The privacy policy is also a legally binding document, not just a promise that the company does. If they are found violating it, the GDPR fines are going to hurt and they would lose the customer base in a blink. Their privacy policy right now is exemplary, I am one of those who read policies before using a product and kagi’s is literally the best I have seen: clear, detailed, specific and most importantly, good from the privacy perspective.