Furthermore, they use their VPN clients as proxies and sell access to their network to scrapers and botnetters. Usually the rule of thumb is that if you're not paying, you're the product, but in this case they manage to double dip. That's where the real funding comes from.