Privacy Policy

1. Who we are

Polisha is a one-person service business operated by Tobi Aina (Oluwatobi Aina Kayode), based in Ontario, Canada. We sell a small catalogue of paid, asynchronous digital services for jobseekers: Polisha Inbox ($39), Polisha LinkedIn ($69), Polisha Resume ($79), Polisha Visibility ($89), Polisha Applications ($129), Polisha Complete ($149). Everything is delivered through https://getpolisha.com and by email.

Tobi Aina is personally responsible for handling your information. There are no employees, no subcontractors and no data-broker relationships. Privacy questions and requests go to hellopolisha@outlook.com

2. What this policy covers

This policy covers every package we sell, whether bought individually or as a bundle. Because the packages do different work, they need different information. Three of them are pure document work, Polisha Resume, Polisha LinkedIn and Polisha Applications bundle, and involve no account access of any kind. Only packages that include Polisha Inbox involve access to an email account.

Important: If your package does not include Polisha Inbox, we never ask you for a password, a credential or access to any account. There is no password field on the intake form for you at all.

3. What we collect, and how it varies by package

We collect only what we need to deliver the package you paid for. Some information is collected for every order:

• Your name.
• Your email address.
• Your phone number, if you choose to give it, this is optional.
• Your city and country, so we can position you for the right job market.
• Which package you bought.
• Order and payment metadata from Stripe: the amount, the currency, the date, the last four digits of your card and whether the payment succeeded.
• Basic technical data from our host, such as IP address and browser type, used for security and to keep the site running.

For resume work, Polisha Resume, and any bundle containing it, we also collect:

• Your existing resume or CV, as a file or a link.
• Your one target role, and your target industry and seniority.
• A sample job description for that target role, if you have one.
• Any achievements, dates, employers, qualifications or certifications you want reflected.

For LinkedIn work, Polisha LinkedIn, and any bundle containing it, we also collect:

• Your LinkedIn profile URL, and your profile content as it appears to us.
• The job titles you want to be found for.
• Your positioning preference, how you want to be described, and what you want emphasised or left out.

For inbox work, Polisha Inbox, and any bundle containing it, we also collect:

• Your email provider (Gmail or Outlook) and the address of the single mailbox to be organized.
• The approximate size of that mailbox, so we can tell you where the work will reach.
• Protected senders, people and organizations whose mail must never be filtered, archived or unsubscribed.
• The permissions you are granting: which folders or labels you want, which mail should be filtered, which lists you want unsubscribed from.
• A Bitwarden Send URL, an encrypted, expiring link you create yourself, which contains the temporary password for that mailbox.

We do not ask for the inbox items on a resume-only or LinkedIn-only order, and we do not ask for a resume file on an inbox-only order.

4. What we never collect

Some things we deliberately do not ask for, do not want and will not accept, on any package. If you send them anyway, we will delete them and ask you to change the credential.

• Permanent passwords of any kind.
• Passwords typed into an ordinary form field, sent by email, WhatsApp or SMS. The intake form has no password field.
• Your LinkedIn password. We never log into your LinkedIn account, your LinkedIn content is delivered to you as a document you paste in yourself.
• Recovery email credentials, recovery codes or two-factor backup codes.
• Banking, payment-app or investment passwords.
• Government or immigration account passwords.
• Social media passwords.
• Your SIN, passport number or any government identification number.
• Full payment card numbers. Stripe processes payments and stores card data on its own systems. We never see or hold your full card number, expiry or security code.

Important: The only credential we ever receive, on any package, is a unique temporary password for the one email account you asked us to organize, created by you, shared only through an encrypted Bitwarden Send link that expires on its own, and deleted by us as soon as the work is finished. Packages without inbox work involve no credential of any kind.

5. How we use your information

We use your information for these purposes and nothing else:

• To rewrite your resume in an ATS-friendly format, tailored toward the one target role you gave us.
• To audit and rewrite your LinkedIn profile content.
• To organize the one email inbox you nominated, in the way you asked for, folders, labels, filters, job alerts and application updates.
• To take payment and issue receipts.
• To send you transactional email about your order: confirmation, questions, delivery and the completion notice.
• To carry out the revision included with your package, if you request it.
• To keep basic business records, including tax records we are required by law to retain.

We do not sell your information. We do not rent, trade or share it for advertising. We do not add you to a marketing list without your clear consent, and if you do opt in you can leave at any time.

6. Temporary email access and encrypted credentials

This section applies only to packages that include Polisha Inbox. Inbox organization requires access to your inbox, and we handle that with the narrowest, shortest-lived arrangement we can:

1. You create a unique temporary password on your email account, one you have never used anywhere else.
2. You put that temporary password into a Bitwarden Send, set it to expire, and paste only the resulting Send link into the intake form.
3. We open the Send once, use the temporary password to sign in, and do only the organization work you authorized.
4. When the work is done, we sign out, remove the account from any device or client used, and delete the credential and the Send link.
5. We email you a completion notice. You change the temporary password immediately and sign out other sessions.

The contents of your encrypted Send never appear in email notifications, analytics events, server logs or our order tracker. Our internal order record stores only that a Send link was received and, later, that the credential was deleted.

If you bought Polisha Resume, Polisha LinkedIn or Polisha Applications bundle, none of the above happens. Those packages are delivered entirely as documents and we never hold a credential for you.

7. Third-party services we use

We use a small number of established providers to run the business. Each receives only the information it needs, and each has its own privacy policy.

• Stripe, payment processing. Receives your name, email and card details directly. We receive only the order metadata described above.
• Tally, the intake form. Receives your form answers, including any resume file and, on inbox packages only, the Bitwarden Send link.
• Resend, or an equivalent transactional email provider, sends order and delivery emails. Receives your name, email address and the message content.
• Vercel, website hosting. Receives standard request data such as IP address and browser type.
• Google Analytics, optional, anonymous usage measurement. Enabled only if we have switched it on.
• Meta Pixel, optional advertising measurement. Enabled only if we have switched it on.

We do not give any of these providers access to your inbox, your temporary password or your Bitwarden Send contents.

8. Analytics and cookies

If analytics are enabled, they measure anonymous, aggregate behaviour only: which pages were viewed, which package cards were clicked, roughly where traffic came from. Events carry no personal detail.

Analytics and advertising tools never receive your resume, your form answers, your credentials, your Bitwarden Send link, your inbox contents or anything we write for you. That data path does not exist on this site.

Cookies: the site sets essential cookies only, the ones needed for the checkout to work and the pages to load correctly. Optional analytics or advertising cookies are set only where those tools are enabled. You can block or delete cookies in your browser at any time; the essential parts of the site will still work.

9. How long we keep your information

• Temporary passwords and Bitwarden Send links: deleted immediately once your work is complete. We do not archive them.
• Resumes, LinkedIn drafts, intake answers and working notes: kept for up to 90 days after delivery so we can handle your revision or a follow-up question, then deleted. You can ask us to delete them sooner and we will.
• Inbox preferences and protected-sender lists: deleted with the rest of the working notes, on the same 90-day schedule.
• Order and delivery emails: kept for the period required for business and tax records.
• Payment records held by Stripe: retained under Stripe's own retention rules, as required for financial compliance.
• Anonymous analytics data: retained under the settings of the analytics provider, and not linked to you.

10. Where your information is stored

Several of our providers, including Stripe, Vercel, Tally and our email provider, are based in the United States or store data on servers outside Canada. This means your information may be transferred to, processed in and stored in another country, where it can be subject to that country's laws and lawful access requests.

We choose established providers with published security practices and standard contractual protections. If you are not comfortable with cross-border processing, contact us at hellopolisha@outlook.com before you order.

11. Your privacy rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and any equivalent provincial law that applies to you, you have the right to:

• Ask what personal information we hold about you and get a copy of it.
• Ask us to correct information that is wrong or out of date.
• Ask us to delete information we no longer need to keep.
• Withdraw your consent to our handling of your information, subject to legal and contractual limits.
• Ask how we handled your information and who we shared it with.
• Complain to us, and then to the Office of the Privacy Commissioner of Canada if you are not satisfied.

To exercise any of these rights, email hellopolisha@outlook.com We will confirm your request within a few business days and respond within 30 days. There is no charge. If we cannot do what you asked, for example, where a tax record must be kept, we will tell you why.

12. Security and breach notification

We keep the amount of sensitive data we hold as small as possible, because data that does not exist cannot be exposed. That is the reason most of our packages need no credential at all. Where a credential is genuinely required, it arrives encrypted, lives briefly and is deleted. Files are stored on password-protected, up-to-date devices and accounts secured with two-factor authentication.

No system is perfectly secure. If a breach occurs that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible. Our notice will describe what happened, what information was involved, what we have done, and what you should do, starting with changing any affected password.

13. Children's privacy

These services are for adults. They are not directed at anyone under 18 and we do not knowingly collect information from minors. If you believe a minor has submitted information to us, email hellopolisha@outlook.com and we will delete it.

14. Changes to this policy and how to contact us

If we change this policy, we will update the date at the top of the page. If a change materially affects how we handle your information, we will also email customers with an active or recent order before it takes effect.

Privacy questions, access requests and deletion requests: hellopolisha@outlook.com Anything else about your order: hellopolisha@outlook.com

15. Not legal advice

This document was prepared as a practical draft for the convenience of the business owner. It is not legal advice and does not create a lawyer-client relationship. It should be reviewed and adapted by a qualified lawyer in Ontario, Canada before the service goes live.