We act like and have the same compliance standards as a bank - so we don't have "unrestricted access" to your bank account anymore than someone you give a check to does. Yes, that person now has your bank account and routing number (because it's printed on the bottom of every check you've ever given anyone), but they only can legally do what you authorized them to do: cash that check for that amount. We're the same way.
The only additional thing you give us is temporary access to some other information in case you want to transfer it (name, address, etc) - but we don't store it. We also have access to your payment history temporarily to ensure that you're likely to
1. Be who you say you are (fraud protection)
2. Have the money to make the payment.
But both of those things are just temporary - we don't and can't store it and we don't and can't use it for anything other than explicitly what it's for.
Side note: government gets a lot of hate in the Tech community, but this is a place where regulation is fantastic. Since we have to be Regulation E compliant, even if someone (investors, partners, etc.) wanted us to use this access for bad purposes, we can't! You're protected and therefore we're protected. As the founders of this company, we wouldn't WANT to nor would we ever do anything with your information, but it's fantastic not to be under any pressure to do so.