Privacy Policy

1. Information We Collect

Account Information (Optional)

• Email address - For account creation and login
• Display name - Chosen during account setup
• Profile photo - If you sign in with Google

Usage Data

• Grant search queries - To improve our matching algorithm
• Bookmarked grants - Stored in your account or browser
• Quiz responses - Business stage, industry, location preferences
• Technical data - IP address, browser type, device information for security and performance

Information We Do NOT Collect

• Social insurance numbers or government IDs
• Full credit card numbers or banking credentials (processed by Stripe)
• Detailed business financial information
• Personal communications with grant agencies

2. How We Use Your Information

• Grant Matching - Provide personalized grant recommendations based on your business profile
• Account Management - Maintain your account and sync bookmarks across devices
• Service Improvement - Analyze usage patterns to improve our grant database and matching accuracy
• Communication - Send important updates about grants you've bookmarked (if you opt-in)
• Security - Protect against fraud, spam, and abuse

3. Data Storage and Security

Where Your Data is Stored

• Authentication - Google Firebase (industry-standard security)
• Bookmarks - Firebase Firestore (encrypted at rest)
• Search History - Local browser storage (not transmitted to servers)

Security Measures

• HTTPS encryption for all data transmission
• Firebase security rules preventing unauthorized access
• Regular security updates and monitoring
• No storage of sensitive financial or government ID information

Data Retention

• Active Accounts - Data retained while account is active
• Inactive Accounts - Deleted after 2 years of inactivity
• Deleted Accounts - All personal data removed within 30 days
• Usage Analytics - Anonymized data retained for service improvement

4. Payment Information

Payment Processing

All payment transactions are processed by Stripe, Inc., a PCI DSS Level 1 certified payment processor. GrantCompass never receives, stores, or has access to your full credit card number, debit card number, or bank account information.

What Stripe Collects

When you subscribe to GrantCompass Premium, Stripe collects the following information to process your payment:

• Name
• Email address
• Payment card details
• Billing address

This data is governed by Stripe's Privacy Policy.

What GrantCompass Stores

We store the following subscription-related data in our Firestore database:

• Subscription status (active, cancelled, past_due)
• Subscription plan type (monthly or annual)
• Stripe customer ID (anonymized reference, not payment details)
• Current billing period end date
• Subscription creation and update timestamps

Billing Communications

We send transactional emails related to:

• Subscription confirmation
• Payment receipts
• Failed payment notifications
• Cancellation confirmations

These emails are sent via Resend (our email provider) and cannot be opted out of as they are required for service delivery.

Data Retention for Payment Records

Subscription records are retained for the duration of the subscription plus 7 years for tax and legal compliance. Stripe retains payment records per their own data retention policy.

5. Your Privacy Rights

Access and Control

• View Data - Access all personal data we have about you
• Update Information - Modify your profile and preferences at any time
• Delete Account - Permanently remove your account and all associated data
• Export Data - Download your bookmarks and preferences

Communication Preferences

• Opt-out of all non-essential communications
• Choose notification frequency (daily, weekly, monthly, or never)
• Select specific grant categories for updates

6. Compliance with Canadian Privacy Law

GrantCompass complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

Legal Basis for Processing

• Consent - You provide explicit consent when creating an account
• Legitimate Interest - Providing grant matching services you requested
• Service Delivery - Processing necessary to deliver our grant finder service

Cross-Border Data Transfers

Some data is processed by Firebase (Google) servers located in the United States. This transfer is covered by Google's privacy framework and provides equivalent protection to Canadian standards.

7. Cookies and Tracking

Cookies We Use

• Essential Cookies - Required for login and basic functionality
• Preference Cookies - Remember your settings and bookmarks
• Analytics Cookies - Understand how our service is used (anonymized)

Third-Party Services

• Firebase - Authentication and data storage (Google Privacy Policy applies)
• Netlify - Website hosting and performance monitoring
• Stripe - Payment processing (Stripe Privacy Policy applies)
• Resend - Transactional and marketing email delivery

You can disable cookies in your browser settings, though this may affect some functionality.

8. Children's Privacy

GrantCompass is designed for business use and not intended for children under 13. We do not knowingly collect personal information from children. If we learn we have collected information from a child under 13, we will delete it immediately.

9. Changes to This Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. We will:

• Notify users of significant changes via email (if registered)
• Post updates on our website with revised date
• Provide 30 days notice for material changes

Continued use of GrantCompass after changes constitutes acceptance of the updated policy.

10. Contact Information