They can see where you go. Could read inbound and outbound email.

Hope this is clear enough.