The fact that this is a VC-backed startup pretty much guarantees it will be doing nefarious things with its users' data somewhere down the line. Even if not intended right now.
Additionally, the fact that it's a "VC-backed startup" is irrelevant. Any company with any structure could be doing this.