When ICO's collect your KYC docs, is that it? What do they do with them, just hold on to them for record keeping or are they required to process them some how?
They might sell your docs on black market if the ico itself will turn into scam. That's why I never give my docs to all random ico out there and also suggest others to be careful when sharing your docs with any ICO.
I am rather buying coins in discount or at around ico price when they will get listed and bounty is distributed.
They might. They might also hand them over to local governments, regulatory agencies and such if asked to do so. Or they could build your profile based on the information you provided to them and sell that profile to third parties such as advertisement companies. Keep in mind, that neither of those two aforementioned options involve breaking a law.