To be honest this comes across a little defensive and a bit elitist. It is irrelevant if someone is paying customer or not, as you have no idea how much future

To be honest this comes across a little defensive and a bit elitist. It is irrelevant if someone is paying customer or not, as you have no idea how much future business they will do with your company, or what blogger or friend of the press she or he talks to at social gathering etc etc. A simple "Yup you're right privacy is important. Thanks for the headsup, we are gonna work on it!" would be a more effective response (assuming it's true). Or if that's not true then: "Well, we not sure if it's important but lets see if more users request it and if they pay us, then will probably look into it! :)"