That's the reason why i'm very hesitant in using my ID for verification of KYC, I don't know where my personal info. will go to, the dev. also don't say a word what they will do in the info they gathered. Such is the reason why i'm avoiding campaign that requires KYC.
I only pass verification on cryptocurrency exchanges that have a good reputation, because this opens up the opportunity to use additional services. I consider it very dangerous to pass KYC to get tokens in bounties and airdrops. I believe that normal projects should not require verification if you are not an investor.