If you look at their transaction history with your service, it's not just their data, it's also yours and you have every right to look at it.

Now what's morally ambiguous is then deciding to reveal that data to others, and if you did it indiscriminately for all customers I'd be against it. But on a small scale, I don't think it's so wrong.