GrantCompass helps Canadian businesses find and win funding. To do that we collect the business profile you give us, we use analytics (including session replay) to understand how the product is used, and we use AI services to generate your matches and drafts. We never sell your data, and you can download or delete everything from your dashboard settings. This policy describes what actually runs on this site — including the third-party services involved — for all GrantCompass services at grantcompass.ca, including GrantCompass Arts (grantcompass.ca/arts/).
1. Information We Collect
Account Information (Optional)
Email address - For account creation and login
Display name - Chosen during account setup
Profile photo - If you sign in with Google
Business Profile and Quiz Responses
Business details - Province, industry, legal structure, business age, team size, revenue band, funding goals, R&D activity, and answers to eligibility questions on our map and quizzes
Business name and website - If you provide them (or use our website-scan onboarding)
Ownership demographics (voluntary) - Our quiz includes an optional question about ownership (for example women-owned, Indigenous-owned, newcomer-owned), because many funding programs are demographic-specific. This can be sensitive personal information. You can always answer "none apply", and we use it only to match you to programs and to personalize your application materials. It is included in the data sent to our AI provider when generating your matches and drafts (see Section 4).
Application work - Drafts, notes, document checklists, and pipeline stages you create in your workspace
Usage and Technical Data
Product usage - Pages visited, features used, quiz and map runs (including the answers and the programs we matched you to, which we store server-side to improve matching quality)
Session recordings - We use Microsoft Clarity, which records how visitors interact with pages (mouse movement, clicks, scrolling, and page structure) to help us find usability problems. See Section 5.
Referral history - How you arrived at the site (referrer and campaign parameters), kept in your browser and, if you create an account, saved with it so we can understand which channels bring users
Technical data - IP address, browser type, device information for security and performance
Information We Do NOT Collect
Social insurance numbers or government IDs
Full credit card numbers or banking credentials (processed by Stripe)
Personal communications with grant agencies
2. How We Use Your Information
Grant matching - Personalized program recommendations based on your business profile
Application help - Generating roadmaps, draft application text, and eligibility feedback for you (this uses an AI provider — Section 4)
Account management - Maintaining your account and syncing your saved work across devices
Email - Transactional email (receipts, sign-in and password links) and, unless you opt out, product email such as deadline alerts, Funding Radar matches, and our newsletter. Every marketing email has an unsubscribe link, and granular toggles live in your dashboard settings.
Service improvement - Analytics on how the product is used, including anonymous aggregate statistics
Advertising measurement - When we run our own ad campaigns (for example on Reddit), we use that platform's measurement pixel to know whether the campaign worked (Section 5)
Security - Protecting against fraud, spam, and abuse
We will never:
Sell your personal information
Share your business profile with grant agencies or other businesses without your action
Use your business information to compete with you
3. Data Storage and Security
Where Your Data is Stored and Who Processes It
GrantCompass is built on established cloud providers. The services that store or process personal information are:
Google Firebase (authentication and database — your account, profile, saved work)
Netlify (website hosting) and Cloudflare (content delivery and security)
Railway (our application backend)
Stripe (payments — Section 6)
Resend (email delivery)
OpenAI (AI generation — Section 4)
Google Analytics, Microsoft Clarity, Reddit (analytics and advertising measurement — Section 5)
Several of these providers process data in the United States. See Section 8 on cross-border transfers.
Security Measures
HTTPS encryption for all data transmission
Data encrypted at rest in Firebase
Access controls (Firebase security rules) limiting your data to your account
Regular security updates and monitoring
If a data breach creates a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner of Canada as required by PIPEDA.
4. AI Processing
Core features — grant matching refinement, funding roadmaps, application drafts, and the eligibility reviewer — are generated using OpenAI's API. When you use these features, the business profile you gave us (including province, industry, structure, revenue band, and any voluntary demographics) and the text you are working on are sent to OpenAI to generate the result.
OpenAI processes this data as our service provider under its API terms, which state API data is not used to train their models
We never send your password, payment details, or email contents
Generated drafts are yours — they are stored in your workspace and included in your data export
5. Analytics, Session Replay, and Advertising Measurement
Google Analytics 4 - Page views and product events, used in aggregate to understand usage
Microsoft Clarity - Session recordings and heatmaps (mouse movement, clicks, scrolling, page content as rendered). We use these to find broken or confusing parts of the product. Clarity masks typed input by default.
Reddit advertising pixel - Present on some pages to measure the performance of our own ad campaigns on Reddit (for example, whether an ad click led to a signup). This shares limited event data with Reddit. We do not sell your data to advertisers, and we do not run third-party ads on GrantCompass.
These tools run when you use the site. If you prefer to limit them, browser tracking-protection features and extensions are effective against all three.
6. Payment Information
Payment Processing
All payments are processed by Stripe, a PCI-DSS Level 1 certified payment processor. Your card number never touches our servers.
What GrantCompass Stores
Your subscription status, plan, and billing period (not your card details)
A record of purchases and subscription events (needed for receipts, refunds under our 30-day guarantee, and accounting)
Billing Communications
We send transactional billing email (receipts, renewal notices, payment-failure notices). These are necessary to the service and are sent even if you opt out of marketing email.
7. Your Privacy Rights
Access, Export, and Deletion — built into the product
Download your data - Dashboard → Settings → "Download My Data" exports your account details, bookmarks, notes, quiz answers, and your applications and drafts as JSON
Delete your account - Dashboard → Settings → Danger Zone. This deletes your account, profile, saved programs, applications and drafts, and match history, and removes you from our email lists.
What deletion keeps - Payment and subscription records (required for financial and refund obligations) and minimal email-consent logs (required under Canadian anti-spam law to evidence consent and unsubscribes). These are retained only as long as those obligations require.
Communication Preferences
Granular email toggles in Dashboard → Settings: Newsletter, Application Nudges, Deadline Alerts, and Funding Radar
An unsubscribe link in every marketing email, which stops all non-transactional email
You may also request access or correction by email (Section 11); we respond within 30 days as PIPEDA requires.
8. Compliance with Canadian Privacy Law
GrantCompass complies with the Personal Information Protection and Electronic Documents Act (PIPEDA).
Legal Basis for Processing
Consent - You provide your profile and quiz answers to receive matching and application help
Contract - Processing needed to deliver the subscription you purchased
Legitimate interest - Product analytics, security, and measuring our own advertising
Cross-Border Data Transfers
Google, Microsoft, Stripe, Resend, Railway, Cloudflare, OpenAI, and Reddit process data in the United States (and other regions they operate in). While in another jurisdiction, data is subject to that jurisdiction's laws. We use providers with strong contractual and security commitments, but no transfer is entirely without this consideration — this disclosure is part of your informed consent.
9. Cookies and Local Storage
Essential - Authentication session (Firebase) and your saved preferences, quiz answers, and bookmarks in browser local storage — these make the product work
Analytics - Google Analytics and Microsoft Clarity cookies (Section 5)
Advertising measurement - Reddit pixel cookie on some pages (Section 5)
Blocking non-essential cookies in your browser will not break core functionality.
10. Children's Privacy
GrantCompass is a business tool and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
11. Changes to This Policy
We update this policy when our practices change. We will post updates here with a revised date, and notify registered users by email of material changes.