Sounds like you have great evidence for a class-action against them. If they told their users they only retain emails for 7 days, but actually kept every email in an S3 bucket that was then sold illegally to Slice, every user of Unroll.me could sue for breach of contract, damages, etc...