I think this applies to any business. Especially large companies like Xero and Stripe come to mind. They have huge data (more than we will ever have).
We have a privacy policy [1] that covers what we can/wont do with your data. We are an Australian based company, and we have fairly tight restrictions on privacy. We have to comply with National Privacy Principles (NPPs) and the Privacy Act 1988 (Cth) in Australia.