Privacy Policy
Effective date: 2026-06-28. Last updated: 2026-06-28.
1. Who we are
L-SPARK Corporation (the “Company”, “we”, “us”) operates Funding Compass, a conversational tool that helps Canadian small businesses identify federal and provincial funding programs that may fit their situation. L-SPARK Corporation is the data controller for personal and business information processed through this service.
Privacy questions, requests, and concerns: admin@fundingcompass.ca.
Privacy officer designation (Quebec Law 25): We have designated a Privacy Officer responsible for overseeing our compliance with this policy and applicable privacy law. You can reach our Privacy Officer at admin@fundingcompass.ca.
2. What we collect
When you use Funding Compass, we collect:
- Conversational content— the messages you type into the chat (business description, sector, revenue, funding ask, team size, R&D activity, founder demographics if you volunteer them).
- Derived facts— structured fields the system extracts from your messages to match against program eligibility (province, sector, funding need type, revenue band, employee count, capital ask, R&D activity).
- Session metadata — a randomly-generated session identifier stored in a first-party browser cookie (
lspark_session, 30-day expiry, HTTP-only, secure); IP address and user-agent string for the request; timestamps. - Analytics data (only with your consent) — if you accept analytics in the cookie banner, Google Analytics collects standard usage data (pages viewed, approximate location derived from a truncated IP address, device and browser type, and on-page interactions) to help us understand how the finder is used. Analytics stays off unless you opt in, and you can decline with no loss of functionality.
The finder requires a free account— your email and a password. Your account and all of your data are automatically deleted within 7 days, and you can request deletion sooner at any time (see “Retention and deletion” below). We do not collect payment information, government identifiers, banking details, or health information.
3. Why we collect it
- To match your business description against the funding-program corpus and surface relevant matches.
- To maintain a session so the conversation persists across messages.
- To monitor service performance, debug errors, and protect against abuse.
- To improve the program-matching quality (we may review anonymized conversation patterns to refine the model and corpus).
4. Where it is stored
All conversation data is stored in the ca-central-1 (Montreal)AWS region. Web hosting is on Vercel's YUL1 (Montreal) edge. AI inference is performed by Anthropic Claude via AWS Bedrock's cross-region service: each request is processed transiently in ca-central-1 or a US AWS region (N. Virginia, Ohio, or Oregon), whichever has capacity. Inference requests are not stored by AWS in any region — nothing about your conversation is retained outside Canada.
If you opt in to analytics, Google Analytics processes anonymized usage data (page views and interactions — never your conversation content) on Google's infrastructure in the United States. This happens only with your consent; see the subprocessor table and the cookies section below.
5. Subprocessors
| Subprocessor | Purpose | HQ | Processing region |
|---|---|---|---|
| Vercel | Hosting + edge CDN | USA | YUL1 (Montreal, Canada) |
| Anthropic via AWS Bedrock | Conversational AI inference | USA | ca-central-1 + US AWS regions (transient processing only — no storage) |
| Supabase | Application database + vector store | USA | ca-central-1 (Montreal, Canada) |
| Upstash | Rate-limit counter (Redis) | USA | ca-central-1 (Montreal, Canada) |
| Cloudflare (Turnstile) | Bot/abuse protection on auth forms | USA | Global edge (no conversation content) |
| Resend | Transactional email (confirm, reset, deletion notice) | USA | United States |
| Google (Analytics) | Anonymized usage analytics — only with your consent | USA | United States |
We may transfer business and personal information outside of Canada when subprocessors require it. By using the service you consent to these cross-border transfers, which are documented above.
6. Retention and deletion
Funding Compass stores your account details and your conversations on servers located in Canada. Your account and all of your conversations are automatically and permanently deleted within 7 days. We'll email you when your account is removed, and you're welcome to register again at any time to start fresh.
Because everything is deleted automatically within 7 days, you usually won't need to do anything. If you'd like your data removed sooner, email us from your account's email address at admin@fundingcompass.ca, and we'll process verified requests within a reasonable timeframe.
We may also remove accounts or content at our discretion — for example, to address misuse, security risks, or violations of our Terms of Use.
7. Automated decision-making
Funding Compass uses an automated AI system (Anthropic Claude) to extract facts from your business description and match them against program eligibility criteria. The system's recommendations are informational only and do not replace advice from a funding consultant, the program administrator, or a qualified legal or financial advisor. If you believe a result is wrong or wish to have a human review the match, contact us at admin@fundingcompass.ca.
This disclosure satisfies the transparency requirements of Quebec's Loi 25 (Loi modernisant des dispositions législatives en matière de protection des renseignements personnels) and the proposed federal Consumer Privacy Protection Act (Bill C-27).
8. Your rights
Under PIPEDA, Quebec Law 25, and other applicable Canadian privacy law, you have the right to:
- Access the personal information we hold about you.
- Request correction of inaccurate information.
- Request deletion of your account and conversation data.
- Withdraw consent at any time.
- Receive your data in a portable format (Quebec Law 25 data-portability right).
- Lodge a complaint with the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.
Email admin@fundingcompass.ca to exercise any of these rights.
9. Cookies
We use one essential cookie — lspark_session — to maintain your conversation across messages. It is HTTP-only, Secure, SameSite=Lax, and expires after 30 days. The finder sets no other cookies unless you opt in to analytics.
If you accept analytics in the cookie banner, Google Analytics sets its own cookies (for example _ga) to measure usage; these load only after you consent, and declining keeps them off entirely. You can change your mind at any time by clearing your browser's site data, which removes the stored consent and the analytics cookies. We use no advertising cookies. Separately, we measure anonymous page views and page-load performance with Vercel's first-party, cookieless analytics, which set no cookies and contain no personal information.
10. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via a notice on the homepage at least 30 days before they take effect. The current version is always available at https://fundingcompass.ca/privacy.
11. Contact
Privacy questions, access requests, or complaints:
Email: admin@fundingcompass.ca
Mail: L-SPARK Corporation, 105-350 Leggett Drive, Kanata, ON K2K 2W7, Canada
Telephone: 613-271-5455