The weird things is that he is only passing text and “Get Contact results” is not a thing in DB. So technicaly he can’t apply privacy rules here.

I just tested passing simple list of texts and it works for me . If you @k.richter confirm that it works for you by passing the list of texts manually (e.g. through multidropdown) then I would assume that this is a bubble bug with passing the data from Get call.