Oh dang. So this whole thing is just a big data grab. Even if they aren't going to make fraudulent charges, that's a clear ulterior motive.
The fact that your privacy policy's fine print allows you to use the information for something other than the express purpose at hand seriously undermines that, even if you have no actual intentions of doing anything shady.
Personally, I'm very much okay with the exchange in this case, particularly given the cost of mailing physical letters.