It doesn't need to be in the ToS. In the US your information has no legal protection, with a handful of exceptions like medical information. You should assume any information you give to any company is being shared, sold, and utilized to the fullest extent to monetize you.

Something many do not consider especially in today's era of social media and AI capable of scraping any tidbit of information you reveal about yourself. As an example, this [1] is an extremely primitive tool that generates a profile of Reddit users based on nothing but what they've publicly submitted. The profiles the companies people 'trust' with their information today are going to be orders of magnitude more detailed, and accurate.

[1] - https://snoopsnoo.com/