Legal Entity: The data controller is TPSTORES LIMITED (Company No. 13238473), trading as Cyclesite. Registered office: 128 City Road, London, EC1V 2NX.
Data Controller Information
Company: TPSTORES LIMITED (trading as Cyclesite)
ICO Registration Number: ZC105359
Data Protection Contact: support@cyclesite.co.uk
Contact: All data protection enquiries should be directed to support@cyclesite.co.uk
1. Information We Collect
Account Information: Name, email address, password (encrypted), phone number, profile photo
Listing Data: Bike details, photos, frame serial numbers, pricing information, location
Frame Checks: When you check a frame number, we record the frame number you checked, the result, your account if you are signed in, and your email address if you asked us to email you the result. If you have accepted analytics cookies, we also link the check to the anonymous identifier that cookie holds. We use these records to tell you if a bike we said was clear is later reported stolen. We do not record your IP address or device details for checks. If you tell us where you saw a stolen bike, we keep only the town or the postcode district (for example BS8), never the full postcode.
Usage Data: Browser type, device information, pages visited, time spent, search queries, timezone, language preference
Location Data: We derive approximate location (city/country) from your IP address for analytics. The IP address is anonymized (last octet zeroed) during processing and is never stored. Only the derived location is retained.
Browser Geolocation: With your explicit permission, we may access your device's precise location via browser geolocation to show you distance to bike listings (e.g., "12 miles away"), find nearby shops, and auto-fill your listing location. Your coordinates are sent to third-party geocoding services (OpenStreetMap Nominatim and postcodes.io) to convert them into a city name or postcode. We may also use your IP address with ipapi.co to detect your approximate location without browser permission. None of these services receive your name or account details. The resolved location (city/postcode) is stored locally on your device only and is never sent to our servers. You can revoke location permission at any time through your browser or device settings.
Communications: Messages between users, support requests, feedback, abuse reports
Payment Information: Processed by third-party payment processors (Stripe). We do not store full card details.
Passkey & Device Authentication Data: If you enable passkey or biometric authentication (such as Face ID or fingerprint) for sign-in or app lock, we use the WebAuthn standard to create a cryptographic passkey tied to your device. Biometric data (e.g. facial recognition or fingerprint data) is processed entirely by your device's secure enclave and is never sent to or stored on our servers. We store only the public key, credential identifier, and signature counter needed to verify your identity, along with device information (device name, browser, operating system), authenticator type, backup status, and timestamps. You can view and remove your passkeys at any time from your account Security page.
Cookies and Tracking: See our Cookies Policy for details
2. Legal Basis for Processing (GDPR Article 6)
We process your personal data under the following legal bases:
- Contract Performance: To provide advertising services when you create listings
- Legitimate Interests: To operate and improve our platform, prevent fraud, ensure security
- Consent: For marketing communications and non-essential cookies
- Legal Obligation: To comply with tax, accounting, and legal requirements
3. How We Use Your Information
- Provide and improve our classified advertising services
- Enable communication between buyers and sellers
- Process payments for advertising services
- Send service notifications (listing updates, enquiries)
- Respond to support requests and complaints
- Prevent fraud, abuse, and ensure platform security
- Comply with legal obligations (tax, law enforcement requests)
- Send marketing communications (only with your consent - opt out anytime)
- Analyse usage to improve user experience
4. Data Sharing and Third Parties
We share your data with:
- Other Users: Your public profile, listings, and messages are visible to other users
- Payment Processors: Stripe (for processing advertising fees); see Stripe Privacy
- Hosting and infrastructure: Railway (application hosting), Backblaze B2 (object storage), Cloudflare (CDN, WAF, DNS)
- Payments: Stripe Payments UK Ltd (card processing and Buyer Protection escrow)
- Email: Postmark (transactional and marketing email)
- Analytics: Google Analytics 4 and Google Search Console (aggregate, non-identifying platform analytics)
- Advertising: Google Ads (conversion tracking and remarketing, only where you have consented to marketing cookies)
- Geocoding: OpenStreetMap Nominatim, postcodes.io, and ipapi.co (coordinates / postcodes only, no account data)
- Shipping carriers (for Buyer Protection transactions only): Paisley Freight, Parcel2Go and Bike Services UK
- Social distribution: Bluesky (where we cross-post public listing content we are authorised to share)
- Legal authorities: Where required by law or to prevent or investigate fraud, crime, or stolen-bike offences
- Business transfers: If Cyclesite (TPSTORES LIMITED) is involved in a merger, acquisition, financing, reorganisation, or sale of all or part of its business or assets, your personal data may be transferred to the successor or acquirer as part of that transaction. The recipient will remain bound by this Privacy Policy (or a policy at least as protective) and will process your personal data for the same purposes. We will notify you of any such change, and of any new data controller, as required by law.
We DO NOT sell your personal data to third parties for their own marketing or for monetary consideration. A transfer to a successor as part of a business sale or reorganisation, described above, is a going-concern transfer and is not a sale of your data.
5. Search Engines and AI Systems
Your public listing content (descriptions, photographs, pricing) may be accessed by search engines and AI systems, including Google, Bing, OpenAI, and Anthropic, for the purpose of indexing, improving search results, and enhancing discoverability of your listings.
What is shared: Only publicly visible listing information. Your personal account details, messages, payment information, and contact details are never shared with search engines or AI systems.
Why: Search engine and AI indexing helps buyers find your listings through Google, Bing, ChatGPT, and other search tools. This increases the visibility and reach of your listing beyond Cyclesite itself.
Your right to opt out: You can request that your listing content be excluded from AI training datasets by contacting us at support@cyclesite.co.uk. We will add technical markers to your listings to instruct AI crawlers to exclude your content. Note that search engine indexing (Google, Bing) cannot be opted out of for public listings, as this is essential for the marketplace to function.
Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR): making your listings discoverable serves both your interest as a seller and the interest of potential buyers in finding relevant bikes.
5.1 Using Cyclesite through an AI assistant
You can use Cyclesite from inside an AI assistant such as ChatGPT or Claude, or any other client that supports the Model Context Protocol (MCP). When you do, the assistant sends us the request for each action you take (for example a search, a frame number to check, or the details of a bike to value) and we send the result back to it. We receive only the request itself, never your conversation with the assistant.
What we send back: public listing information and market data that is already visible on Cyclesite. Your own listings, enquiries and messages are only returned after you sign in and approve that specific access.
Signing in: actions on your own account (publishing a listing, marking it sold, sending or answering an enquiry) use OAuth 2.0. You approve each permission on Cyclesite itself; the assistant never sees your password. We keep a hashed copy of the access token (valid for one hour) and of the refresh token, together with the permissions you granted and the identity of the connecting client. You can see and disconnect any connected assistant at any time under Account → Connected apps.
What we record about the connection: aggregate counts of calls per tool and per client type, and a short-lived sample of unrecognised client identifiers, so we can tell which assistants are being used. These counters contain no content from your requests. Requests are also written to our standard server logs and kept for the period in section 7.
The assistant provider: the company running the assistant (for example OpenAI or Anthropic) processes your conversation, including anythingCyclesite returns to it, under its own privacy policy. We are not a party to that processing and do not receive data from it beyond the requests described above.
Legal basis: performance of a contract (Article 6(1)(b)) for actions on your account, and legitimate interests (Article 6(1)(f)) for public data and the aggregate usage counts. Developer terms for assistants and other integrations are in our Partner API Terms.
6. International Data Transfers
Some of the processors listed in Section 4 are based outside the UK (notably Stripe, Postmark, Cloudflare and Google services, which may process data in the United States or other jurisdictions). Where your personal data is transferred outside the UK, we rely on one of the following safeguards as required by UK GDPR Article 46:
- The UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses as supplemented by the UK Addendum
- For transfers to the United States, reliance on the UK Extension to the EU-US Data Privacy Framework where the recipient is self-certified under that framework
- Adequacy regulations where the recipient country has been granted adequacy
You can request a copy of the safeguard used for any specific transfer by contacting us at support@cyclesite.co.uk.
7. Data Retention
We retain your personal data for:
- Active Account: While your account is active
- After Account Deletion: Up to 7 years for legal, tax, and fraud prevention purposes
- Marketing Data: Until you unsubscribe or withdraw consent
- Logs and Analytics: Typically 12-24 months
8. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right to Access: Request a copy of your personal data
- Right to Rectification: Correct inaccurate or incomplete data
- Right to Erasure: Request deletion of your data ("right to be forgotten")
- Right to Data Portability: Receive your data in a machine-readable format
- Right to Object: Object to processing based on legitimate interests or direct marketing
- Right to Restrict Processing: Request we limit how we use your data
- Right to Withdraw Consent: Where processing is based on consent
- Right to Complain: Lodge a complaint with the ICO (see below)
To exercise your rights, email support@cyclesite.co.uk or use our GDPR Request Form.
We will respond to requests within 30 days. Some requests may take longer if they are complex.
9. Automated Decision-Making
Under Article 22 of the UK GDPR, you have the right to know about and challenge decisions made solely by automated means that significantly affect you. We use the following automated systems:
9.1 Fraud & Trust Scoring
We use automated systems to assess the risk of fraudulent activity on listings and accounts. This may include analysis of listing content, account behaviour, and device information. A low trust score may result in additional verification requirements or listing removal.
9.2 Search Ranking & Personalisation
Search results are ranked using automated scoring that considers listing quality, relevance, seller reliability, and your browsing history. This affects the visibility of listings but does not restrict access to any content.
9.3 Pricing Intelligence
We provide automated pricing suggestions to sellers based on market data, comparable sales, and demand signals. These are recommendations only; sellers set their own prices.
9.4 Your Rights
- Right to human review: You can request that any automated decision affecting your account be reviewed by a member of our team
- Right to contest: You can challenge the outcome of any automated decision
- Right to an explanation: You can request an explanation of the logic involved in any automated decision
To request human review of an automated decision, contact dpo@cyclesite.co.uk
10. Data Breach Notification
In the event of a data breach that poses a high risk to your rights and freedoms, we will notify you within 72 hours of becoming aware of the breach, in accordance with UK GDPR requirements. We will also notify the ICO as required by law.
11. Cookies and Tracking
We use cookies and similar technologies to improve your experience, analyze usage, and deliver personalized content.
Cookie Categories:
- Essential Cookies: Required for the site to function (e.g., login sessions)
- Performance Cookies: Help us understand how visitors use the site
- Functionality Cookies: Remember your preferences
- Marketing Cookies: Used for targeted advertising (requires consent)
See our Cookies Policy for full details. Manage your preferences in Account Settings.
12. Data Security
We implement industry-standard security measures to protect your data:
- TLS/SSL encryption for data transmission
- Encrypted password storage (bcrypt)
- Secure cloud hosting with access controls
- Regular security audits and penetration testing
- Staff training on data protection
- Incident response procedures
However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
13. Children's Privacy
Our service is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice on the Service at least 30 days before changes take effect. Your continued use constitutes acceptance of the updated policy.
15. Contact Us & ICO Complaints
Data Protection Contact
Email: support@cyclesite.co.uk
All data protection correspondence should be directed via email.
Right to Complain to ICO
If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office:
ICO: ico.org.uk/make-a-complaint
Tel: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF