Looking forward to the inevitable "Kagi sells user data" investigative report. The simple truth is that unless they make themselves explicitly liable to users if they are ever caught doing this, that the irresistable urge to monetize user data will tempt even the most well-meaning firm into sin. The ONLY solution is to make 'sinning' an existential threat to the firm. IANAL but I believe this can be done if ownership agrees to voluntarily enter into something like a fiduciary arrangement with their users. This means writing a EULA that does not minimize the firm's risk, but instead increases it in specific, meaningful ways. Increasing client risk is something attorneys are absolutely allergic to, and will argue up and down about why the client shouldn't do it. I would say that, if the customers know and care about such a step, it could be a valuable PR and marketing move that demonstrates REAL integrity.

As it is, we only believe that "users paying for services" will protect against data exfiltration because of very naive reasoning, or, perhaps more accurately, praying.