If cloudflare have thr certificate’s private key and are advertising the A record they have access to everything you send, from emails to credit card numbers.