Company says cutomers’ personal data is owned by the business and may be disclosed, in some cases.