Shortest privacy policy you can think of

This seems like a worrisome idea. For example, in the event of an acquisition, is the company legally obligated to destroy all customer records, because they will not "sell it to anybody"?