Hacker News Reader

They can not access your private repositories if you are just in the organization.

Right, I’m wondering from a legal perspective if they do

if you're worried about legal, go for separated accounts.