Use an object for privacy level models

This makes the association between the level key name and the display
text explicit and tight in the code.