The first step in creating your policy is to know exactly what information is being collected. In many cases, your site automatically logs things such as the visitors IP address, but other information may be gathered, as well. In addition to what is being collected, you should be aware of who has access to it and what they plan to do with that information. For example, some organizations choose to sell their visitors information in order to raise extra money. This practice is often frowned on by visitors and can be a major turn-off.