User data is a leaky moat, since you can convince people to get their data via GDPR request and hand it over to you.

The law even demands that the data is machine readable.

The only real moat is your own, observational data.