Last updated: May 16, 2026
QueueUp is a hosted waitlist service operated by Abdullah Canakci, sole proprietor, in Turkey ("QueueUp", "we", "us"). This Privacy Policy explains what personal data we process, why, and how to exercise your rights over it. You can reach us at [email protected].
QueueUp acts in two distinct capacities under data protection law.
When you sign in to the QueueUp panel to run a waitlist for your business, we are the controller of your personal data (your account information, billing, panel activity).
When someone joins a waitlist that you run on QueueUp, you are the controller of that subscriber's personal data and we are the processor acting on your instructions. The Data Processing Addendum at Annex A of our Terms of Use sets out the contractual processor terms.
When someone signs up to a waitlist that uses QueueUp, the embed form or public subscribe API collects the following on the tenant's behalf:
We additionally inspect the following per request but do not persist them to our database:
These signals are used only to decide whether a signup is a real person, to enforce rate limits, and to block disposable email domains. They appear briefly in operational logs and are otherwise discarded.
We do not run any third-party analytics, advertising trackers, device fingerprinting, or cross-site cookies. The marketing site, the embed widget, and the hosted status page set zero tracking cookies. The panel uses session cookies set by Clerk for authentication; these are essential to the service and not used for tracking.
We use a small set of third-party services to operate QueueUp. Each is bound by its own data-protection commitments. Links go to each subprocessor's privacy policy.
We may add or replace subprocessors with at least 30 days' notice through the panel or by email, which gives tenants the opportunity to object on legitimate data-protection grounds.
Primary processing of customer data happens on Hetzner Cloud servers in Falkenstein, Germany (European Union). Some subprocessors are based in the United States. Transfers to those subprocessors rely on the European Commission's Standard Contractual Clauses, supplemented by the UK International Data Transfer Addendum where applicable, and by the EU-US Data Privacy Framework where the subprocessor self-certifies. We are happy to provide a copy of the relevant transfer mechanism on request.
We will action a deletion request from a subscriber or tenant within 30 days of receiving it.
We protect personal data with measures appropriate to its sensitivity, including encryption in transit (HTTPS), encryption at rest for integration secrets, one-way hashing of customer API keys, signed webhook payloads, and access controls on the panel. No system is perfectly secure, and we cannot guarantee absolute security.
Depending on where you live, you have some or all of the rights described below. If you are a waitlist subscriber rather than a tenant, the tenant who runs the waitlist controls your personal data; you should contact them first. We can route your request to the tenant if helpful.
European Union and United Kingdom (GDPR, UK GDPR). Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right not to be subject to a decision based solely on automated processing. QueueUp does not perform automated decision-making.
Turkey (KVKK Art. 11). The equivalent rights under Turkish data protection law: learn whether your personal data is being processed, request information about it, correct inaccurate data, request deletion, and object to results derived from automated processing.
California (CCPA / CPRA). The right to know, delete, correct, and limit our use of sensitive personal information; the right to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law.
To exercise any of these rights, email [email protected]. We may ask you to verify your identity to protect your data. We will respond within 30 days. If you believe we have not handled your data appropriately, you can lodge a complaint with your local supervisory authority (the Personal Data Protection Authority in Turkey, your national DPA in the EU or UK, or the California Attorney General).
QueueUp is not directed at children. Tenants must not use QueueUp to collect signups from individuals below the local age of digital consent (16 in the EU, 13 in the United States) without verifiable parental consent.
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. We will notify tenants of material changes through the panel or by email.
Privacy questions, data-subject requests, and complaints: [email protected]. A postal address is available on request.
