Whether or not you're paying has no bearing on whether you are or are not the product.
That has a lot more to do with the people in charge of the product and how big the company is.
A tiny open source hobby project may be free AND not sell your data. A company that sells you a product may also sell your data for Two Money. There's not actually a correlation between whether you're paying and whether your data gets sold anymore.
Honestly I think this idiom was pretty true at one point. That point is long gone because now everyone knows how lucrative selling user data is. Everyone that can get away with it will sell it. Unless, like some small dev with some tiny app on GitHub they do as a hobby, they aren't in it to make any money at all. But if you're a business and in the business of making money, you wanna make Two Money. And if you say you don't want to make Two Money, you might later decide to make Two Money, or sell to someone who wants to make Two Money. The only way to avoid Two Money is to use software that doesn't have data of yours to sell in the first place, which is extremely difficult. But you can't take this on faith alone.
Honestly I think this idiom was pretty true at one point. That point is long gone because now everyone knows how lucrative selling user data is. Everyone that can get away with it will sell it. Unless, like some small dev with some tiny app on GitHub they do as a hobby, they aren't in it to make any money at all. But if you're a business and in the business of making money, you wanna make Two Money. And if you say you don't want to make Two Money, you might later decide to make Two Money, or sell...