Privacy boundaries tested as start-up promises humans will only be added to database with their consent - apart from the celebs it added without their consent, that is