You are right in suspecting and requiring a Privacy Policy. You are NOT supposed to have implicit faith on ANY website, including IRI. Bills and expenses are a fact of life, and all websites need to make ends meet. Exploiting user private info is one way to generate revenue. Other ways of doing so is to cross-subsidize operations - for example, Google uses Search revenue to cross-subsidize all of its other businesses. Social media sites like FB have more than 25000 very highly salaried employees, and they cannot meet their expenses and be profitable, if they don't exploit user private info.
.
IRI...
more... Privacy Policy is available here
IRI Privacy Policy It is not as elaborate as you would find for FB, Google and other important sites, but it addresses the basic points.
.
Thanks.