“How do you continuously improve a critical system—like search—when you're not allowed to look at any of the user data that powers it?”