Playing devil's advocate, maybe they would argue that "we" refers to the organization that operates the service, and that in the event that the ownership of the organization changes, the statement could still be true - "we" did not sell your data, but during the acquisition "we" were sold.