It all boils down to: you're storing data in someone else's database. At this point, technically, they could do whatever they want with it. All that stops them from doing so is their ethics, the law, and the desire to keep their business.