I recently went through this process and paid a law firm to do this. I saved a fair bit of cost by writing the terms and privacy policy myself first (based on other examples around on the web) and then getting them to adjust it rather than start from scratch.