A privacy policy is required as soon as you collect anything, which includes a contact form, an email signup, or analytics on your website. Several regimes require it, app stores require it, and advertising platforms require it before they will run anything. It must describe what you collect, why, who you share it with, and how somebody can ask for their data or its deletion. Copying one from another business is common and produces a document describing collection practices that are not yours, which is worse than a short accurate one.
Terms of service or terms of sale govern the relationship with customers: what you provide, payment terms, cancellation, refunds, limits on your liability, and how disputes are handled. For a service business this frequently sits inside your proposal or contract rather than on a page, and either is fine as long as it exists before the work rather than after. The refund and cancellation terms are the ones that get relied on, so they should say what you will actually do.
A contractor agreement is necessary from the first person you engage, and its most important function is assigning ownership of the work to you. Without a written assignment, the person who created the logo, the site, or the photographs retains the copyright, and businesses discover this years later when they want to modify something. It should also cover scope, payment, confidentiality, and termination.
A cookie policy and a consent mechanism become relevant if your site sets non essential cookies and you have visitors in jurisdictions requiring consent, which is most public websites once analytics is installed. This is frequently combined with the privacy policy rather than published separately.
Two more become relevant with growth rather than at the start. Employment documentation with your first hire, handled largely through a payroll provider. And data processing agreements with suppliers who handle customer information, which most established software vendors publish for you to accept.
This is general information rather than legal advice. The proportionate approach is to get a privacy policy and a contractor agreement in place immediately, since both apply from day one and both are cheap, and to treat the rest as triggered by specific events rather than as a checklist to complete before starting.