Skip to main content

Privacy Policy

Last updated: October 20, 2026

This Privacy Policy explains which personal data is collected through the "UYAP e-Satış Bot: Otomatik İhale Teklif Robotu" Chrome extension (the "extension"), the esatisbot.com website and the servers behind them (together, the "service"), how it is processed, how long it is kept and with whom it is shared. It also serves as the information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK").

e-Satış Bot is an independent service and has no official affiliation with the Turkish Ministry of Justice or UYAP.

1. Data controller and contact

Your personal data is processed by e-Satış Bot (esatisbot.com) as the data controller. For any question about this policy or your data, write to info@esatisbot.com or use our contact page.

2. In short

  • The extension starts the robot automatically the first time you open UYAP e-Satış and shows a short note on the page explaining which data it uses and why. You can stop data sending at any time from that note or from the extension's "Veri ve izinler" (Data and permissions) page; once stopped, the robot does not start by itself again and no data is sent to our servers until you press "Robotu kullanmaya başla" (Start using the robot) again.
  • So that the robot can bid on your behalf, your UYAP e-Satış session cookies are sent to and stored on our servers.
  • We never ask for, read or store your e-Devlet password.
  • We do not sell your data. It is shared only with the recipients listed in this policy and for the stated purposes. Sharing with Google Ads for advertising happens only if you separately give optional explicit consent (see section 5).
  • You can change your advertising consent and stop data sending at any time on the extension's "Veri ve izinler" (Data and permissions) page, and ask us to delete your data.

3. Data we collect and how

Data is collected electronically through the extension, the website, UYAP e-Satış, payment providers and the forms you fill in.

3.1. Chrome extension

The extension runs only on esatis.uyap.gov.tr pages and collects the following data after the robot has started. The robot starts automatically the first time you open UYAP e-Satış; if you have stopped data sending, this data is not collected until you start the robot again:

  • Authentication information: the JSESSIONID session cookie of esatis.uyap.gov.tr and the load balancer cookies whose names start with "TS". They are sent to our servers when the connection is set up, every 30 seconds while an auction page is open, and whenever they change. Other cookies of this domain and cookies of other sites are not sent.
  • Identity and contact information: your Turkish ID number (T.C. kimlik no), full name, e-mail address and mobile phone number. Our server retrieves them from UYAP using your session cookies; where UYAP does not return them, the extension reads the name, e-mail and phone fields shown on the UYAP page.
  • Auction and activity information: the number, title, price, dates and round of the auctions you view; how long you stay on an auction page and how long it is visible; whether you open auction photos and documents; the filters and result counts of your UYAP auction searches; the auctions in your search results (up to 100 per search); your deposit status, watch list status, UYAP's automatic bid setting, the bids you place on UYAP and your "Tekliflerim" (my bids) list. This information is taken from the responses UYAP returns to the page.
  • Robot settings and bid records: the maximum bid, increment and waiting times you set; your robot requests and their status; the time, amount and result of the bids the robot places.
  • Technical information: IP address, browser information (user agent), extension version, a random installation ID generated at install time and the session ID issued by our server. If you have started the robot, the address of the "why did you uninstall?" page opened after uninstalling contains the installation ID and version.
  • Ad click identifiers: only if you have given explicit consent to advertising use: if you came to esatisbot.com from a Google ad within the last 30 days, the Google Ads click identifiers (gclid, gbraid, wbraid) our website stored in your browser are linked to your account when you connect.

To show the "you need to sign in to UYAP" warning, the extension checks whether e-Devlet (turkiye.gov.tr) cookies exist; their contents are never sent to or stored on our servers. The extension does not read your browsing or page contents on sites other than UYAP.

The extension keeps the session ID, connection status, latest robot request, installation ID and your consent record (date the robot started, whether it started automatically, disclosure version, your advertising consent and, if you stopped data sending, the date you stopped it) in your browser's local storage (chrome.storage). This data is removed from your browser when you uninstall the extension.

3.2. Payments

  • Card payments: your card details are entered directly into Stripe's secure payment field; your card number never reaches us and is not stored on our servers. We store the amount, currency, Stripe payment ID and payment result.
  • USDT (TRC-20) payments: the payment address assigned to you, the sender wallet address, the amount and the transaction hash are stored. Blockchain transactions are public.

3.3. Website

  • Visit information: random visitor and session IDs (vid and sid cookies), IP address, browser and device information, screen and window size, time zone, page load time, the pages you visit, the referring address and campaign (UTM) parameters.
  • Analytics and advertising cookies: Google Analytics and Google Ads tags loaded through Google Tag Manager. These tags use analytics and advertising cookies only if you accept them in the cookie banner (Google Consent Mode).
  • Forms: the name, e-mail, phone, subject and message you enter in the contact form; your e-mail address for the newsletter; the optional uninstall reason and comment you submit after removing the extension.

4. Purposes and legal bases

  • Providing the service: monitoring auctions and bidding with your UYAP session without exceeding the maximum amount you set; recognising your account; managing robot requests, approvals and payments. Legal basis: formation and performance of a contract (KVKK art. 5/2-c).
  • Notifications and support: sending notifications such as robot approval, rejection, start, stop and auction results by e-mail and WhatsApp; answering support requests. Legal basis: performance of a contract (art. 5/2-c).
  • Security: detecting abuse, fraud and automated traffic; IP reputation and approximate location analysis; system logs and backups. Legal basis: legitimate interest (art. 5/2-f).
  • Improving the service: statistics on how the extension and the website are used. Legal basis: legitimate interest (art. 5/2-f); for analytics cookies on the website, your consent in the cookie banner.
  • Ad measurement and targeting: measuring how many sign-ups and payments our ads bring; showing our ads to you and to people similar to you (Google Ads Customer Match). Legal basis: your explicit consent (art. 5/1). This consent is optional and not a condition of using the robot; it is given with a separate checkbox in the extension's window and can be withdrawn at any time on the "Veri ve izinler" page.
  • Legal obligations: accounting and tax records, requests from competent authorities. Legal basis: explicitly provided by law and compliance with a legal obligation (art. 5/2-a and 5/2-ç).

Your Turkish ID number is used to recognise your UYAP account and to match each person to a single account; it is never shared with anyone for advertising or analytics.

5. Sharing and international transfers

We do not sell or rent your data. We share it only with the following recipients, limited to the stated purpose:

  • UYAP e-Satış (Ministry of Justice): the bids placed by the robot and the requests made to retrieve information from UYAP are sent to UYAP with your session cookies.
  • Google Ads (Google), only with your optional explicit consent: for ad matching (Customer Match), your full name, e-mail address and phone number are transferred to Google Ads; Google hashes this information before matching and uses it only for matching. To measure ad conversions, your sign-up and payment events are sent to Google Ads together with the ad click identifier (gclid, gbraid, wbraid), your SHA-256 hashed e-mail and phone, IP address, browser information and user number.
  • Google Analytics (Google): usage events from the extension (e.g. auction views, robot actions, payment method), a random user ID, your IP address (for approximate location) and browser information; analytics cookies on the website if you have accepted them. Your name, Turkish ID number, amounts and error messages are not sent to Google Analytics.
  • Stripe: processing card payments.
  • TRON network and TronGrid: verifying USDT payments on the blockchain.
  • WhatsApp (Meta): sending welcome, robot approval or rejection, robot start or stop and auction result notifications to your phone number.
  • E-mail delivery service: sending e-mail notifications.
  • IP security and location services (ipdata.co, Scamalytics, Abstract API, ip-api.com): IP address only, for abuse detection and approximate location.
  • Hosting and backup providers: the infrastructure that runs our servers and stores our encrypted backups.
  • Competent public authorities: when required by law.

Some providers, such as Google, Stripe and Meta, process data on servers outside Turkey. International transfers are made in accordance with Article 9 of the KVKK. Transfers to Google Ads for advertising happen only with your optional explicit consent.

6. Retention

  • Account, contact, robot and bid records: kept while you use the service; deleted when you ask us to delete your account, except records we are legally required to keep.
  • UYAP session cookies: invalidated by UYAP when your UYAP session ends and can no longer be used to bid. Deleted entirely when your account is deleted.
  • Payment and accounting records: kept for the periods required by tax and commercial law (5 years under the Tax Procedure Law No. 213, 10 years under the Turkish Commercial Code No. 6102).
  • Usage and visit records: kept to improve and secure the service; records linked to your account are deleted when your account is deleted. Data in Google Analytics is deleted according to Google's retention settings.
  • Backups: automatic backups are encrypted and a limited number are kept; older backups are deleted as new ones are taken. Deleted data leaves the backups once the backup cycle completes.

7. Security

  • All communication between the extension, the website and our servers is encrypted with HTTPS.
  • Access to servers and the database is limited to authorised people; the admin panel is password protected.
  • Automatic backups are stored encrypted.
  • Card details never reach our servers; they are processed by Stripe.
  • Turkish ID numbers are masked in system logs.

8. Your rights

Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Turkey or abroad to whom it is transferred; to request correction of incomplete or inaccurate data; to request deletion or destruction under the conditions of Article 7 of the KVKK; to request that corrections and deletions be notified to the third parties to whom the data was transferred; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.

Send your requests to info@esatisbot.com. Requests are handled free of charge within 30 days at the latest.

  • Withdrawing advertising consent: you can withdraw your consent to advertising use at any time from the "Veri ve izinler" (Data and permissions) link in the extension window; your data is then no longer sent to Google Ads in later transfers. You can also turn off personalised ads in your Google account's ad settings.
  • Stopping data sending: the "Veri gönderimini durdur" (Stop sending data) button on the same page, or in the note shown when the robot starts, closes the extension's connection to our server and stops it sending data; the robot then no longer starts by itself. To have the data on our servers deleted, you need to make a separate request.
  • Cookies: you can reject analytics and advertising cookies in the website's cookie banner and delete cookies in your browser settings.
  • Uninstalling the extension: uninstalling removes the extension's data from your browser.

9. Children

The service is intended for people aged 18 or over who can take part in UYAP e-Satış auctions. We do not knowingly collect data from anyone under 18.

10. Changes

We may update this policy. The current version is always on this page and the "Last updated" date changes. If the data the extension collects or how it is used changes materially, the extension shows the new disclosure on UYAP e-Satış.

Get Started