Hacker News Reader

So how do they know if the response with the data a user requests, are all we've got about them, and if indeed where stored the proper way?

Generally they don't, until something happens that reveals the contrary. Like the Cambridge Analytica fiasco.

As far as I know, you pay for an audit yourself, and then you send them the results.

How difficult would be to pay auditor to close their eyes? Do you need another audit?

Sorry, I don't know the details.