Your data is not the product.

We collect the absolute minimum to run a job board: the things you type into an application or sign-up form, and the basic technical data your browser sends to ours. We do not sell your information. We do not share your inbox with recruiters. We do not run third-party advertising trackers.

BisBig Jobs is operated by Leafy Code International (Pvt) Ltd, a company registered in Sri Lanka. Our registered office is at 2nd Floor, 269, 1 High Level Road, Pannipitiya 10230, Sri Lanka. You can reach our team at hello@bisbig.com.

Account details

Your name, email, and a hashed password when you create an account. We use this to sign you in and to attach the applications you've already submitted with the same email.

Application content

Anything you type or upload into an application — CV, cover note, answers to employer-defined questions, optional video answer. The hiring company you applied to can see this. We can see it for support and abuse prevention.

Portfolio content

If you build a public candidate profile (the /p/your-slug page), the content you publish there is public by design. You control what goes up and you can take it down or unpublish at any time from /me/portfolio.

Saved searches and alerts

If you save a search, we keep the filters so we can email you matches. One match, one email — never digests.

Technical data

Standard server logs (IP address, browser type, pages visited, timestamps) for security and basic analytics. Retained for 90 days.

• To run the service. Without your application content there's nothing to send to the employer.
• To keep you signed in. A first-party session cookie on api.bisbig.com that expires when you sign out.
• To tell you the outcome. Status updates on roles you applied to — never marketing.
• To prevent abuse. Rate limiting, spam filtering, and fraud detection.

When you apply to a role, the company that posted the role sees your application content. That's the whole point. Other companies on the platform do not see your applications, your email, or your search history.

When you publish a portfolio page, anyone with the link can see it. We do not surface it to search engines unless you toggle it public.

We use a small set of first-party cookies — a session cookie so you stay signed in, and a theme cookie so dark mode sticks. We do not run third-party advertising or behavioural-tracking pixels.

We may use a privacy-respecting analytics tool to count page views, but it does not set tracking cookies or sell data on.

We use a handful of vendors to keep the service running:

• DigitalOcean — hosting and managed PostgreSQL (data residency: Singapore).
• Amazon SES — transactional email (verification, password reset, application status).
• Cloudflare — CDN and DDoS protection.

We don't add vendors lightly. If we engage a new one that handles personal data, we'll list them here.

• Applications — kept until you delete your account or the hiring company closes the role, whichever comes first. Closed applications are anonymised after 24 months.
• Account data — kept while the account is active. Delete it any time from /me.
• Server logs — 90 days.

You can access, correct, export, or delete your data at any time. Most of it is one or two clicks from /me. If a control you need isn't there, email hello@bisbig.com and we'll handle it within 30 days.

If you're in a jurisdiction with statutory data rights (GDPR, UK GDPR, CCPA, Sri Lanka's PDPA), those rights apply. We'll honour them even if you're not.

BisBig Jobs is for working-age adults. We don't knowingly collect information from anyone under 16. If you think a child has signed up, tell us and we'll remove the account.

If we change anything material, we'll bump the "last updated" date at the top and — for any change that materially expands what we collect — email registered candidates before the change takes effect.