It's worth pointing out, that if you use PayPal to buy anything from any site, the site in question gets to see your PayPal email address (whether they need to

It's worth pointing out, that if you use PayPal to buy anything from any site, the site in question gets to see your PayPal email address (whether they need to use it or not). If your main email address is used as your PayPal login, and an e-commerce is site is hacked or they just straight up sell your data, then that's your main email address totally compromised. Source: I've implemented PayPal integrations for several sites over the years, and saw first hand what data is exchanged during the API workflows.