Just as you trust the bank to guard your money, and many of their employees have access to your current account balance, the convenience of using these kind of services need you to trust the organization.
(sure, the bank could perform other tricks behind your back, like doing bad investments with the money you put in, but hey they'll get bailed out anyway...)
Luckily in the case of files you can easily do something about it, by encrypting them client-side or using a storage provider client that handles that for you.
cperciva is giving 2 examples: (1) use a service provider that doesn't require your trust. (2) limit the exposure of customer sensitive information to your employees that you must trust to keep it private.
I agree this is a better strategy than simply updating a privacy policy, as far as actual security is concerned.