PCIFIC privacy notice

Last updated: 7 September 2026

This privacy notice for Pcific Marketplaces Limited, doing business as PCIFIC, explains how and why we collect, use, store, disclose, and otherwise process personal information when you use our services. References to "PCIFIC", "we", "us", and "our" mean Pcific Marketplaces Limited. Our services include activities where you:

Visit https://pcific.co.uk or another website of ours that links to this notice;
Create an account, buy, sell, list, search for, save, watch, or interact with items on the PCIFIC marketplace;
Use PCIFIC support, shipping, payment, AI, verification, analytics, map, mobile, newsletter, or subscription features;
Use the PCIFIC Safeguard browser extension or connect it to your PCIFIC account; or
Contact us or interact with us in other related ways, including sales, marketing, or events.

PCIFIC is a UK-based online marketplace focused on sustainability, repair, reuse, and the resale of electronics, parts, and related products. Pcific Marketplaces Limited is responsible for deciding how and why personal information is processed under this notice, except where we explain that another organisation acts independently.

This notice explains our practices and your rights. It is not a request for blanket consent to all processing. Where we need your consent, we will ask for it separately. If you have questions or concerns, contact [email protected].

Summary of key points

What personal information do we process? We process information you give us, information generated through your use of our services, and information from relevant third parties, such as social login, payment, shipping, support, marketplace API, and verification providers.

Do we process sensitive personal information? We do not intentionally require special category personal data for normal marketplace use. Messages, attachments, screenshots, disputes, verification materials, and AI submissions may nevertheless contain sensitive information. Please provide only what is needed and keep personal, sensitive, and confidential information out of general AI prompts and uploads.

Do we receive information from third parties? Yes. Depending on the features you use, these may include Google or Facebook for social sign-in, Stripe for payments, shipping and carrier providers, SendGrid/Twilio email infrastructure, map providers, device-verification providers, and eBay for supported Safeguard listing checks.

How do we use information? We use it to operate and secure the marketplace, manage accounts, process transactions and shipping, respond to support requests, provide AI features, send permitted communications, and comply with legal obligations. We may also use eligible AI interaction content to develop, train, fine-tune, and evaluate current and future models used by PCIFIC, subject to the limits in this notice.

Who do we share information with? Relevant providers include Sharetribe, Stripe, OpenRouter, Cerebras, underlying AI model providers accessed through OpenRouter, shipping and carrier providers, SendGrid/Twilio email infrastructure, MailerLite, Mapbox, Google Analytics, social login providers, and marketplace API providers where used.

Do we use AI, and can interactions be used for training? Yes. We use AI services supported by OpenRouter and Cerebras. To improve the accuracy, usefulness, and safety of PCIFIC's AI, we may use prompts, uploads, relevant context, generated responses, tool results, and feedback from across our AI-enabled services to train and improve current and future models used by PCIFIC. This does not mean that every interaction will be used. Legal requirements, privacy rights, source restrictions, and the additional limits for Safeguard extension data still apply. See sections 3, 4, 9, 13, and 18.

What should I avoid putting into AI features? Please do not include information that identifies you or another person, passwords, payment card details, identity documents, medical information, or other sensitive or confidential material. Check screenshots and files before uploading them. Where personal information is needed for an account or order issue, use the designated secure form or support channel rather than a general AI prompt.

Do we use cookies and similar technologies? Yes. We use cookies, browser and extension storage, service-worker cache storage, scripts, mobile device-secure storage, and similar technologies for security, sessions, marketplace functions, preferences, and analytics where permitted.

How do we protect information? We use technical and organisational measures intended to protect personal information. No online service or transmission is completely secure.

What are your rights? Depending on applicable law, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information. You can withdraw consent where we rely on consent. These rights also apply to personal information used for AI development where the relevant legal conditions are met.

How can you exercise your rights? Contact [email protected]. UK users can also complain to the Information Commissioner's Office, known as the ICO.

What information do we collect?
How do we process your information?
What legal bases do we rely on?
How do we use AI features?
When and with whom do we share information?
Do we use cookies, analytics, and similar technologies?
How do we handle social logins?
How do we handle payments, shipping, support, and verification?
How long do we keep information?
How do we keep information safe?
Do we transfer information internationally?
Do we collect information from minors?
What are your privacy rights?
Controls for do-not-track features
Do we make updates to this notice?
How can you contact us?
How can you review, update, or delete your information?
PCIFIC Safeguard extension

1. What information do we collect?

Information you provide

We collect personal information you provide when you register, manage listings, buy or sell, contact support, subscribe to communications, use AI tools, or use optional verification, extension, or social login features.

Depending on your use of the services, this may include:

Name and display name;
Email address and phone number;
Postal, billing, and shipping addresses;
Account credentials and authentication information;
Profile information, biography, public and private profile details, and preferences;
Saved searches, favourites, price watches, saved sellers, and cart information;
Listing text, images, device details, condition, pricing, and availability;
Marketplace messages and information about transactions;
Support requests, screenshots, photographs, attachments, and email replies;
Dispute, fraud-report, and report-listing information;
Newsletter, waitlist, and important-update signup details;
Seller onboarding, payout, or verification information handled through payment providers;
Serial numbers or IMEI numbers submitted to device-verification tools;
AI prompts, messages, uploads, feedback, and related context; and
Shipping, returns, service-point, parcel, and tracking information.

Please keep information accurate and up to date. Only provide information about another person where you have a lawful reason to do so.

Account, authentication, and mobile data

We process information needed to create, authenticate, secure, and manage accounts. On the web, this includes cookies and session data. During social login, we may temporarily use sign-in preview information such as email, name, identity-provider identifier, and login or signup state.

On mobile, authentication tokens may be stored in device-secure storage, such as the device keychain. The app may send those tokens with requests to confirm that you are signed in.

Payment data

Stripe processes payment information when you make purchases or use seller payout, onboarding, or subscription features. We do not store full payment card numbers on our own systems.

Stripe may process payment instrument details, identity and onboarding information, transaction information, billing contact details, connected-account information, payout data, and subscription or invoice records. Stripe's own privacy documentation also applies to its processing.

Support and case-management data

If you contact support or an issue becomes a support case, we may process:

Your name, email address, and account identifier;
Messages and email metadata;
Screenshots, photographs, and other attachments;
Internal summaries used to assess or respond to the issue;
Related listing, seller, or transaction references; and
Follow-up messages and case history.

Support, dispute, fraud, and report flows may include AI-generated summaries, conversation snapshots, case records, copies of relevant seller conversations, and attachments needed to investigate or resolve the matter.

Automatically collected information

We may automatically collect:

IP address;
Browser type and version;
Operating system and device information;
Referring web addresses;
Page and activity timestamps;
Technical logs, errors, and diagnostics;
Security, fraud-prevention, rate-limit, and abuse-prevention signals; and
Information about how and when you use our features.

We use this information to operate the services, maintain security, prevent misuse, troubleshoot problems, understand performance, and improve the user experience.

Listing views and engagement

We may use session identifiers, IP addresses, account identifiers, or similar technical information to count listing views, prevent abuse, calculate view or trending statistics, support wishlist and live-viewer features, and improve marketplace relevance.

Browser and device storage

We use cookies, local storage, session storage, service-worker cache storage, extension storage, scripts, and comparable technologies. These can remember privacy choices, maintain sessions, support cart and search functions, restore recently viewed items, retain AI or interface preferences, store unread or sound settings, and support security. Mobile authentication tokens may use device-secure storage.

Location data

Location-based features may process search locations, address-autocomplete queries, geocoding requests that turn addresses into map locations, map bounds, coordinates, and service-point locations. Where you enable it, we may process your current device location. Precise location permissions can usually be controlled through your browser or device settings.

Information from third parties

We may receive information from:

Google or Facebook when you choose social sign-in;
Stripe for payment, payout, onboarding, billing, or subscription status;
Shipping, logistics, returns, carrier, service-point, label, and tracking providers;
Support email providers that process messages and attachments;
Map and address providers;
Analytics providers where analytics is permitted;
Serial or IMEI verification providers; and
eBay or other relevant marketplace API providers for supported listing evidence and authorised marketplace functions.

Section 18 explains information collected through PCIFIC Safeguard in more detail.

2. How do we process your information?

We process information to:

Create, authenticate, secure, and manage accounts;
Publish and manage listings;
Process purchases, payments, payouts, refunds, and subscriptions;
Arrange shipping, returns, service points, and tracking;
Respond to support requests, disputes, and fraud or safety reports;
Provide AI-powered search, listing assistance, comparison, support, and marketplace guidance;
Develop, train, fine-tune, test, and evaluate current and future models used by PCIFIC using eligible AI interaction content, subject to sections 3, 4, and 18;
Communicate about accounts, transactions, listings, support cases, subscriptions, and policy changes;
Send newsletters and marketing where permitted by law and consistent with your choices;
Send important account, marketplace, safety, and service updates;
Save preferences, searches, price watches, favourites, sellers, cart state, and AI guidance settings;
Count listing views and improve search and recommendations;
Provide Safeguard features, manage quotas, and operate disclosed referral or promotional offers;
Monitor reliability, diagnose errors, and protect against manipulation, fraud, abuse, and security incidents; and
Comply with legal obligations, resolve legal claims, and enforce our terms.

Providing an AI response and training a model are separate purposes. Information needed for one purpose is not automatically eligible for the other.

3. What legal bases do we rely on?

Where UK or European data protection law applies, we need a lawful basis for each use of personal information. Depending on the purpose, we rely on the following bases.

Performance of a contract

We use this basis where processing is necessary to provide a service you request under our contract, or to take steps you request before entering that contract. Examples include managing an account, completing a marketplace transaction, providing a subscription, and generating an AI response you request where the processing is necessary for that service.

We do not treat training future AI models as automatically necessary to fulfil your marketplace contract.

Legitimate interests

We may rely on our legitimate interests in operating and securing the marketplace, preventing fraud, managing support, coordinating shipping, monitoring services, and improving relevant products. This applies only where the processing is necessary and our interests are not overridden by your interests, rights, and freedoms.

For eligible AI development and training, the interests we seek to pursue are improving the accuracy of marketplace answers, the quality of listing assistance and product comparisons, and the safety and reliability of PCIFIC's AI features. We rely on legitimate interests for personal information used for those purposes only where a documented assessment supports that basis. That assessment must consider necessity, less intrusive alternatives, the source and sensitivity of the information, people's reasonable expectations, and the effects on their rights.

An intention to improve AI is not, by itself, a sufficient legal basis. Where legitimate interests does not support the proposed use, we will not proceed on that basis.

Consent

We seek consent where required for optional cookies or similar technologies, certain marketing, or other optional processing. Where we rely on consent for AI training, we will ask separately before that use and explain how to withdraw it. Using an AI feature, accepting marketplace terms, or continuing to use PCIFIC does not by itself constitute consent to training.

Legal obligations and vital interests

We process information where necessary to comply with applicable tax, accounting, regulatory, or other legal obligations. In limited circumstances, processing may be necessary to protect someone's life or prevent serious harm.

Sensitive information and anonymisation

Special category data, such as health information, needs an additional legal condition as well as a lawful basis. Information about criminal offences is also subject to additional restrictions. The general bases listed above do not remove those requirements.

Genuinely anonymous information is information that no longer identifies someone and cannot reasonably be used to identify them. Removing a name or replacing an account identifier does not necessarily make information anonymous. Collecting, selecting, or anonymising personal information still requires a lawful basis, even if the resulting information is anonymous.

4. How do we use AI features?

AI-powered services

PCIFIC offers AI-powered features such as search, listing assistance, support assistance, product comparison, marketplace guidance, and Safeguard buyer and seller tools. Depending on the feature, we may process:

Prompts, questions, and messages you submit;
Relevant marketplace context supplied for the task;
Listing, transaction, or account context needed for the requested feature;
Images, documents, or other files you upload;
Recent conversation context;
Generated answers, reports, summaries, and drafts;
Tool results and action information needed to return the result; and
Feedback, usage information, and technical or safety signals.

AI output can be inaccurate. Review generated listing details, reports, messages, and recommendations before relying on them or taking action.

OpenRouter and Cerebras

We use both OpenRouter and Cerebras to support our AI features. Depending on the feature and model, requests may pass through OpenRouter to an underlying model provider or be processed by Cerebras. The providers involved receive the request content and technical information needed for the service.

OpenRouter and Cerebras are separate providers with different terms and data-handling practices. OpenRouter's published documentation states that its retention of prompts and responses is opt-in and that it retains request metadata, such as token counts and response times. Underlying model providers accessed through OpenRouter may have their own retention and data-use rules.

Cerebras's published privacy policy states that it does not retain inputs and outputs associated with its training, inference, and chatbot services. Its published service terms do not grant it the right to use service content to train or fine-tune models. It may process operational information needed to provide and manage its services.

The applicable service, our agreements, and our account and request settings determine how each provider handles a particular request. A provider's policy does not describe every other system involved in an AI interaction. In particular, provider non-retention does not mean that PCIFIC keeps no conversation or case records.

You can read the providers' documentation at:

PCIFIC's own model development, described below, is separate from a provider using information for its own training. This notice does not give providers unrestricted permission to train their own models on your information.

Developing and training current and future models

To make PCIFIC's AI features more accurate, useful, and safe, we may use eligible content from AI interactions to develop, train, fine-tune, test, and evaluate current and future models used by PCIFIC. Fine-tuning means further training an existing model for particular tasks.

This may include prompts and messages, uploaded files and images, relevant context supplied to the AI, generated responses, tool results, and feedback. It applies across PCIFIC's AI-enabled services, including our websites, mobile apps, marketplace tools, listing assistants, support assistants, comparisons, and other AI features. It is not limited to a single chat window or technical endpoint.

We may carry out this work ourselves or use contracted service providers acting on our instructions. It may involve automated assessment and authorised human review where lawful and permitted for the source of the information. Additional limits apply to human access to Safeguard extension data under section 18.

Not every interaction will be used. Any use must follow the applicable legal basis, privacy rights, source restrictions, and safeguards described in this notice. Information that remains only on your device is not automatically sent to us for training. Private marketplace messages, payment records, and account records do not become eligible for training simply because they exist within PCIFIC.

Information from Safeguard may be used only within the narrower purposes allowed by the Chrome Web Store rules and other applicable restrictions. The references above to future models do not permit using Safeguard data to train unrelated or general-purpose models.

Please keep personal information out of AI submissions

Please do not include information that identifies you or someone else in general AI prompts, uploads, notes, or feedback. This includes names, email addresses, phone numbers, home addresses, account identifiers, and identity documents. Do not include passwords, payment card details, medical information, or other sensitive or confidential material.

Check screenshots, photographs, and documents before uploading them. Personal information may appear in image backgrounds, labels, receipts, message threads, or file details as well as in the main text.

If an account, payment, delivery, or order issue requires personal information, use the designated secure form or support channel and provide only what is necessary. Do not use a general AI prompt to submit payment credentials or identity documents.

This guidance does not remove PCIFIC's responsibility for personal information that we receive. It is not a guarantee that all submissions or generated outputs are anonymous. Any personal information in training material remains subject to data protection law, and we must have an appropriate basis and safeguards for its use.

Support, disputes, and safety

If an AI interaction becomes a support ticket, dispute, fraud report, or other case, we may retain relevant conversation content, summaries, attachments, case records, copies of relevant seller conversations, and follow-up messages so our team can investigate and assist you.

AI features may also use rate limits, abuse detection, suspicious-query logging, and operational diagnostics. Retaining information for support or security does not automatically make it eligible for training.

Existing interactions and changes to training practices

Publishing this notice does not automatically authorise us to train on historical conversations collected under a promise that they would not be used for training. Before introducing a new use of previously collected personal information, we must assess whether that use is lawful and compatible with the original purpose, provide any required notice, and obtain consent where needed. We will not rely on this wording alone to override an earlier commitment.

Your rights and choices

Where we rely on legitimate interests, you have the right to object to the use of your personal information for AI development and training on grounds relating to your particular situation. Where we rely on consent, you can withdraw it at any time. Section 13 explains these rights and how to contact us.

Deleting a conversation or account is not necessarily the same as removing its effects from a trained model. This technical difficulty does not remove our legal duties. We will assess requests concerning source records, training datasets, and models that contain personal information under the applicable law, and explain the action taken or any lawful limitation.

5. When and with whom do we share information?

We share information with providers and partners where needed for the purposes in this notice. Depending on the features you use, recipients may include:

Marketplace infrastructure providers, including Sharetribe;
Hosting, storage, and technical infrastructure providers;
Payment and subscription providers, including Stripe;
AI providers, including OpenRouter, Cerebras, and underlying model providers accessed through OpenRouter;
Contracted providers assisting with permitted AI development, evaluation, or training on our instructions;
Shipping, logistics, returns, carrier, service-point, label, and tracking providers;
Support email and communications providers, including SendGrid/Twilio email infrastructure;
Newsletter, waitlist, and email-update providers, including MailerLite;
Map, address-autocomplete, and geocoding providers, including Mapbox and Google Maps services where enabled;
Analytics providers, including Google Analytics where permitted;
Social login providers, such as Google and Facebook;
Device-verification providers, such as imei.org;
Marketplace API providers, including eBay for supported Safeguard flows; and
Security providers and professional advisers where relevant.

Information in public listings and public profiles is visible to other users and visitors. Buyers and sellers receive information needed for their transactions, communications, shipping, returns, and dispute resolution. Avoid putting private contact details or other unnecessary personal information into public listing content.

Providers may act on our instructions or, for some activities such as their own legal or regulatory duties, as independent organisations responsible for their own processing. Their own privacy notices apply to those independent activities. A link to another provider's policy does not replace our responsibility to explain PCIFIC's processing.

We may also disclose relevant information:

Where required by law, regulation, court order, or other valid legal process;
To investigate or prevent fraud, abuse, or security incidents;
To enforce our terms or protect the rights and safety of PCIFIC, users, or others; or
In connection with a merger, financing, acquisition, or sale of assets, subject to applicable safeguards.

Safeguard extension data is subject to the additional sharing limits in section 18, including the requirements for a business transfer.

6. Do we use cookies, analytics, and similar technologies?

Yes. We use cookies, local storage, session storage, extension storage, service-worker cache storage, scripts, and comparable technologies. Mobile apps may also use device-secure storage.

These technologies may:

Keep you signed in and maintain sessions;
Remember cookie and privacy choices;
Support cart, search-history, and recently viewed functions;
Protect against misuse and fraud;
Count listing engagement and similar usage events;
Store interface preferences, including AI overview, unread, and sound settings;
Support map and address features;
Cache resources and support service reliability; and
Support analytics where permitted by law and your choices.

Some technologies are strictly necessary for the services to work. Others are optional and require consent unless a relevant legal exception applies. Describing a technology as useful or convenient does not automatically make it strictly necessary.

Google Analytics helps us understand use of PCIFIC and improve the services. Our current analytics arrangement loads Google Analytics 4 only after the full-consent choice is recorded. Where available, you can change optional cookie choices through our privacy or cookie controls. Browser settings also let you manage stored data, although blocking necessary storage may affect sign-in or other functions.

If we add or change optional technologies, we will provide the required information and choices through this notice, a cookie notice, or the relevant consent interface.

7. How do we handle social logins?

If you register or sign in through Google or Facebook, we may receive information needed for that process, such as your name, email address, profile information, and provider account identifier.

We use this information to authenticate you, create or connect your PCIFIC account, and support account management. The provider controls its own service and privacy practices. Review its privacy notice and account permissions for more information.

8. How do we handle payments, shipping, support, and verification?

Payments and subscriptions

Stripe handles payments, payouts, seller onboarding, and subscription billing where those features are used. It may process payment method, billing, transaction, identity, onboarding, connected-account, and payout information. Subscription functions may also involve checkout sessions, invoices, renewals, cancellations, payment failures, and billing-portal activity.

We may keep payment or subscription references and status information needed to fulfil transactions, manage entitlements, assist users, and meet legal obligations. We do not store full payment card numbers on our own systems.

Shipping and returns

Shipping, returns, labels, service points, and tracking may involve specialist providers. Relevant information may include buyer and seller names, addresses, phone numbers, email addresses, parcel information, selected shipping options, tracking numbers, label links, and shipment status updates.

Support email

SendGrid/Twilio email infrastructure may handle inbound and outbound support messages. Replies and attachments may be parsed, linked to a support case, and stored so we can respond and maintain a case history.

Device verification

If you use serial or IMEI verification tools, device identifiers and related information may be sent to providers such as imei.org. Results may include device model, storage, colour, carrier, blacklist status, warranty, activation information, and related verification details.

We may retain verification results, hashed identifiers, listing references, and user references for fraud prevention and marketplace safety. Hashing changes an identifier into another value, but does not necessarily make it anonymous.

9. How long do we keep information?

We keep personal information only for as long as necessary for its stated purpose, unless a longer period is required or permitted by law. We consider the type and sensitivity of the information, whether it is still needed, applicable legal duties, ongoing disputes, security risks, and your privacy requests.

In particular:

Account and marketplace information may be kept while an account is active and afterwards where needed for disputes, fraud prevention, legal compliance, or claims;
Transaction, billing, tax, and accounting records are kept for the applicable legal recordkeeping periods;
Support records are kept for the case and any justified follow-up, quality review, legal claims, or compliance needs;
Fraud, safety, verification, and abuse-prevention records are kept while necessary to investigate risks and protect the marketplace;
Technical logs and device or browser identifiers are kept according to their operational or security purpose;
AI interaction records may be kept to provide conversation history, requested results, support, safety checks, and other disclosed functions; and
Eligible AI development records and training datasets are kept only while needed for the defined development or evaluation work, reproducibility, safety assessment, and any applicable legal duties. Possible usefulness for unspecified future models is not, by itself, a reason to retain personal information indefinitely.

Where models themselves contain personal information, the applicable retention and privacy obligations extend to that information. Making a dataset anonymous requires more than deleting direct identifiers, and extension restrictions can continue to apply even to anonymous or derived information.

When we no longer need personal information, we will delete it or make it genuinely anonymous. Where immediate deletion is not possible, for example in protected backups, we will isolate it from ordinary use until deletion is possible under the applicable retention process.

Local browser or extension data may remain until overwritten, cleared, or removed by the browser. Clearing local storage does not necessarily remove records already held by PCIFIC or a provider.

Account deletion may be limited or delayed by ongoing transactions, disputes, legal duties, fraud concerns, or necessary accounting records. We may need to coordinate deletion with providers. Those limits do not permit unrelated or indefinite retention.

10. How do we keep information safe?

We use technical and organisational measures designed to protect against accidental loss, unauthorised access, misuse, alteration, and disclosure. Depending on the service, measures may include access controls, secure authentication, signed webhooks, security monitoring, rate limits, and operational safeguards.

Access to personal information should be limited to people and providers who need it for an authorised purpose. Additional restrictions on human access to Safeguard data appear in section 18.

No website, app, email service, storage system, or internet transmission can be guaranteed completely secure. Protect your account credentials, use a secure device, and avoid sending unnecessary sensitive information.

11. Do we transfer information internationally?

PCIFIC is based in the United Kingdom. Providers and infrastructure may process information in the UK, European Economic Area, United States, or other countries. This can include AI request processing, hosting, payments, support, and analytics.

Where required, we use a lawful transfer mechanism, such as an applicable adequacy decision or regulation, the UK International Data Transfer Agreement, the UK addendum to standard contractual clauses, or applicable European standard contractual clauses. We assess transfers and use supplementary measures where required.

A data processing agreement alone is not necessarily a valid international transfer mechanism. We must use the safeguards appropriate to the destination and processing involved.

Contact [email protected] for information about the safeguards relevant to your information or to request a copy, subject to necessary redactions that protect confidential or security-sensitive details.

12. Do we collect information from minors?

PCIFIC is not intended for children. Users must meet the applicable age requirements for the services and be legally able to enter the relevant marketplace arrangements.

We do not knowingly collect children's personal information in violation of applicable law. Our general AI training wording does not provide permission to disregard children's additional protections. Please do not include children's personal information in AI submissions.

If you believe a child has provided personal information improperly, contact [email protected] so we can investigate and take appropriate action.

13. What are your privacy rights?

Depending on applicable law and the circumstances, you may have the right to:

Request access to your personal information and information about its use;
Correct inaccurate information or complete incomplete information;
Request deletion;
Restrict certain processing;
Object to processing based on legitimate interests;
Object to direct marketing, including related profiling;
Receive a portable copy of certain information;
Withdraw consent where we rely on it; and
Receive protections in relation to certain solely automated decisions that have legal or similarly significant effects.

To exercise a right, contact [email protected]. You do not need to use a particular subject line or legal wording. We may ask for proportionate information to verify your identity and locate the relevant records.

AI training objections and consent withdrawal

If we rely on legitimate interests to use your personal information for AI development or training, you can object on grounds relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed for legal claims.

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing that took place before withdrawal. We will stop the processing that depends on that consent. Withdrawal does not affect separate uses supported by another valid basis, such as keeping legally required billing records.

Requests can concern AI interaction records, training datasets, and personal information contained in a model. Technical difficulty does not create a blanket exemption from your rights. If we cannot fulfil all or part of a request, we will explain the applicable reason and your complaint rights.

Marketing and complaints

You can unsubscribe from marketing emails using the link in the email or by contacting us. We may still send necessary service messages, such as order confirmations or account security notices.

UK users can complain to the Information Commissioner's Office. Users in the European Economic Area or Switzerland may also have the right to complain to their local supervisory authority. You do not have to contact us before complaining to a regulator, although we welcome the chance to address your concern.

We respond to privacy requests within the period required by applicable law. Under UK and European data protection law, this is generally within one month, subject to applicable rules on clarification, identity checks, and permitted extensions. If an extension applies, we will explain it as required.

14. Controls for do-not-track features

Some browsers offer a do-not-track setting. We do not currently respond to these signals through a standardised do-not-track mechanism.

This does not replace your cookie choices or privacy rights. Where applicable law requires us to recognise a particular privacy or opt-out signal, we must comply with that requirement. We will update relevant disclosures if our handling changes.

15. Do we make updates to this notice?

We may update this notice when our services, legal obligations, or privacy practices change. The date at the top identifies the latest revision.

Where required, we will give additional notice of material changes before the new processing begins. This may include changes to AI training purposes, the information used, provider arrangements, or extension functions.

An updated notice is not a substitute for a valid legal basis. Continued use of PCIFIC does not by itself mean that you consent to new personal-data processing. Where consent is required, we will obtain it separately. Section 4 explains the limits on reusing historical AI interactions.

16. How can you contact us?

For questions, concerns, or privacy requests, contact:

Pcific Marketplaces Limited
71-75 Shelton Street
London WC2H 9JQ
United Kingdom

Email: [email protected]

17. How can you review, update, or delete your information?

You may request access to, correction of, or deletion of personal information we hold about you. You may also request restriction, object to relevant processing, or request a portable copy where the law provides that right.

Contact [email protected]. Describe the account, feature, or information concerned without sending unnecessary sensitive material. We may need to verify your identity before completing the request.

Deleting a marketplace account may not immediately remove every record where we must retain information for ongoing transactions, accounting, legal compliance, fraud prevention, or dispute resolution. We may need to coordinate with providers acting on our behalf. Independent providers may have separate obligations and request processes.

If your request concerns AI training, say so if you can, so we can assess the relevant interaction records, datasets, and any model containing personal information. You are not required to know which model or technical system processed your information.

Removing the Safeguard extension or clearing browser storage does not itself delete your PCIFIC account or cancel a paid subscription. Use the relevant account or billing controls for those actions, or contact support for help.

18. PCIFIC Safeguard extension

Scope and purpose

This section explains how PCIFIC processes personal information and marketplace information through the PCIFIC Safeguard browser extension. Read it together with the rest of this notice. Where this section places narrower limits on extension data, those limits apply even if another section describes broader uses for other PCIFIC services.

PCIFIC Safeguard is a Chrome-first extension for supported eBay UK and eBay US pages. It helps buyers review technology listings, prepare questions for sellers, open PCIFIC Checkup tools, ask listing-specific questions, and save local listing notes. Where seller tools are available, it also helps review or draft listing content.

The extension connects with selected PCIFIC login, account, subscription, billing, referral, and promo-code pages so your account or paid entitlement can be connected to the extension.

Supported pages and permissions

The extension runs on selected eBay item pages and supported seller listing or draft pages. It also interacts with selected PCIFIC pages for login, account handoff, billing checkout and management, referrals, promotions, and extension status.

The extension uses permissions for these purposes:

eBay UK and eBay US host permissions let it recognise supported pages, add PCIFIC controls, read relevant listing or seller-draft information, and return requested reports or drafting assistance;
PCIFIC host permissions and externally connectable messaging let PCIFIC pages complete login, billing, subscription, promotional, referral, and account-status handoffs;
activeTab, tabs, and scripting let it identify and interact with the supported tab, insert the interface where needed, and read information required for the requested feature;
sidePanel lets it show reports, account status, quotas, billing actions, referral or promo controls, and buyer or seller tools; and
storage lets it keep settings, account state, local reports, notes, usage counters, and technical state in Chrome extension storage.

The extension is designed not to click buy, bid, make offer, checkout, pay, publish, or send-message actions on your behalf. If PCIFIC introduces materially different marketplace automation, we will provide the required disclosure before that use and seek permissions or consent where required.

Listing and seller-draft information

When you use Safeguard on a supported page, it may read visible information or information returned through official PCIFIC and eBay flows. Depending on the feature, this may include:

Listing addresses, marketplace, item and item-group identifiers, category details, and page titles;
Listing titles, subtitles, prices, currencies, buying options, condition, condition notes, availability, and descriptions;
Delivery, postage, shipping, and returns information;
Seller names, profile addresses, account types, feedback scores, feedback percentages, and feedback counts;
Item specifics, variations, configuration options, revision markers, and seller revision information;
Visible sold or watcher information;
PCIFIC Checkup codes and related certificate or evidence signals;
Image addresses, image counts, and detected media status; and
Seller draft fields, including title, description, category, condition, price, item specifics, delivery and returns, promotion or fee-related page text, missing-field signals, and draft action labels.

Buyer listing checks may send the listing address to PCIFIC so we can request official eBay Browse API evidence. The result may include item identifiers, title, price, condition, description, seller details, feedback, item specifics, delivery and returns, variations, revisions, Checkup codes, image addresses, and other relevant listing data returned by eBay.

We use this evidence to produce the requested listing review and reduce reliance on reading page content. Information about sellers or other people remains subject to applicable privacy law even when publicly visible. eBay contractual restrictions may also limit how official evidence can be reused.

Safeguard may process image addresses and counts as listing evidence. It does not visually review listing images, send listing photographs as image files for visual AI analysis, or ask a model to inspect those photographs unless PCIFIC introduces and separately discloses that feature. The general reference to image uploads elsewhere in this notice does not change this extension-specific limit.

AI prompts, notes, and generated outputs

AI-powered extension features may process selected listing evidence, seller-draft context, your prompt or requested action, recent conversation context, generated seller-message drafts, scratchpad suggestions, and resulting reports or answers.

Relevant information may be sent to PCIFIC's AI infrastructure and providers, including OpenRouter, Cerebras, and underlying model providers where used, to generate, stream, check, secure, and deliver the requested result.

Buyer checks may produce a report, score, tone, seller-question suggestions, suggested next actions, and supporting evidence. Seller tools may produce a review, score, tone, title or description suggestions, and supported autofill content. Listing assistants may use your message, recent conversation, listing and review context, and scratchpad information made available through the feature you use.

Training and improvement limits for extension data

We may use eligible Safeguard AI interaction data to evaluate or improve Safeguard's disclosed listing-review and drafting functions, including training or fine-tuning models specifically for those functions, only where that use is necessary for providing or improving the extension's disclosed single purpose and is permitted by applicable law, Chrome Web Store requirements, and source-provider terms.

We do not use Safeguard extension data to train unrelated or general-purpose AI models. This restriction applies to raw information and to information aggregated, anonymised, de-identified, or derived from it. Moving extension data to another PCIFIC system does not remove the restriction.

Any permitted development use remains subject to the legal bases, privacy rights, and limits on historical information in sections 3, 4, and 13. Where required, we will provide prominent disclosure within the extension and its store listing and obtain the necessary consent before collecting or using information for a new purpose. Consent does not authorise a use prohibited by Chrome Web Store rules.

Section 4 explains provider practices. We must select provider arrangements and settings that respect these extension restrictions; a provider's broader terms do not override them.

Browser storage and local data

Safeguard uses Chrome extension storage and similar browser storage to operate across tabs and sessions. Local information may include:

Settings, technical service addresses, selected tool mode, and auto-scroll choices;
Extension install identifiers and authentication handoff state;
Account-status caches and saved reports;
Report status, scores, tone, listing snapshots, and suggested next actions;
Seller-message drafts, buyer questions, and seller review status;
Guest usage counts; and
Scratchpad notes and related technical state.

Scratchpad notes are saved locally for the relevant listing. Where you use a feature that makes scratchpad context available to the assistant, the extension may send metadata or a preview, such as whether a note exists, its length, a short extract, source address, item identifier, listing cache key, and update time. Local storage alone does not mean that all note contents are sent to PCIFIC.

Please do not put personal, sensitive, or confidential information in notes, prompts, drafts, or reports. Local information remains until overwritten, cleared, or removed, subject to Chrome's storage behaviour. Removing the extension or using browser controls can clear local extension data, but does not necessarily delete server-side records.

If debug logging is enabled, the extension may keep technical logs locally to diagnose errors.

Account, quota, billing, referrals, and promotions

If you sign in or connect an account, PCIFIC may process:

User identifier, email, display name, and profile image address;
Authentication and account status;
Plan type, subscription status and period, billing provider, and promotional access end date;
Listing-check allowance, usage count, remaining quota, and guest usage count; and
Extension install identifier.

Usage and quota records may include usage kind, marketplace, report score and tone, risk category, estimated listing value, seller-question count, Checkup-code count, event source and fingerprint, billing period key, plan tier, usage session key, and timestamps.

These records support disclosed free, paid, promotional, and referral functions and help prevent abuse. Any public statistics must avoid exposing personal information or private listing content and remain within applicable extension-use restrictions. Rounding or aggregation alone does not authorise an otherwise prohibited use.

Stripe may process subscription payments, card details, invoices, checkout activity, renewals, cancellations, payment failures, and billing-portal information. PCIFIC may store Stripe customer, subscription, and price identifiers, plan tier, subscription status and dates, cancellation status, and related billing state.

Referral and promo functions may process submitted codes, redemption status, grant periods, referral codes and sharing addresses, claim status, referrer and referred account information, bonus-check grants, activation checks, and abuse-prevention signals. These signals may include hashed or limited install, IP address, browser, event, and account-relationship information. Hashing does not necessarily make the information anonymous.

Purposes and lawful bases

We use extension information to provide requested buyer and seller tools, generate reports and drafts, manage accounts and subscriptions, enforce quotas, restore local reports, support Checkup handoffs, process billing, operate disclosed referrals and promotions, troubleshoot errors, secure the service, prevent abuse, comply with law, and improve the extension within its permitted single purpose.

The lawful basis depends on the activity. It may be performance of a contract, steps requested before a contract, legal obligations, legitimate interests that are not overridden by people's rights, or consent where required. AI training is assessed separately from providing a requested AI result, as explained in section 3. A lawful basis does not override Chrome Web Store or eBay restrictions.

Sharing and independent services

Relevant providers may include hosting and technical infrastructure, OpenRouter, Cerebras, underlying AI model providers, eBay API services, Stripe, security providers, and permitted analytics or diagnostics providers. Professional advisers may receive information only where the applicable legal and extension-use conditions allow it.

PCIFIC is independent from eBay unless we expressly state otherwise. eBay, Stripe, Chrome, and AI providers have their own terms and privacy practices.

Chrome Web Store Limited Use

PCIFIC Safeguard's use and transfer of user data adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

The extension may process website content from supported eBay pages; browsing activity limited to supported eBay addresses and PCIFIC handoff pages; prompts, notes, seller drafts, and messages; install and account identifiers; authentication and account information; usage data; diagnostics; and relevant subscription information.

We limit collection, use, and transmission to what is necessary for the extension's disclosed single purpose and permitted related operations. Browsing activity is collected and used only as required for a user-facing feature described prominently in the store listing and extension interface.

We do not sell personal information or extension user data collected through Safeguard. We do not use or transfer it for personalised advertising, retargeting, interest-based advertising profiles, data-broker or information-reseller services, creditworthiness, lending eligibility, or other prohibited or unrelated purposes.

We transfer extension user data only where necessary to provide or improve its disclosed single purpose, comply with applicable law, protect against malware, spam, phishing, fraud, or abuse, or complete a permitted merger, acquisition, or asset sale after obtaining the explicit prior user consent required by the Chrome Web Store rules.

Humans may read extension user data only where:

The user has explicitly consented to reading specific data, for example for a requested support investigation;
The information is aggregated and anonymised and used for internal operations in accordance with applicable law;
Access is necessary for security purposes, such as investigating abuse; or
Access is necessary to comply with applicable law.

General debugging, service maintenance, or model training does not by itself create an exception to these human-access limits. The Limited Use restrictions also apply to scraped information and to aggregated, anonymised, de-identified, or derived data.

Retention and user controls

We keep extension information only as long as needed for the permitted purposes described here and in section 9. Account, quota, billing, support, security, diagnostics, and legal records follow the applicable retention criteria and legal requirements.

You can disable or remove Safeguard and clear local extension storage through Chrome. These actions do not automatically delete PCIFIC server records, close your account, cancel a subscription, or withdraw a consent recorded separately. Use the relevant account or billing controls, or contact [email protected] for assistance and privacy requests.

eBay pages can contain information about sellers, buyers, or other third parties. Use Safeguard only for its disclosed marketplace safety, listing review, seller drafting, Checkup, and related account and service functions. Do not submit unnecessary personal or sensitive information.