using private prefix for service callout policy request variable

[#1]

We are using ServiceCallout Policy in the request flow, as some of the fields in request payload contains sensitive data so using private prefix for the request to hide the contents in Trace session. But somehow the contents of private.myRequest.content is not getting hidden. Also tried masking the entire private.myRequest.content using API Call even that didn't work. Please help.

Attached is the ServiceCallout policy that is used.

<ServiceCallout async="false" continueOnError="false" enabled="true" name="SC.ACN">
    <DisplayName>SC.ACN</DisplayName>
    <Properties/>
    <Request clearPayload="false" variable="private.myRequest">
        <Set>
            <Headers/>
            <Verb>POST</Verb>
            <Path>/acn</Path>
            <Payload contentType="application/json" variablePrefix="@" variableSuffix="#">
                {
                  	"name": "@cardholdername#",
                  	"creditcardnumber":"@private.creditcardnumber#",
                  	"addressline1":"@streetAddress1#",
                  	"addressline2":"@streetAddress2#",
                  	"city":"@city#",
                  	"state":"@stateOfResidence#",
                  	"zipcode":"@zip5#",
                }
            </Payload>
        </Set>
        <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
    </Request>
    <Response>calloutResponse</Response>
    <LocalTargetConnection>
        <Properties>
            <Property name="success.codes">2XX,3XX,500</Property>
        </Properties>
        <Path>/target/v1</Path>
    </LocalTargetConnection>
</ServiceCallout>