profile, knowledge base documents, replies edited by the business, conversations with the in-app assistant | So the assistant describes the business correctly and writes in its voice |
| Customer contact data | Name, phone number, email address, channel identifiers | Keeping the same person in one record across channels |
| Conversation data | Messages, voice messages and their transcripts, images, call recordings and transcripts | Understanding requests, writing replies, keeping a record |
| Transaction data | Appointments, quotes, commitments, status | Delivering and following up the service |
03How we collect it
Data reaches luup in five ways. Channels and the phone line are connected by the business itself: if a channel is not connected, nothing arrives from it.
- Entered by the business
- Information entered at sign-up and during setup, the business profile, knowledge base documents, edited replies and conversations with the in-app assistant.
- Received over connected channels
- Messages, voice messages and images that the business's customers send on the WhatsApp, Instagram, Messenger and other channels the business connects, together with the conversation history.
- Phone calls
- For calls the assistant answers or places: the call audio and the caller's number. After the call, the recording and transcript are returned to luup and stored.
- Public sources during setup
- To draft the business profile: text from the business's website, its Google business listing and reviews, and its Instagram account. This lookup happens during setup.
- The app and device
- A push notification token so we can send notifications, and usage events showing which parts of the app are used.
04Data shared with third-party AI services
luup's AI features do not run on a model hosted on our own servers. They work by sending requests to third-party AI services. This means part of the data above is transferred outside Türkiye, to providers in the People's Republic of China and the United States. We do not claim that AI processing stays in Türkiye or the European Union.
Only the data needed for the task at hand is sent. The providers process it on our behalf, as processors, under their own service terms. We require every third party we share user data with — by contract or through its service terms — to provide protection equal to that described in this policy: to use the data only for the requested task, to protect it against unauthorised access, and not to pass it on. How long a provider retains data depends on its own terms; we do not claim that providers store nothing.
We do not sell personal data, and we do not use it for any purpose other than those listed here.
| Provider | Country | Data sent | Purpose |
|---|---|---|---|
| DeepSeek | China | Customer messages and conversation history, voice-message transcripts, call transcripts, business profile, knowledge base documents, past replies edited by a person, website / Google review / Instagram text gathered during setup, the in-app assistant's memory | Writing replies and drafts, translation, conversation analysis, summaries and briefings, setting up the business profile |
| Anthropic | USA | Images customers send on connected channels, and the caption sent with them | Describing what an image shows |
| Vapi | USA | Call audio, caller number, business profile, customer history | Running phone calls; the recording and transcript are returned to luup and stored |
| OpenAI (inside calls, via Vapi) | USA | The transcribed conversation, business profile and customer history | Language model that produces replies during the call |
| Deepgram (inside calls, via Vapi) | USA | Call audio | Speech-to-text |
| Microsoft Azure (inside calls, via Vapi) | US-based provider | The reply text to be spoken | Text-to-speech |
05Legal basis, consent and withdrawing it
The transfer of data to AI providers abroad is based on explicit consent (Turkish Personal Data Protection Law No. 6698, KVKK, art. 9). In the mobile app, before any data is sent to these services, you are shown a disclosure explaining which data goes to which provider, in which country and for what purpose, and you are asked for permission. Consent is given to that text: if a provider or a type of data changes, the disclosure is shown again and permission is asked again.
You can withdraw consent at any time in the app under Settings → "AI & data sharing" (in Turkish: "Yapay zekâ ve veri paylaşımı"). Withdrawal does not undo transfers made before it; because the AI features cannot work without these providers, they are not available without consent. To delete your account and data entirely, see luup.com.tr/en/delete-account.
For a business's own customers, the business is the data controller: it is responsible for informing its customers about this processing in its own privacy notice and for obtaining their consent where required.
06Sub-processors
The complete list of services that process data on our behalf is below. When it changes, this page is updated, and when a new AI provider is added the in-app permission is asked again.
| Sub-processor | What it does | Location |
|---|---|---|
| Supabase | Database and authentication | European Union region |
| DeepSeek | All text-based AI processing | China |
| Anthropic | Describing images | USA |
| Vapi | Phone calls | USA |
| OpenAI | Language model inside calls (via Vapi) | USA |
| Deepgram | Speech-to-text inside calls (via Vapi) | USA |
| Microsoft Azure | Text-to-speech inside calls (via Vapi) | US-based provider |
| Google Places | Looking up business information during setup | US-based provider |
| Apify | Collecting public business information during setup | Outside Türkiye |
| Firebase Cloud Messaging (Google) | Delivering mobile push notifications | US-based provider |
| OpenPanel | Usage analytics; requests are relayed through our own server | Outside Türkiye |
| iyzico | Payments | Türkiye |
| Meta | Delivering messages on WhatsApp, Instagram and Messenger | US-based provider |
07Storage, retention and security
Business data is stored in a database hosted in the European Union region. Each business's records are separated by row-level access rules, so a user of one business cannot query another business's records. Access is limited by role and logged.
The business sets how long call recordings are kept; when that period ends they are deleted automatically. When an account is deleted, the account and any business its owner solely owns are deleted with their records; invoices and payment records are kept for the period required by Turkish tax and commercial law.
08Your rights
Under KVKK you have the right to learn whether your personal data is processed, to request information about it, to have it corrected or deleted, to learn who it has been transferred to, and to object to processing. If you use the luup app or panel, send requests about your own account data to info@luup.com.tr; requests are answered within 30 days at the latest.
You can delete your account immediately in the app (More → Settings → Close account) or in the web panel (Settings → Close account). If you cannot sign in, you can request deletion at luup.com.tr/en/delete-account without logging in.
If you are a customer of a business that uses luup, that business is the data controller: send your request to the business. Requests that reach us are logged and passed on to the business concerned.
09Contact and changes
Questions about this policy: info@luup.com.tr. The Turkish version of this policy is at luup.com.tr/guven/kvkk. When the list of data or providers changes, this page is updated and the date at the top changes with it.
Questions about this policy: info@luup.com.tr
FAQ
Frequently asked questions
Yes. The database is hosted in the European Union region, but the AI features work by sending the relevant parts of the data to providers abroad: DeepSeek in China for text, Anthropic in the USA for images, and Vapi in the USA, with OpenAI, Deepgram and Microsoft Azure, for phone calls. In the mobile app this happens only after you give permission, and you can withdraw it in Settings.
No. We do not sell personal data. It is used only to provide the service described on this page — running a business's customer conversations and calls — and shared only with the providers listed here, for the purposes listed here.
Each provider processes data on our behalf under its own service terms, and how long it retains request data depends on those terms. We do not claim that providers store nothing. We require every provider to protect the data to a standard equal to this policy and to use it only for the requested task.