That's nice. How can a user verify whether they fully comply with those contracts?

They have every incentive not to, and no oversight to hold them accountable if they don't. Do you really want to trust your data is safe based on a pinky promise from a company?