Privacy Policy
Last updated: September 7, 2026
1. Who is responsible
This Privacy Policy explains how GetPolisha, operating as GetPolisha Verdict ("we," "us," or "our"), collects, uses, discloses, and protects personal information through verdict.getpolisha.com and related services.
Our privacy contact is our Privacy Officer, Cambridge, Ontario, Canada, hellopolisha@outlook.com. Questions, requests, and complaints may be directed to that contact. Support is provided by email only.
2. Information we collect
Depending on how you use Verdict, we may collect:
- account and contact information, such as email address, authentication identifiers, and account preferences;
- career and application information contained in uploaded resumes, CVs, job descriptions, instructions, and generated documents, including employment history, education, skills, and contact details;
- purchase and transaction information, such as package, amount, currency, receipt, transaction status, and limited payment metadata received from Stripe;
- service-use and technical information, such as IP address, device and browser information, timestamps, security events, diagnostic logs, and interactions with the Service;
- support communications and information supplied in privacy, deletion, billing, or complaint requests; and
- inferences and generated information, such as match scores, verdict categories, identified strengths or gaps, and AI-generated career-document text.
Please avoid including sensitive personal information that is not necessary for a resume analysis, such as government identification numbers, financial account details, medical information, or information about other people.
3. How we collect information
We collect information directly from you when you create an account, upload materials, enter text, purchase a package, contact support, or exercise a privacy right. We also collect limited technical information automatically when the Service operates. Stripe and our other service providers may send us transaction, authentication, security, or delivery information needed to provide the Service.
4. Why we use information
We use personal information for purposes a reasonable person would consider appropriate in the circumstances, including to:
- create and manage accounts;
- receive and process resumes, CVs, and job descriptions;
- generate match analysis, verdicts, and rewritten career documents;
- deliver purchases, receipts, and downloadable files;
- process, reconcile, and support payments and refunds;
- authenticate users, secure the Service, and prevent fraud or abuse;
- provide customer support and respond to requests or complaints;
- diagnose failures, maintain reliability, and improve the Service using appropriately limited information;
- comply with law, enforce agreements, and establish or defend legal claims; and
- produce aggregated or de-identified information that is not reasonably capable of identifying an individual.
We do not use your CV content or job description content to build, train, or improve any public or third-party AI model, and we do not sell your data.
5. AI processing notice
When you request an analysis, relevant content from your resume or CV, the job description, and your instructions is sent to Anthropic's Claude API so the AI model can generate the requested analysis and documents. The resulting output is returned to Verdict and may be stored in your account according to the retention schedule below.
Generative AI is probabilistic and can produce inaccurate or biased output. Verdict does not use the output to make an employment decision about you, and employers do not receive your information from Verdict unless you choose to provide it to them.
Under Anthropic's standard commercial API terms, API inputs and outputs are not used to train Anthropic's publicly available models. We have not independently confirmed the exact data-retention period, processing region, or contractual specifics of our particular Anthropic account beyond that general policy; we will update this section if we confirm account-specific terms that differ from it.
6. Consent and choices
We seek consent where required and identify the purposes for collecting, using, or disclosing personal information at or before collection. By choosing to submit a resume, CV, and job description for analysis after receiving the upload notice, you request and consent to the processing needed to provide that analysis, including transfer to the service providers described below.
You may withdraw consent to future optional processing by contacting us, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may prevent us from continuing to provide features that require the information. Withdrawal does not require us to reverse processing already lawfully completed.
7. Service providers and transfers
We use service providers to operate Verdict. They process information for the purposes described below. We remain accountable for personal information transferred to processors under our control and use contractual or other safeguards appropriate to the service.
| Provider | Purpose | Information | Location |
|---|---|---|---|
| Anthropic | AI analysis and generation | Relevant CV, job description, instructions, and output | Not independently confirmed for this account — see AI processing notice above |
| Stripe | Payments, refunds, and fraud prevention | Contact, transaction, and payment metadata; card data is handled directly by Stripe | May process outside Canada; Stripe is a PCI-DSS-compliant payment processor |
| Supabase | Database, authentication, and file storage | Account, uploaded, and generated technical data | United States (Ohio) — confirmed for this deployment |
| Vercel | Hosting, delivery, security, and logs | Web requests, technical metadata, and content handled by application routes | United States (default deployment region) — confirmed for this deployment |
Personal information may be processed outside Canada and may be subject to the laws and lawful access processes of the jurisdiction where it is processed. Contact our privacy contact for information about relevant service-provider practices.
8. When we otherwise disclose information
We may disclose personal information:
- with your direction or consent;
- to service providers acting for the purposes described in this policy;
- where reasonably necessary to complete a business transaction such as a financing, reorganization, merger, or sale, subject to confidentiality and lawful handling requirements;
- to comply with law, court orders, or lawful requests;
- to investigate fraud, security incidents, or misuse; or
- to establish, exercise, or defend legal claims.
We do not sell personal information. We do not disclose user resumes or generated documents to employers unless the user chooses to do so.
9. Retention and deletion
We keep personal information only as long as necessary for the identified purposes and legal obligations described above, then delete it from our active systems or de-identify it, on the following schedule:
| Record | Retention |
|---|---|
| Uploaded CVs, job descriptions, analyses, and generated documents | Retained while your account is active; deleted from our active systems within 30 days of account deletion |
| Account profile | Removed as part of account deletion itself, which you can request at any time — see below |
| Temporary files created while processing an upload | Deleted automatically once processing completes, or promptly if an upload fails or is abandoned |
| Backup copies held by our infrastructure providers | Removed through the normal backup cycle, within 90 days |
| Security and diagnostic logs | 12 months |
| Customer support and feedback records | Up to 24 months after the matter is closed |
| Payment, refund, accounting, and tax records | Seven years, or longer where legally required — never deleted on account deletion, see below |
| Properly de-identified information | May be retained for security, reliability, and statistical purposes once it can no longer reasonably identify you |
You can remove your data whenever you choose. You may delete individual reviews at any time from your dashboard. You may permanently delete your entire account, including your uploaded CVs, job descriptions, analyses, generated documents, and your login itself, at any time from Account settings, or by contacting us.
What we keep even after you delete your account, and why. Records of a payment, refund, or transaction (amount, date, product, and status — never your CV content) are not deleted when you delete your account, because we are required to keep accounting and tax records for several years. Instead, these records are detached from your account and name at the moment of deletion, so they can no longer be linked back to you, while still satisfying that legal retention requirement.
Deletion from our active systems may not immediately remove information from encrypted backups. Backup copies are isolated from ordinary use and expire according to the backup cycle above, unless retention is required by law or for a documented legal claim. We do not control retention on Anthropic's side beyond the terms described in the AI processing notice above.
10. Cookies and similar technologies
Verdict uses only the strictly necessary session cookie required to keep you signed in, managed by our authentication provider, Supabase Auth. We do not use any other cookies, browser local storage for tracking purposes, or third-party analytics or advertising technologies. If optional analytics, advertising, or other non-essential tracking is introduced, we will update this policy and implement any notice or consent mechanism required by law before enabling it.
11. Safeguards
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, such as access controls, encryption in transit, service-provider controls, logging, backups, and procedures for responding to suspected incidents. No method of transmission or storage over the internet is completely secure, so we cannot guarantee absolute security.
We restrict access to personal information to people and providers who need it for authorized purposes and require appropriate confidentiality and security obligations.
12. Privacy incidents
We maintain procedures to assess and respond to suspected loss of or unauthorized access to personal information. Where required by law, we will notify affected individuals and the appropriate regulator and will maintain required breach records.
13. Your rights
Subject to applicable law and appropriate identity verification, you may ask to access personal information we hold about you, understand how it has been used or disclosed, correct inaccurate information, withdraw consent to future optional processing, or request deletion of information we are not required to retain.
Send requests to hellopolisha@outlook.comwith the subject line "Privacy Request." We may need information to verify your identity and locate records. If we refuse a request in whole or in part, we will explain the reason where required and identify available complaint options.
14. Children
Verdict is intended for adults and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can investigate and take appropriate action.
15. International users
Verdict is operated from Ontario, Canada. If you use the Service from another jurisdiction, your information will be processed in accordance with this policy and may be transferred to Canada and the processing locations of our service providers described above. Local law may provide additional rights. We do not claim compliance with a foreign privacy regime unless expressly stated.
16. Changes to this policy
We may update this Privacy Policy to reflect changes to the Service, our service providers, law, or privacy practices. We will post the updated policy and effective date. If a change is material, we will provide reasonable notice and seek consent where required.
17. Questions and complaints
Contact our Privacy Officer at hellopolisha@outlook.com, or Cambridge, Ontario, Canada. We will investigate and respond to privacy questions and complaints within a reasonable time. You may also have the right to contact the Office of the Privacy Commissioner of Canada or another applicable regulator.