I just read the whole Nearby card. Why is "OSM privacy situation is a bit of a mess?" OSM only knows that you're taking a copy of their database. No secret there, no PII problem, nothing. You're going to be writing your own tile set and serving them off your own servers using your own privacy policy. So I'm confused as to why this question of "OSM privacy" is even coming up.
I'm also confused about why you would even consider Google Maps. You're not going to be hosting their tiles, their tiles will be fetched directly from Google by users and they'll be subject to Google's privacy policy. Simply a non-starter.