Claiming not to do shady things with user data is the minimum I expect from a domain registrar. Fortunately, Gandi aren't unique in that respect.
Gandi came highly recommended to me, so I was quite disappointed by the reality.
They buy the domain themselves, and let you pay with Dogecoins -- possibly a good deal for the next Pirate Bay, but not what I would use for general domain registration. There is a good chance one day they will go down and take your (their!) domain with them.
From their website:
---
We're not actually a domain name registration service, we're a customer to these.
[...]
When you buy a domain in our system, we're actually purchasing it for ourselves. We will be the actual owners of the domain.