Add IRB-relevant information

[jodeleeuw]

If people were going to use this to host an experiment, they would probably need to see a privacy policy specifically for DataPipe, so that they have something to show IRB folks that the data will not be used for any purposes and that it will be simpled passed through.

Providing information about OSF's storage limits https://help.osf.io/article/137-osf-storage-caps and privacy policy https://github.com/CenterForOpenScience/cos.io/blob/master/PRIVACY_POLICY.md. I'm not sure if OSF guarantees that they will not retain the files even after they are deleted.

This information could probably be consolidated to an IRB FAQ or privacy page.

From #46