Adding a privacy policy to a website is mostly a publishing task, and the part that fails is not the page. It is the linking: a policy that exists at a URL nobody reaches has not been conspicuously posted, and a policy linked only from the footer has not been given to the person at the moment they hand over their data. Both of those are separate duties from having written it.
One: write it about your own site
Whatever you start from, the categories collected, the purposes, the recipients, the retention and the rights route have to be yours. The fastest honest route is to list every tool that receives personal data, which is usually more than expected, and write the recipient section from that list. Everything else on the page follows from it.
Two and three: a stable URL, linked where a person looks
Publish at a path that will not move, conventionally a privacy page at the root, and link it from the footer of every page using the word privacy. California's online privacy law requires the policy to be conspicuously posted, and names an icon or a link containing the word privacy as the ways of doing it. A link that moves breaks every record that pointed at it, including consent records, which is why the URL is worth choosing once.
Four: link it at the point of collection, which is the step people skip
Beside the newsletter box, beside the contact form, at the checkout, next to the account sign-up. California's consumer privacy statute requires a notice at or before the point of collection setting out the categories and the purposes, and a footer link at the bottom of a long page does not discharge it. A short line beside the field, linking to the full policy, is enough and reads better than a paragraph of statute.
Five: date it, and diary the review, which is the other step people skip
Put the effective date at the top where people look for it rather than the bottom. Describe how you notify changes, which the older California law requires. Then set the review: a business in scope of the consumer privacy statute updates its policy at least once every twelve months, and every business should revisit it whenever a tool that receives personal data is added or removed, which is the event that actually falsifies it.
Other questions people ask
Where exactly should the link go?
The footer of every page, the point of every collection, and, for an app, the store listing. Those three cover the conspicuous posting duty and the notice at collection duty between them.
Can I use my platform's generated policy?
As a skeleton. It describes the platform's standard processing and cannot know which apps, pixels and tools you added, which is exactly the part a reader cares about.
Does the page need to be indexable?
It should be reachable and readable, and there is no reason to hide it from search. People do look for a company's policy directly by name.