Having read your privacy agreement, I don't see where the threat is existential if you are in breach. I think that the knowledge of engineers of the judicial system, both criminal and civil, is very naive. You can sue anyone over anything at any time - you don't need valid grounds. It also doesn't mean that if you win it matters.
Your privacy policy has lots of feel-good language that actually doesn't mean anything - along the lines of the classic "We value your privacy" statement that firms often make. When you analyze it, you find it means nothing. There are no actionable clauses. For example, if you are in breach of "Anonymous logs are aggregated with GCP's logging tools, retained for 30 days." what are the enumerated damages? A counter-party would have to prove show BOTH that you are in breach AND then real damages , which is difficult in this case, and entirely misses the point. E.g. if you sell 1M user data records for $.001 each, and a user has on average 10 records on them, the real damages are $.01, but your firm made $100k on the transaction. I don't see a limit to class action (or forced arbitration) so that's good; but good luck building out that class - especially since you'll resist sharing user data with the class action plaintiff, using the same privacy policy as a shield!
(This is the other trick of privacy agreements, apart from not actually saying anything: the stuff that is measurable is unenforceable).
It's time that the public stop seeing moonbeams and rainbows in these matters. Do you think that a lender will be satisfied with a debtor statement "I value paying back my debts, and will never be late!"? If not, then why are we mollified by similar statements by software firms made to us? What is measurable has no teeth; what has teeth is not measurable.
It's a very dirty trick.