Jobxy

Legal

Privacy Policy

Last updated: 24 July 2026

This policy explains how JOBXY PTE. LTD.("Jobxy", "we", "us") collects, uses, discloses and protects your personal data when you use the Jobxy platform at jobxy.sg. We are a company incorporated in Singapore, and we handle personal data in accordance with the Personal Data Protection Act 2012 (PDPA).

1. What we collect

Everyone who creates an account

  • Your full name and email address
  • Your password, which is stored only as a one-way bcrypt hash - we never store or have access to your actual password

Workers who apply for a job

Browsing jobs requires none of the below. We ask for it only when you first apply for a job, because employers need it to hire and pay you:

  • Date of birth (you must be at least 18)
  • Residential address - block and street, unit number, postal code
  • Mobile number, and your PayNow mobile number if it differs
  • NRIC or FIN number - required to verify your right to work in Singapore
  • Bank name and bank account number - so employers can pay you
  • Nationality (Singaporean, PR or foreigner)
  • A profile photograph
  • Your uniform or attire size
  • Optionally, a resume and an emergency contact name and phone number

Employer and company staff accounts

Employer accounts hold only a name, email address, hashed password and an optional profile photograph. We do not collect NRIC or bank details from employer accounts.

Collected automatically

  • Your IP address, used to rate-limit requests and protect the service against abuse and brute-force login attempts
  • A record that a job listing was viewed, used to give employers aggregate view counts. Views by signed-out visitors are not linked to any person
  • Standard web server logs
  • Authentication cookies - see our Cookie Policy

We do not use advertising or third-party tracking cookies, and we do not track you across other websites.

2. Why we collect it

We use your personal data only for the purposes you gave it to us for:

  • To create and secure your account, and to sign you in
  • To show you relevant job listings and let you apply for them
  • To let employers assess your application, hire you, schedule your shifts, and pay you for work you have done
  • To let employers you work for manage their crew, rosters and worked hours
  • To send you email that relates to your account or an action you took (see section 4)
  • To keep the platform secure, prevent abuse, and meet our legal obligations

We do not use your personal data for any unrelated purpose without asking you first, and we do not sell it. We hold no marketing list, and we do not buy, rent, or share contact lists with anyone.

3. What employers can see about you

This is the most important section for workers, so we set it out plainly. What an employer sees depends on how far your application has progressed:

  • Before they accept you - the employer sees your name, profile photo, nationality and attire size. Your NRIC and bank account number are shown masked (for example S••••567D), and your date of birth, address, phone numbers and emergency contact are withheld entirely.
  • Once they accept you - because they now need to hire and pay you, the employer can see your unmasked NRIC and bank account number, along with your date of birth, address and contact numbers.
  • If you withdraw an accepted application, those details are automatically re-masked.
  • Once you are part of a company's crew - the company owner, and admins they have granted member-management rights to, can see your unmasked NRIC in their staff list. This is limited to that one company and does not extend to any other employer on the platform.
  • Your resume is never shown to employers. It is stored privately and is visible only to you.
  • Scheduling conflicts. If you are already confirmed for work that clashes with a new application, we tell the employer that a clash exists and name the conflicting job, so they do not accidentally double-book you. This means one employer may learn that you are working for another. You can see the same information on your own applications page.

An employer can only ever see this for their own company. No employer can see your data from a different company, and there is no public directory of workers.

4. Who else we share it with

We do not sell your personal data. We share it only with service providers who process it on our behalf, under contract, to run the platform:

  • Supabase - our database and file storage, hosted in Singapore
  • Railway - application hosting, in the Singapore region
  • Amazon Web Services (Amazon SES) - delivery of account-related email, in the Asia Pacific (Singapore) region
  • Cloudflare - domain name service, content delivery and protection against denial-of-service attacks

Some of these providers may process data outside Singapore. Where that happens we take reasonable steps to ensure a standard of protection comparable to the PDPA. We may also disclose personal data where the law requires it, or to establish or defend a legal claim.

The email we send is limited to messages about your own account or an action you took - for example verifying your email address, resetting your password at your request, or telling you about a job application you submitted. We do not send marketing email.

5. How we protect it

  • Your NRIC/FIN and bank account number are encrypted at rest using AES-256-GCM, with the encryption key held separately from the database
  • Passwords are stored only as bcrypt hashes and are never recoverable, even by us
  • All traffic is encrypted in transit using HTTPS/TLS
  • Session tokens are held in httpOnly cookies that JavaScript cannot read, which protects them from cross-site scripting attacks
  • Resumes are stored in private storage and served only through short-lived links generated for you
  • Access is enforced on our servers, not merely hidden in the interface, and every request is checked against your permissions
  • Photographs are stripped of embedded metadata, including any GPS location, on upload

No system can be guaranteed completely secure. If a data breach occurs that is likely to result in significant harm, we will notify the Personal Data Protection Commission and affected individuals as the PDPA requires.

6. How long we keep it

We keep your personal data for as long as your account is active and for as long as we need it for the purpose it was collected, or to meet a legal, accounting or business requirement - for example, records of work you performed and were paid for. When data is no longer needed for any such purpose, we cease to retain it or remove the means by which it can be associated with you.

7. Your rights

Under the PDPA you may:

  • Ask for access to the personal data we hold about you, and information on how it has been used or disclosed in the past year
  • Ask us to correct anything inaccurate or incomplete. You can already edit most of your details yourself from your profile page
  • Withdraw your consent to our continued use of your personal data, by writing to us at the address below

We will respond to an access or correction request within 30 days. If we cannot, we will tell you when we can. Note that withdrawing consent for data that is essential to the service - such as your NRIC, which is required to verify your right to work - means we can no longer offer you that part of the service.

Some information cannot be edited by you directly once submitted, specifically your NRIC and bank account number. This is a deliberate safeguard. Contact us to have either corrected.

8. Minimum age

You must be at least 18 years old to complete a worker profile and apply for jobs on Jobxy. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has given us personal data, please contact us and we will remove it.

9. Changes to this policy

We may update this policy as the platform develops. The date at the top of this page shows when it was last changed. If a change materially affects how we handle your personal data, we will take reasonable steps to tell you.

10. Contact us

Questions, access or correction requests, and complaints about how we handle personal data should go to our Data Protection Officer:

Data Protection Officer
JOBXY PTE. LTD.
Email: privacy@jobxy.sg
Singapore

If you are not satisfied with our response, you may raise the matter with Singapore's Personal Data Protection Commission.