Nothing wrong with this in principle. The burning questions is what they use the data for. In particular, do they sell it to 3rd parties? How long do they keep the data?