> if you send a company your unencrypted data

There is no need for this data to be sent unencrypted. Encryption could be handled completely on the client side.