Of course... If you send someone unencrypted data, they can read it. Companies at least have to follow some laws regarding the data - don't expect that with private instances (not controlled by you).