If they don’t loudly promise to not scan or store requests they handle then I believe they already do it, or will.