Well they have to host the servers and pay for them somehow... So they take all of your traffic going through their servers and sell it. They know when you go to any website, at what time, and how long you were there... That's why anyone recommending a VPN strongly recommends vpns that do not keep logs of what their clients do when connected to their servers. Even some paid vpns double dip and keep logs and sell them as well as charging for access.