This notice is provided by the data controller below under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

Data controller

Ehliman Taşkın (PazarApi)

Address

Çobançeşme Mah. Ferah Sok. No:4/13, 34180 Bahçelievler / İstanbul, Türkiye

Email

iletisim@pazarapi.com

This notice covers the PazarApi Mobil app and the server service it connects to. It concerns two groups of people:

• Users: store owners who use the app and the people they authorize.
• Marketplace customers: people who ask a store a question on a marketplace and whose name and question are shown in the app.

The app can only be used with an access key generated in the PazarApi desktop application. No account can be created in the app; there is no sign-up form.

3.1 Sign-in and account data

• API Key and API Secret Key: sent to the server when you sign in or use "Add store" (Mağaza ekle). They are not stored on the phone. On the server they are kept in the access key record created in the PazarApi desktop application; the app only verifies them.
• Access key record: the membership it belongs to, its scope (one store or all stores), marketplace, store number and name, store owner's name, key description, creation and last-use time, and whether it is active. The owner's name reaches the phone but is not displayed.
• Session token: a random value issued by the server after sign-in. It is stored on the phone and sent with every request.

3.2 Device and notification data

• Device ID: a random identifier (UUID) generated by the app and renewed at every new sign-in. The phone's IMEI, Android ID (ANDROID_ID) or advertising ID are not read.
• Device name: the phone's manufacturer and model (for example "Google Pixel 8").
• Notification address (Firebase Cloud Messaging token) and Firebase installation ID.
• Timestamps: first sign-in and last-seen time (last seen is updated with every request), and the time a store was added to the phone.

3.3 Content you write and actions you take

• Reply text (10 to 2000 characters): the reply you approve, edit or write yourself.
• Product note ("Ürün hakkında bilgi", up to 1000 characters): saved to the product and used when preparing suggested replies for later questions about that product.
• Request for this reply (up to 500 characters): applies to that suggestion only and is deleted from the server once PazarApi picks it up.
• Actions: approving, marking as not to be answered, undoing an approval, requesting a new suggestion; approval and sending time; approval source (you or auto-approve); number of suggestion requests per question (at most 5); sending attempts and the error message returned by the marketplace.
• Auto-approve settings: for which marketplace or store it is on or off, when it was turned on, the device record that last changed it, and the time of change.

3.4 Marketplace customer and product data

This data is not collected by the app. PazarApi obtains it from the store's marketplace account; it is stored on the server and shown only on phones connected to that store:

• The customer's name as provided by the marketplace, the question text and date.
• Product name, code, image addresses, link, description, category and stock information. Prices are not stored.
• The suggested reply prepared by PazarApi, the reply status and the marketplace's error message.

3.5 Technical logs

• Server error logs: member number, question or record number, marketplace and store, error type and message. Question and reply texts are not written to error logs.
• Access logs: as part of normal operation, the web server may record the IP address, time and requested address of each request. The IP address is not used to determine location.

3.6 Data kept on your phone

• Session token, device ID, list of connected stores (marketplace, number, name) and the times they were added, kept in the app's private storage that other apps cannot access.
• Replies being written: kept temporarily in Android's saved screen state so they are not lost on screen changes (last 20 entries).
• A cache for product images, and Firebase's own files (installation ID, notification address).
• App data is not included in Google cloud backup and is not transferred to a new phone.

• The app does not use your location, contacts, photos, videos or files, camera, microphone, SMS or calls, and does not read the advertising ID.
• It contains no advertising, crash reporting or usage analytics tools.
• What you type in the search box is used only on the phone to filter the list; it is not sent to the server.
• When you tap "Paste from clipboard" (Panodan Yapıştır), the clipboard is read only at that moment. The full text is not sent; only the API Key and API Secret Key are extracted from it.

• Information you enter (keys, replies, notes, requests, settings): electronically, through the app's screens.
• Device and notification data, action times: automatically and electronically, by the app and the server.
• Access key record: when the key is generated in the PazarApi desktop application.
• Marketplace customer and product data: electronically, by PazarApi from the store's marketplace account.

We do not use your data for advertising, marketing, profiling or sale.

About suggested replies: PazarApi prepares suggested replies using the question text, product information and, if any, your product note and request. Suggestions are generated with AI and may be wrong or incomplete. Check them before sending. For questions that come to this app, no suggestion is sent to a customer without your approval while auto-approve is off. Only you can turn auto-approve on; while it is on, replies PazarApi considers suitable are sent without you reading them first. Check auto-sent replies as well.

7.1 Google (Firebase Cloud Messaging and Firebase Installations)

Used as a service provider to deliver notifications to your phone.

• The Firebase library sends Google the Firebase installation ID, the app version and technical information including the operating system version, device and library details.
• Our server sends notifications through Google. Notification content may include the store name and the first 120 characters of the question, or question counts and a "reply could not be sent" message.
• Google may process this data on servers outside Türkiye. Details: Firebase privacy and security, Google Privacy Policy.

The app contains no Google Analytics, Crashlytics or advertising library.

7.2 Marketplaces

The reply text you approve, or that is approved by auto-approve you turned on, is sent by PazarApi on behalf of the store to the marketplace the store is connected to (for example Trendyol, Hepsiburada, N11, Pazarama, İdefix, ÇiçekSepeti), where it is published to the customer and publicly. This transfer relies on KVKK Art. 8 with the basis in Art. 5(2)(c), and happens through your "Approve" (Onayla) action or the auto-approve setting you turned on. Replies that reach a marketplace are subject to that marketplace's own rules and privacy policy. The app does not connect to marketplaces directly.

7.3 Hosting and infrastructure providers

Server-side data (section 3) and the infrastructure of the PazarApi service run on servers of the hosting and infrastructure providers we use. These providers host the data on our behalf in order to provide the service. Our main server is located in Germany. Some processing, such as preparing reply suggestions, may take place on servers of other infrastructure providers outside Türkiye.

7.4 Competent public authorities

When required by a legal obligation, and only to the extent provided by the applicable legislation.

7.5 Transfers abroad

Transfers to Google and to infrastructure providers located outside Türkiye are transfers abroad. They are made under Article 9 of the KVKK on the basis of appropriate safeguards such as the standard contracts announced by the Personal Data Protection Board, or the exceptional cases listed in the same article.

7.6 Addresses your phone connects to directly

• Product images are loaded by your phone directly from the addresses provided by the server (marketplace or product image servers). These servers can see your phone's IP address. Images are loaded over HTTPS only.
• "Open product page" opens, only when you tap it, only over HTTPS and only known marketplace addresses in your phone's browser.

• Data on the phone: kept until you sign out or uninstall the app. When you tap "Sign out" (Çıkış yap), the session token, device ID, store list and the times stores were added are deleted, the notification address is invalidated and notifications on screen are removed. Uninstalling the app deletes all app data on the phone.
• Data on the server (sections 3.1 to 3.5): kept while your access key is active and you use the service. After the access key is revoked in the PazarApi desktop application or the service relationship ends, it is deleted or anonymized within 6 months at the latest. If there is a dispute or a legal obligation, the relevant data may be kept for as long as that lasts.
• When you sign out, your device record on the server is set to inactive, the notification address is deleted and the session token is invalidated; the record is deleted within the period above. If you uninstall without signing out, the notification address is deleted from the server at the first failed notification attempt.
• Request for this reply: deleted once PazarApi picks it up.
• Auto-approve setting record: deleted when you remove the setting with "Return to … setting" (… ayarına dön) or "Turn off all" (Hepsini kapat).
• Data held by Google Firebase is subject to Google's own retention rules.
• Replies published on a marketplace are subject to that marketplace's rules; our deletion does not remove the published reply from the marketplace.

• All connections between the app and the server are encrypted with HTTPS; unencrypted connections are disabled in the app.
• The API Secret Key is not stored on the phone; a random token is used for the session.
• Each phone can only see questions of the stores connected to it; this check is done on the server.
• Notifications that arrive while signed out are not shown.
• App data is not included in cloud backup and is not transferred between devices.
• Direct access to configuration and key files on the server is blocked.

No system is completely secure. If we learn that data has been obtained by others unlawfully, we will notify the persons concerned and the Personal Data Protection Board as soon as possible, as required by Article 12 of the KVKK.

By applying to the data controller, you may:

1. learn whether your personal data is processed,
2. request information if it has been processed,
3. learn the purpose of processing and whether it is used in line with that purpose,
4. know the third parties in Türkiye or abroad to whom it is transferred,
5. request correction if it is incomplete or inaccurate,
6. request deletion or destruction under the conditions of Article 7 of the KVKK,
7. request that correction, deletion or destruction be notified to the third parties to whom the data was transferred,
8. object to a result against you arising exclusively from analysis by automated systems,
9. claim compensation if you suffer damage due to unlawful processing.

• How to apply: by email to iletisim@pazarapi.com (subject: "PazarApi Mobil – KVKK request" or "PazarApi Mobil – data deletion request"), in writing to Çobançeşme Mah. Ferah Sok. No:4/13, 34180 Bahçelievler / İstanbul, Türkiye, or by the other methods listed in the Communiqué on the Procedures and Principles of Application to the Data Controller (registered electronic mail, secure electronic signature, mobile signature).
• What to include: your name and surname, your signature for written applications, your Turkish ID number (for foreigners, nationality and passport or ID number), your address for notifications, your email and phone if any, and the subject of your request. To help us find your records, include the store name and marketplace. We may ask for additional information to verify your identity.
• Never share your API Secret Key in any request.
• Response time: your request is concluded free of charge as soon as possible and within 30 days at the latest. If the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.
• Complaint: if your request is rejected, you find the answer insufficient or no answer is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application.
• What happens on a deletion request: device records, questions, replies, notes and settings belonging to your stores are deleted or anonymized, except those that must be kept by law, and you are informed of the result. For replies published on a marketplace, you need to contact that marketplace.
• What you can do yourself: sign out to delete the session data on the phone, uninstall the app to delete all data on the phone, or revoke the access key in the PazarApi desktop application. When the key is revoked, the phone's session ends and auto-approve within that key's scope is turned off.
• Marketplace customers whose name and question appear in the app may apply in the same way.

PazarApi Mobil is designed for people who run marketplace stores and their staff; it is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child's data is being processed, please contact us and we will take the necessary steps.

We may update this notice to reflect changes in the service or the law. The current version is always published at this address with an updated effective date. We will try to announce important changes separately in the app or on the Google Play page.

This notice is provided in Turkish and English; if the two differ, the Turkish text prevails.

Data controller

Ehliman Taşkın (PazarApi)

Address

Çobançeşme Mah. Ferah Sok. No:4/13, 34180 Bahçelievler / İstanbul, Türkiye

Email

iletisim@pazarapi.com

Effective date

29.09.2026