Online Customer Acquisition under Privacy Constraints: A Query-Based Targeting Policy