It might be worth writing a privacy policy to this effect. It would then be worth examining the claim; for example, could this information be found in request logs? You know and trust your intentions but strangers do not.