Privacy Policy

Last updated October 11, 2026

Draft: pending legal review. This page describes what the site does today and has not yet been reviewed by a lawyer.

This policy explains what the operator of Grants & Loans Finder ("we") collects when you use Grants & Loans Finder, why, who receives it and the choices you have. We operate from Canada and aim to follow the federal Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL) and, for Quebec residents, the opt-in approach of Law 25: non-essential tracking is off until you opt in.

What we collect

  • Account details: your email, optional name and a hashed (never plain-text) password.
  • Your activity when signed in: programs you save, stages and notes you add, programs you open, your profile (who you are and topics of interest) and saved searches. This powers resume, alerts and personalised ranking.
  • Billing: payments are handled by Stripe. We store your Stripe customer ID and subscription status but never your card number.
  • Essential technical data: a session cookie that keeps you signed in, a record of your cookie choice, and basic server logs (IP address, pages requested) kept briefly for security and debugging.
  • Analytics, only if you accept it: a random visitor ID, the pages you view, buttons you click, the programs you open, the search terms and filters you use on the site, the campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and ad click IDs (fbclid, ttclid, li_fat_id) from the link that brought you here, the referring site's domain, and a coarse device class (mobile, tablet or desktop). We do not store your IP address or browser user-agent string in these records. If you are signed in, or create an account while analytics is on, we link these events to your account so we can tell which campaigns produce sign-ups.
  • Advertising data, only if you accept it: see "Advertising pixels" below.

Why we use it (purposes)

  • To run the Service: sign-in, saving, alerts and personalised ranking.
  • To send emails you would expect: welcome, password resets, receipts and, if you leave them on, deadline and change alerts (turn them off on the Account page). We send marketing email only with your consent.
  • To keep the Service secure.
  • With analytics consent: to understand how the Service is used, which programs and searches matter to visitors, and which marketing campaigns work, so we can improve it.
  • With advertising consent: to measure our ads and show our ads to people who visited the site.

We do not sell your personal information.

Advertising pixels (Meta, TikTok, LinkedIn)

If you choose "Accept all" or switch Advertising on, and a pixel is configured, your browser loads tracking code from:

  • Meta Platforms (Facebook and Instagram) Pixel,
  • TikTok Pixel, and
  • LinkedIn Insight Tag.

These companies receive your IP address, browser and device information, the pages you view on our site, actions such as viewing pricing, signing up, starting checkout or purchasing (with the amount in CAD), and the ad click ID. They set their own cookies and may combine this with data they already hold about you. We use it to measure which ads lead to sign-ups and purchases and to build audiences so we can show our ads to site visitors and to similar people. Those companies act under their own privacy policies and may process data outside Canada, including in the United States. We do not send them your email address or the contents of your account. Their retention is controlled by them; see each company's privacy policy and your ad settings on each platform to review or delete what they hold.

Opting out: use "Cookie settings" in the footer of any page to switch Advertising off at any time; the pixels stop loading straight away. We honour the Global Privacy Control signal (a browser setting, for example in Brave, DuckDuckGo or Firefox) as a refusal of advertising cookies. You can also use the ad-preference controls on each platform.

Who we share it with

Service providers that help us run the Service: hosting (Railway), payments (Stripe), email delivery (Resend) and, only with your advertising consent, Meta, TikTok and LinkedIn as described above. Providers may process data only to provide their services, except the advertising companies, which use data under their own policies. We may also disclose information where the law requires it.

Cookies

One essential cookie keeps you signed in. Everything else is optional and off until you choose. The full list, with names, purposes and durations, is on our Cookie Policy.

Retention

  • Account data: while your account is open, then deleted on request or after closure, subject to legal record-keeping needs.
  • First-party analytics events: up to 24 months, then deleted.
  • Cookies: the session lasts up to 7 days, the consent record 12 months, the visitor ID 12 months and campaign tags 90 days.
  • Server logs: kept for a short period only.

Your rights under PIPEDA

You may: ask what personal information we hold about you and how it is used; ask us to correct it; withdraw consent (for analytics and advertising, any time through "Cookie settings"; for other uses, by contacting us, though some features may then stop working); ask us to delete your information; and challenge our compliance. We aim to respond within 30 days. Contact [email protected]. If we cannot resolve a concern you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). Quebec residents also have rights to data portability and to be told how their information is processed.

Analytics events that are not linked to an account are tied only to a random ID stored in your browser; clearing the gp_vid cookie breaks the link. To have events linked to your account deleted, contact us.

Security

Passwords are hashed, sessions are signed and encrypted in transit, and access to data is limited. No system is perfectly secure; please use a strong, unique password.

Contact

Privacy questions and requests: [email protected]. Operator: the operator of Grants & Loans Finder.

Changes

We will post updates here and change the date above. If we make a material change to how we use your information, we will ask for your consent again where the law requires it.