Reminder for any organization dealing with a Privacy Policy:
It's not the privacy policy that matters as much as your actual practices.
Your privacy policy *needs* to accurately and truthfully describe your practices. If it doesn't, you could get in a lot of legal trouble, even if you have "checkboxed" the privacy policy requirement.