A lawyer. I would try contacting a local startup incubator to see if they have any recommendations before you start googling or looking up Avvo.

I also found Termly helpful for a first Privacy Policy especially through their wizard, which clears up all your GDPR/CCPA matters, but you want a professional to look this over at some point.