Publishing a website privacy policy is now standard practice. But assuming that a single, generic policy covers everything is inherently risky.