As soon as you start your own business, you'll know all of this. The short gist of it is when you incorporate, you have to publish rules that govern your entire operation. These are either your articles of incorporation or your bylaws, depending upon the type of entity you are.

If "Don't sell customer data, even surreptitiously" isn't in those bylaws or articles, then the company is free and clear to do that. ToS says how you can use THEIR service externally, not how they internally operate.