I wonder how privacy will be ensured when your query hits the map-reduce infrastructure running on these clusters.

Regarding privacy the bar is significantly higher than what Google has to deal with. This will come at some cost in quality and/or speed.