I don't think this qualifies for a flag unless they explicitly stated the info would be kept private. It is definitely shitty behavior and should be brought to people's attention though so they can avoid these projects if they take issue with this. Thanks for bringing attention to it.
Even if his customer keeping data still private, i think its still break our privacy. i think for newbie member it can be a big problem like malware or phishing email he receive if customer of coinwriter using his data to spread malicious program.
I completely agree. However due to the nature of this type of activity as well as the likely customer base, a flag wouldn't accomplish anything even if you think it is justified. Apparently the mods found that offering the BCT database was grounds for removal of the post, which is because that info was illicitly obtained even though it is publicly available on the web now due to past hacks. Flagging users like this is like throwing ice cubes at the sun. Make posts like you have done here to raise awareness. Leave the trust system for documenting objective evidence of fraud.