Who should really own your data?