I find it quite amazing that you would publish a package that sends your documents to some webservice, and not say anything about data security, data protection, confidentiality, etc.

I'm sure you can point me to the relevant documentation. But it certainly doesn't have the prominence it deserves/requires by law.