privacymodel