Privacy Policy

1. Introduction

BigLaw Bear (“we,” “us,” or “our”) operates the BigLaw Bear platform at biglawbear.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. We are committed to protecting your privacy and handling your data with transparency. By creating an account or using our services, you consent to the practices described in this policy.

2. Information We Collect

We collect information you provide directly and information generated through your use of the platform.

Profile Information

When you create an account, we collect your name, email address, phone number (optional), law school, expected graduation year, and any additional profile details you choose to provide such as your resume, transcript, practice area interests, and geographic preferences.

Gold Star Selections

We record which firms you designate as Gold Star selections. These selections are a core part of the service and are shared with firms as described in Section 4.

Optional Student Community

Where enabled, community posts use an alias unless you explicitly choose to post with your name. A pre-law room is limited to verified pre-law students and verified law students who choose to advise there. Some posts are held for a person to review before other students can read them. The hold does not name the word or phrase that matched. Anonymous means anonymous to other students: authorized administrators retain account links for moderation, restrictions, export, and deletion. General boards are shared with verified students; school discussions are limited to verified students of that school. Details you write can still identify you. Posting with your name does not reveal the alias attached to your other posts.

Community messages begin with a request. Each participant chooses an alias or name that stays fixed for that conversation. The founder uses the same choice. You can mute, block, report, or hide a conversation from your inbox. Hiding does not delete the other participant's copy. Account deletion removes your message text and identity while preserving the other participant's contributions. Authorized moderators can review reported messages and take action against abuse.

Optional post images are normalized to remove file metadata and kept in private storage. They are visible to other eligible readers only after moderator review. Images can still contain identifying details in their visible content. Expired draft uploads are removed after 24 hours; rejected images and images on hidden or deleted posts are removed by scheduled cleanup. In-app alerts use generic text. We do not send community email or push notifications.

Course grades and recruiting reports are private by default and are separate from discussion aliases. Only reports you opt into sharing contribute result and native grade-label counts to school-only summaries, with small groups suppressed. Course names and individual grade records are not shown. Grades are self-reported in their original format, not converted into a cross-school GPA or used to predict hiring outcomes. Community reports are not supplied to firms or career offices. Community pages are excluded from session replay and provider analytics. Your export includes your contributions; account deletion removes your grades, reports, aliases, and authored text.

Usage Data and Analytics

We automatically collect information about how you interact with the platform, including pages visited, features used, search queries, session duration, device type, browser type, operating system, IP address, and referring URLs. This data is collected through server logs and analytics tools.

Cookies and Similar Technologies

We use essential cookies to maintain your authenticated session and remember your preferences. We may also use analytics cookies (such as those provided by third-party analytics services) to understand aggregate usage patterns. You can control cookie settings through your browser, but disabling essential cookies may prevent the platform from functioning properly.

3. How We Use Your Information

We use the information we collect to:

• Operate, maintain, and improve the BigLaw Bear platform and its features
• Facilitate connections between law students and law firms through the Gold Star matching system
• Provide our LegalCub career office service to law schools and their students, as described in Section 10
• Communicate with you about your account, platform updates, and relevant recruiting opportunities
• Generate aggregate, de-identified analytics about recruiting trends, student interests, and platform usage
• Ensure the security and integrity of the platform, including fraud prevention and abuse detection
• Comply with legal obligations and respond to lawful requests from authorities

4. How We Share Your Information

We share your information only in the following circumstances:

With Firms You Select

When you designate a firm as a Gold Star selection, that firm may receive your profile information, including your name, law school, graduation year, resume, and any other details you have chosen to include in your profile. This is the core purpose of the platform: firms see students who have expressed interest in them.

With Employers You Choose

Firms and other employers see information about you as an individual only when you choose to share it with them: by naming them as a Gold Medal or Gold Star, by applying, by bidding for an on-campus interview with them, or by joining a resume book your career office sends them. An on-campus interview bid shares your resume with that one employer, on your school's behalf, and you can withdraw it until the bid deadline. A resume book shares what the book lists, and you can leave it in your account settings. Employers may use what you share only for recruiting, as our Terms require. Your choice to share with your career office never, by itself, shares anything with an employer.

Aggregate Firm Analytics

Firms subscribed to the BigLaw Bear firm portal may see anonymous, aggregated statistics about student interest in their firm. For example, a firm may see how many students from a tier of law schools have indicated interest in them, or how their applicants' practice-area preferences are distributed.

These statistics are aggregated and de-identified using a minimum cohort size of 10 students; smaller cohorts are suppressed and counts are rounded to the nearest 5 to make re-identification impractical. Individual records, demographic data, and identifying details are never shared in this product. Firms are contractually prohibited from attempting to re-identify students from aggregate data (Terms Section 6).

You are included by default. You can opt out at any time from your account settings. Opting out does not affect the core matching service: your Gold Stars still reach the firms you select; you simply don't count in cohort statistics that other firms see.

With Your Law School's Career Office

A law school career office that uses BigLaw Bear can upload its own roster of students (name, school email, class year and, optionally, a student ID) so it can invite them. We send those invitations by email on the office's behalf, and every one has an unsubscribe link. For students on its roster, the office can see whether a BigLaw Bear account exists with that school email address, and when that account joined (only for addresses on the school's own email domain). For students who are not on its roster, the office sees only a rounded count, never names or emails, unless a student chose to share their basics with the office. When the office removes someone from its roster, we delete that roster entry, and for people who never signed up, the delivery records we kept for that address.

Career offices can post announcements, deadlines, events and documents for their students. Announcements appear inBigLaw Bear and may also be emailed to you; you can unsubscribe from those emails at any time. We record whether you opened an announcement in BigLaw Bear and show the office how many students read it. When your school's career office joins BigLaw Bear, we let that school's verified students know, once, in BigLaw Bear and by email; staff never see a student's details unless the student chooses to share with them.

If you book a meeting with a career counselor throughBigLaw Bear, the counselor receives your name, email, the topic you picked and any note you add. The meeting details are shared with Google Calendar so it can send the calendar invite to you and the counselor.

Career-office staff may keep private notes about their meetings with you. Only staff at that office can see them; other schools and other students cannot. These notes are not part of the data download in your account settings; to request a copy, contact us as described in Your Rights below and we will handle it. When you delete your account, we delete these notes and your sharing choices, cancel your upcoming meetings, and remove your name, email and booking note from past ones. If you verify a school email address to open your career office, we keep it on your account to confirm you are a student there.

Anything beyond that is shared only if you choose. We ask whether you want to share with your school's career office, and nothing more is shared unless you say yes. If you do, staff at your school's career office (invited and verified by BigLaw Bear) can see your name, email, class year, practice areas and cities, your resume, your Gold Medal and Gold Stars, and your application tracker (firms, statuses and deadlines), so they can advise you. Your transcript, grades and private notes are never shared. Staff at other schools see nothing. You can stop sharing at any time in your account settings; staff lose access immediately. If you also turn on Resume Keyword Search, we keep a searchable copy of the text in your resume so staff at your school can find you by words in it. We delete that copy when you turn the setting off, stop sharing, delete your resume, change schools, graduate or delete your account, and it is included in your data download. We record your choice and log each time staff view your profile or open your resume.BigLaw Bear administrators may view what you share for support, and those views are logged too.

Other Aggregate and De-Identified Data

Outside the firm-portal analytics product above, we may share aggregate, de-identified data with law schools and other partners for general recruiting-trend research. The same minimum cohort size and rounding apply.

Service Providers

We use third-party service providers for hosting and privacy-friendly site analytics (Vercel), database and file storage (Supabase), email delivery (Resend), our business email and meeting calendar (Google Workspace), SMS delivery (Twilio), edge network and bot protection (Cloudflare), error monitoring (Sentry), and our internal outreach records (Notion). Optional features also use video interviews (Daily, Zoom), calendar scheduling (Google Calendar, Microsoft Outlook), and billing (Stripe). These providers have access to your information only to perform services on our behalf and are obligated to maintain its confidentiality. A complete sub-processor list with each vendor's purpose appears in the Sub-Processors section below.

We may engage, replace or add service providers and sub-processors as the platform changes, including for hosting, database, email, analytics, file storage, backup and, if we add AI features, AI processing (see Section 13a). Each one is bound by written terms that protect your information at least as well as this policy, and may use it only to provide services to us. We keep the list in the Sub-Processors section below current and update it when a provider changes. Firms and schools with an agreement with us also get the advance notice of a new sub-processor that their agreement provides.

Business Partners and Affiliates

We may share or make available personal information, including aggregate and de-identified data, to business partners, affiliates, licensees, or other third parties in connection with the operation, improvement, or commercialization of the platform or related services. Where required by applicable law, we will provide notice and obtain any necessary consent before doing so.

If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, your information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.

Any successor must keep protecting your information as this policy describes, including our commitments to law schools about their records. Before your information becomes subject to a materially different privacy policy, we will notify you as described in Changes to This Policy below.

Legal Requirements

We may disclose your information if required to do so by law, in response to a subpoena or court order, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Data Retention

We retain your account information for as long as your account is active or as needed to provide you services. If you request account deletion, we will remove your personal data within 30 days, except where we are required by law to retain certain records. De-identified aggregate data may be retained indefinitely for analytical purposes. Uploaded documents (resumes, transcripts) are deleted from our storage within 30 days of account deletion.

When you apply to a career-office posting inside BigLaw Bear, we keep separate copies of the documents and any typed cover letter for that application. We schedule deletion of those copies once 30 days have passed after the posting closes, or sooner if you withdraw the application or delete your account. The application record remains, and your original profile documents are unaffected. A firm may keep anything it downloaded while access was open.

6. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate or incomplete information in your profile
• Deletion: Request that we delete your account and associated personal data
• Data Portability: Request a machine-readable export of your profile data
• Withdraw Consent: Withdraw your consent to data processing at any time by deleting your account

To exercise any of these rights, contact us at tulio@biglawbear.com. We will respond to your request within 30 days.

7. Security

We implement industry-standard security measures to protect your personal information. All data transmitted between your browser and our servers is encrypted using TLS. Access to personal data is restricted to authorized personnel on a need-to-know basis. Our infrastructure providers (Supabase, Vercel) maintain SOC 2 compliance and employ encryption at rest for stored data. While no system is perfectly secure, we continuously review and improve our security practices. If we become aware of a data breach that affects your personal information, we will notify you promptly in accordance with applicable law.

8. Third-Party Links

Our platform may contain links to third-party websites, including law firm websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party site you visit.

9. Demographic Information

BigLaw Bear does not collect information about your race, ethnicity, gender, sexual orientation, gender identity, disability, veteran status, first-generation status, citizenship, or work authorization. Voluntary demographic information that some students previously provided through an optional self-identification section has been deleted, and that section has been removed.

10. FERPA and School Career Offices

BigLaw Bear is not an educational institution. Most of what is on the platform is provided by students themselves. Our career office service, LegalCub, also lets a law school's career office work with its students. Information reaches a career office in two separate ways:

• Records the school gives us. A school may upload or import its own records, such as a student roster, employment outcomes, imported advising history, OCI lists and counselor notes. These are the school's education records. We process them on the school's behalf and only as it directs. Where a school's agreement with us designates us a school official under FERPA (34 CFR 99.31(a)(1)(i)(B)), we act under the school's direct control. We use them only to provide services to that school under its instructions, and we do not disclose them to any firm, employer or other school except as the school directs. We use service providers to host, secure and run the service, and they may handle these records only on the same terms. Each time a school uploads records, its staff member confirms that they are authorized to upload them and that the school has a lawful basis to provide them to us for its career services. Uploading a roster sends nothing to students. Questions about these records, including requests to see or correct them, go to your school, and we help the school answer them.
• What you choose to share. Your BigLaw Bear profile, resume, cover letters, Gold Medal and Gold Stars, and application tracker are yours. Your school's career office sees each item only if you turn on sharing for it, and only while you keep sharing. You can stop at any time from your settings. Sharing with your school never shares anything with a firm.

What your career office can see

Your school's career office can see the records the school itself gave us; the items you chose to share (Profile Basics, which are your name, email, class year, practice areas and cities, and, separately, your resume, cover letters, Gold Medal and Gold Stars, and application tracker, including firms, statuses, deadlines and outcomes such as offers you record); and your activity with the office's own services, such as meetings you book with it, events you register for or check in to through it, and documents you send it for review. While you pause recruiting, your Gold Stars and tracker stay hidden from the office even if you shared them.

The basis for sharing

What you share, you share by your own consent, item by item, and only for the version of the sharing terms you agreed to. When what can be shared changes, we ask you again, and nothing new is shared until you say yes. Records your school gives us, such as its roster, are the school's. We hold them for the school, and where its agreement with us designates us a school official with a legitimate educational interest under FERPA, we act under the school's direct control.

How your school may use it

Your school may use this information to advise you and run its career services, and for its own reporting, including the employment outcomes it reports to the American Bar Association and NALP. Under its agreement with us, a school uses it only for those educational purposes and does not pass it on except as FERPA and other applicable law allow. A school cannot use LegalCub to see an item you have not shared.

Aggregate and de-identified data

Counts and charts shown to a career office are aggregated: groups smaller than ten are withheld and larger groups are rounded to the nearest five. We may also combine de-identified data from school records and from student activity, under the same rule, to run and improve the service, to study recruiting trends, and, only for schools that choose to take part, to show peer-school benchmarks. Aggregate data never names a student, and benchmarks never name a school that has not agreed to be named. We do not try to re-identify anyone from it. The school-wide counts a career office sees include students who have not turned on sharing; they never name a student.

Your choices

In your account settings you can turn off any item you share, or stop sharing with your career office altogether; staff lose access right away. You can also pause recruiting, hide your profile from firms, hide specific firms, leave a resume book, opt out of aggregate firm analytics, unsubscribe from office emails, and delete your account. Deleting your account deletes what you shared and your sharing choices. It does not by itself direct us to delete records your school gave us, such as a roster row. Those belong to the school, and we keep them for the school under its agreement with us until the school directs us to delete or de-identify them or the agreement ends. We do not use them to bring back a deleted account or to show you to a firm. Ask your school's career services office to see, correct or remove them. When the agreement ends, the school can download its records for a period the agreement sets. We then delete them on a documented schedule, including from backups as they rotate, and confirm the deletion in writing on request.

Schools can read the terms that govern their records in the School Data Use Agreement.

11. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions
• Right to Opt-Out of Sale or Sharing: To the extent that any disclosure of personal information described in this Privacy Policy constitutes a “sale” or “sharing” under the CCPA, you have the right to opt out. You may exercise this right by contacting us at tulio@biglawbear.com or by using any opt-out mechanism we make available on the platform. We will process your request within 15 business days. Attorneys named in public firm bios can ask to be removed from our attorney counts, lists and search at our removal page
• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise these rights, contact us at tulio@biglawbear.com. We will verify your identity and respond within 45 days.

12. EEA and UK Privacy Rights (GDPR)

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar data protection laws, you have the following rights under the General Data Protection Regulation (GDPR) and equivalent statutes:

• Right of Access (Article 15): Request a copy of the personal data we hold about you, the purposes of processing, recipients, retention period, and other prescribed information.
• Right to Rectification (Article 16): Have inaccurate or incomplete personal data corrected.
• Right to Erasure (Article 17): Have your personal data deleted, subject to certain exceptions.
• Right to Restriction (Article 18): Restrict processing of your personal data in certain circumstances.
• Right to Data Portability (Article 20): Receive a machine-readable export of the personal data you provided to us.
• Right to Object (Article 21): Object to processing based on our legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.

The legal basis for our processing is your consent (account creation, voluntary profile fields), the necessity of performing the recruiting service you requested (Gold Star signals shared with firms you select), and our legitimate interest in operating and improving the platform.

To exercise any of these rights, contact us at tulio@biglawbear.com. We respond within one calendar month and may extend this period by up to two additional months for complex requests, in which case we will notify you of the extension within the first month.

13. Data Sub-Processors

We use the following third-party services to operate the platform:

• Supabase: Database and file storage. Hosted on Amazon Web Services (AWS) in the US West (Oregon) region. Data encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Vercel: Application hosting, edge network, and cookieless page-view analytics. SOC 2 Type II compliant.
• PostHog: Product analytics and session replay, hosted in the United States. Your analytics opt-out, Do Not Track and Global Privacy Control are honored, and sensitive fields are masked or not recorded.
• Resend: Transactional email delivery (account verification, notifications, interview invitations).
• Twilio: SMS delivery for phone-number verification one-time passcodes. Phone numbers are stored hashed and OTP codes are short-lived.
• Google Workspace: Business email fortulio@biglawbear.com and other messages you send us, and Google Calendar for meetings you book with our team (name and email of attendees).
• Notion: Internal records for our Student Ambassador program (applicant name, email, and law school) and for law school and law firm contacts we work with.
• Cloudflare: Edge network, DNS, and Turnstile bot protection on login and signup forms. No tracking cookies set by Turnstile.
• Sentry: Error monitoring and performance tracking. Receives error reports with passwords, tokens, and other sensitive fields removed.

The following providers are used only when the related optional feature is turned on, for example by a firm whose plan includes it or that connects its own calendar or video account:

• Daily: Video interview rooms (participant names and the audio and video of the call; recordings only where enabled).
• Zoom: Interview meetings created through a firm’s connected Zoom account (meeting title with the candidate’s name and the host’s email).
• Google Calendar and Microsoft (Graph / Outlook Calendar): Interview scheduling and availability checks through a firm’s connected calendar (event details and attendee names and email addresses).
• Stripe: Billing and payments for firm subscriptions (firm user email and billing details).

13a. Artificial intelligence

BigLaw Bear does not currently use artificial intelligence or automated decision-making on student or firm data.

If we add an AI feature, we will update this policy before it launches. Any AI provider we use will be bound in writing not to use your information to train or improve its models and to keep it no longer than it needs to provide the service. AI is never used on records a law school gives us unless that school opts in under its agreement with us.

13b. Email communications and onboarding sequences

When you create a BigLaw Bear account we send a series of welcome emails over your first two weeks (Day 0 / 2 / 5 / 14) introducing the tracker, Gold Stars, and interview prep resources. Firm admins receive a parallel activation sequence. These messages are not transactional, they describe features rather than confirm an action you took, so you can opt out at any time from /settings without losing transactional communication (interview confirmations, offer letters, application status changes).

Outbound email is delivered through a managed queue with automatic retry. Failed sends are retried up to five times with exponential backoff and then surface in our admin dashboard for manual triage. The queue table is service-role-restricted; firm or candidate accounts have no access.

Per-firm marketing email preferences are independently controllable: from /settings you can opt out of marketing email from any firm you’ve interacted with without affecting transactional messages from that firm.

13c. Operational telemetry

We log per-execution metadata for our scheduled jobs (cron name, duration, status) and inbound webhook events (provider, event id, status) so the on-call team can monitor platform health. These logs do not contain personal data and are retained for 30 days. Read access is restricted to platform admins.

13d. SMS communications

BigLaw Bear uses SMS text messages solely for account verification (two-factor authentication). When you verify your phone number, we send a one-time 6-digit code via Twilio to confirm your identity. No marketing messages, promotional texts, or recurring messages are sent via SMS.

By providing your phone number and clicking “Verify Phone,” you consent to receiving a one-time verification code via text message from BigLaw Bear. Standard message and data rates may apply. You will not receive any further text messages unless you explicitly request a new verification code.

Reply HELP to any SMS for assistance. Reply STOP to opt out of future verification messages. For support, contact tulio@biglawbear.com.

14. Children's Privacy

BigLaw Bear is intended for law students and legal professionals who are at least 18 years of age. We do not knowingly collect personal information from individuals under 18. If we learn that we have collected data from someone under 18, we will delete that information promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on the platform. Your continued use of BigLaw Bear after any changes indicates your acceptance of the updated policy.

16. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

tulio@biglawbear.com