If you give any information to any company of significant size, you should expect that information will get out into the wild. Any promises of privacy or data protection are functionally unenforceable and moot once the data is out there.
And that is why I have my own domain and make up a different email address for every single company. When they get hacked emails sent to that address go straight to trash.