The current version of the API, known as the ESI, give access to most of your character info to a program or other person you allow access to. That includes your assets, location, communication, contacts, kill history and skills and probably more. They also have ongoing access and can see what you do in the future if you don’t revoke access that is. You can restrict what info is shared, but if we are talking a corporation asking for access for security, they usually ask for it all.
They cannot get any info on your account or other characters. That was possible in a previous version of the API you might find referenced out there, but the ESI is based per character only and there is no way for them to see your other characters or account info. They won’t be able to “hack” or get your real email address unless you sent it in an evemail or something else really dumb.
They might be able to infer things looking at transactions or mails or something else on the character you shared with them, but otherwise the ESI is strictly per character now.