@ Lee D
Go and read the M/S T&Cs. Look for anything that limits what they can grab under your agreement with them. It looks reasonable that they'd need your login credentials with themselves. But do they restrict themselves to saving those or do they include the right to capture anything else such as your bank login creds, your Amazon creds, your eBay creds....? Last time I looked there was no limit to what you'd have to agree to. Same thing about transactions: it's reasonable they'd keep their transactions with you but the language doesn't limit them to that. If they capture all you bank transactions, there'd be no problem because you'd agreed to that as well.