Ready-to-paste privacy policy for your site — 100% free, runs in your browser
A privacy policy is required if you collect any personal data, and payment gateways will not approve a site without one. This generates a standard policy covering the usual bases, which you should then adapt to what you actually do.
It covers the standard clauses, but it is a template, not legal advice. If you handle sensitive data or serve users abroad, have a lawyer review it.
If you use analytics, contact forms or advertising, you are collecting data, so yes.
In the footer of every page. Payment gateways check for exactly this during review.