privacy assessment from the old webapp