I would not attach a java agent which sends out JVM profiling to a remote site and that too in production.
Do you intend to have an offline version of this tool?
Self-hosted solutions would be possible though.
I'd also like to clarify what kind of data is uploaded - it's what kind of classes and methods are used, not any of the actual data. E.g. it might contain information that you use BCrypt, but not input nor output. It is however, of course, your decision if you judge that data sensitive or not.