As a rule of thumb, if you think you've found a convenient way around needing an NDA... you probably haven't. ;-)

The log of the list of queries would also be covered under the privacy policy. The log contains arbitrary, free-form user input and therefore is treated as containing personally identifying information until proven otherwise. You're correct that aggregates (like the ones that you're after) are generally fine to release publicly, but the person creating those aggregates would still need an NDA.

I'm sorry for the inconvenience. The Wikimedia Foundation tries its hardest to safeguard user data, which can sometimes complicate processes like this as they're designed for maximal user safety and privacy rather than convenience.

Hope that helps,

Dan