Audit raises startling questions about what political campaigns do with your data