But if you want it literally states any data used FROM the API must have user accessible ways to remove from your app or use of the API. This person did NOT have that.
You are also not allowed to disclose user data used within your use of the API, I think sharing the data falls under that.