When a company says:
"We don't track", and our application is on a third-party cloud platform.
Is it true to say, their users' data are still trackable. The company might not track at all, however their cloud provider might; and have the ability to do so if they wanted.