Privacy policy should cover impersonal info too