Well spotted. Cloudflare at least should be mentioned as they can collect IP addresses which are PII. They also load scripts from Google, again exposing, at a minimum, IP addresses.

There is a reference to their cookie policy but to link to it.