Respectfully, talk is cheap. Every company says they take security and privacy seriously even after their database has been breached and their customers' plaintext passwords and credit card details have become public information.

If you were actually serious about prioritizing privacy above securing an ongoing service relationship you would ship local inference as the default and only (possibly later) offer a cloud service as an optional add-on for those who want/need it.