What can someone access on my iPhone if they set up their iCloud account on my device?
You can not remove their iCloud account without their password. 
The can access everything you allow to synchronise with their iCloud account. 
You can turn off all iCloud settings except Find My iPhone without their password. 
They can also lock your iPhone and or erase your iPhone. 


So basically the can find your iPhone at any given time. 

When your transaction is done make sure they remove their iCloud account completely!