This seems like a lazy snipe. They clearly state that they receive only an age verification result and none of the personal data. It would take collusion from both sides to silently enable transfer of user data while publicly stating that they don't.

I have used these KYC services before. There is the option to get access to all user data - but unless there is evidence to the contrary, we have to take their word for it, for now.