A company talking big about privacy generally comes across as dishonest, and you'd have to get all the details right to avoid unleashing the Internet's wrath. It looks like you screwed up between the server logs and Cloudflare. Unfortunate, but it seems to me that it reflects a lack of experience more than ill intent (I do not have such experience myself either.)

Honest question, but did you add the Cloudflare proxy to solve an actual problem, or did you deploy it a priori without an actual justification?