As to data privacy, if one of your customers is on a reservation then you really should check to see what the data rules are for that reservation. Making an assumption that only the state and/or federal rules are in effect could be costly.