I think start-up culture tends to be a bit unethical - we favor expedience and results over rules and regulations, and that's generally correct, but also leads us into murky territory.
The most important guideline might be this - build a company where you'd want to have any of the jobs, and where you'd want to be a customer. But specifically:
1) never send someone an email without explicit opt-in (make them check a box, don't start spamming just because they registered).
2) make it easy for a user to delete themselves from your database, entirely
3) make it easy for a user to port data elsewhere
4) don't make up fake email personages, or otherwise overtly lie to your customers
5) don't use misleading numbers for marketing or fundraising
6) give employees warning and/or severance when you plan to fire them
7) don't discriminate based on gender or sexual preference, even though it may be legal for small companies to do so in your locality
8) if you store financial or sensitive data, make security a priority