I spoke with a mca lead generator today, was pitching me complete packages for little under $400. App+recent statements. Everything they said sounded to good to be true but is selling merchants personal financial data legal?