It seems they aren't violating the promise about "your data", and are handing over "their data" (IP addresses, payment data)