I suspect they (at least the company, as opposed to an employee with database access) didn't sell it. Not only is your SaaS sub far more profitable than selling

I suspect they (at least the company, as opposed to an employee with database access) didn't sell it. Not only is your SaaS sub far more profitable than selling email addresses on the darknet, selling contact information to third parties is also inconsistent with other details of their privacy policy and likely illegal and subject to fines in most of Europe. Not that losing your data shouldn't still undermine your trust in them.