There might be a promise not to sell data, but you aren't doing any client/server encryption to prevent yourselves from reading it. If a government sent a request you couldn't deny, data could still be collected. Gmail has HTTPS, but everyone agrees that only protects from MITM attacks from the hacker in the coffee shop, not the one in the datacenter.