The fact that this is a VC-backed startup pretty much guarantees it will be doing nefarious things with its users' data somewhere down the line. Even if not intended right now.
Either a business can thrive without selling user data, or it can’t. If it can’t, then eventually the data will fall in the hands of someone willing to sell it. It doesn’t matter if that someone is current management (perhaps under pressure from VCs) or future management (after inevitable acquisition or asset liquidation since the business is not viable).
Therefore it does not matter how current management feels about selling user data today, or whether they are vc-funded or bootstrapped. If they aren’t building a viable business, the data they are collecting will be sold eventually.