That depends on the company and most likely a decent one will never misuse your personal info, but of course not all of them, tokens issuing companies, can be called decent ones. The interesting part is that the less you will get from a bounty project the more chances your identity info will be misused. Try to participate in only good paying projects. But please don't get me wrong, I don't mean to participate in projects who promise to pay you a lot, I mean to work with those who really pay. Google the members of the team before participating in anything.