Your boss’s monitoring app didn’t just watch you — it shared your data to Facebook and a Russian search engine