You should assume that they are training on their data even when it's disabled by you. None of these companies prove that they are worthy of any trust. If they got caught then they receive a fine which would be a droplet in their massive budget. They don't have really big incentive to be trustworthy.