Correct if I'm getting anything wrong:
Are you a turnkey solutions provider or are simply
supplying the software that enables businesses to set
up their own mobile stores?
If you are simply the software provider, then you ought
to have something in your own privacy policy that
states that responsibility for information privacy
rests with the businesses from which the end users are
purchasing. In which case, the businesses themselves
should provide their own privacy policy.
If you are handling the transactions and shipping
yourself (i.e., you are bypassing the businesses
themselves in this regard), then your privacy policy
should be sufficient, unless there is some way that
your clients can access the end users' information. If
that is the case, then you might be putting yourself at
risk.
Hope that was helpful.