Dan Marchant is absolutely right, of course, and I would not contradict his advice, but if it was my start-up business, and I probably didn't have a lot of money to begin with, I'd borrow the privacy policy from another similar website - with appropriate wording changes, after all, you should understand any policy you have on your website, and make a note to self to review this question in six months time. If you are starting-up focus on making a sale - everything else is a distraction. Good luck!