Privacy policy

Updated October 6, 2026

You appear to be visiting the site from outside Canada. Subvention.app is intended for businesses and households in Canada; the rights described here (access, correction, deletion, portability) also apply to you, and you can exercise them at the same address.

Subvention.app is operated by 9564-3482 Québec inc. (NEQ 1181994576), in Quebec. This policy explains what information we collect, why, where it is kept and how to have it corrected or deleted. It complies with Quebec law (Law 25), federal law (PIPEDA) and the laws of Alberta and British Columbia, which apply depending on your province.

Person in charge of the protection of personal information

The president of 9564-3482 Québec inc., who can be reached through the form. We reply within 30 days.

What we collect

Your answers to the questionnaire (activity, size, region, project, household situation). Every question is optional. Some answers are marked "sensitive" in your profile: you provide them only if you want to.
Your account, if you create one: first name, phone, email and PIN. The PIN is stored as an encrypted hash; no one can read it. An account can hold several profiles: one per business and one for your household.
Your program tracking, if you use it: favourite programs, the status of your application (to apply, applied, received, declined), your notes and your deadlines. It is also used for deadline reminders by email, 14 days and 3 days before, which you can turn off in one click. Assistance marked "received" counts, without your name, in the public total of assistance received.
Your notifications, if you turn them on: a device identifier provided by Apple or by your browser, to send you new grants, deadlines from your tracking and, if you agree, at most one reminder a month. It is deleted with your account, or as soon as the device stops accepting notifications.
Your payments, if you become a member or partner or make a donation: plan, amount, date, email, and the profile the plan is tied to. The link to Stripe carries a random token, never your profile number. The card number is entered with Stripe; we never see it.
A donor's name, only if they tick the box provided before paying: the name they choose appears on the donors page for 12 months.
Your documents, if you add any to prepare an application: business plan, financial statements, completed form. They stay private. The AI model draws answers for your profile from them, each with a quote from the document, never replacing an answer you already gave and never filling a sensitive answer.
What you contribute about a program: an address, a text or a file that completes its file. The model checks that it is about this program and contains no information about a specific person or business. Only then is it added to the program's file for the next people; otherwise it stays private.
Partner listings: organization name, website, region, description and logo, published on the home page.

We measure traffic with Cloudflare Web Analytics: number of visits, pages viewed, country, browser and the site you came from. This tool sets no cookie, builds no individual profile and does not follow you from site to site. We use no targeted advertising and no advertising pixel.

Why

To find the assistance programs you seem eligible for and explain what is missing for the others.
To send you the monthly newsletter, drawn from your list. It goes to your email while your account is active; every newsletter contains an unsubscribe link, and My account lets you turn it off.
To send you your list and, only if you checked the box, new assistance programs every week. Every email contains an unsubscribe link.
To suggest programs you might not have thought of, in the opportunity report: the first one when you ask for it, then every month if you are a member. Every report email contains an unsubscribe link.
To collect donations and partnership payments, and meet our tax obligations.
To improve the service. On our own servers, we count the steps completed in the questionnaire (questions viewed, results consulted), with the platform used (website or app). This data is tied to your profile. When you delete it, or after 13 months, only monthly totals remain, with no link to you. Also without cookies or identifiers, we count views of program pages and clicks to official websites, to learn which programs people are interested in. These counts are tied to your profile only when you are signed in; that link is deleted with your profile. After 13 months, only monthly totals remain.

We do not sell or rent your information. Partners never see profiles.

Decisions made by artificial intelligence

An AI model reads the program pages and compares their criteria with your answers. It produces an assessment for information only ("seems eligible", "almost", "not eligible"), not a decision: the body offering the assistance always decides. You can ask which information led to an assessment, and have it reviewed by a person, by writing to us through the form.

The opportunity report is written by the same model, from the answers in your profile and the assessments already made. It suggests programs from our catalogue, without promising eligibility. Your answers are not shared with any third party, funding body or partner. The report email contains no tracking pixel: we only record the date you open a report on the site.

Public guides are written and checked by the same model from the program pages only, without any information about you or your profile.

Where your information is kept

Our service providers process the information for us, under contract, and for nothing else:

Railway (database, servers and storage of your documents), in the United States (Virginia).
Modal (AI model computing): requests enter through Canada, and computing runs in the United States or another region where Modal has capacity. The model runs on a server reserved for Subvention.app; your answers are not used to train a model.
Stripe (payments) and SMTP2GO (sending emails).
Cloudflare (site protection and cookie-free traffic measurement).

This information therefore leaves Quebec and Canada. It remains subject to the laws of the countries where it is kept. Before entrusting it to these providers, we carried out the privacy impact assessment required by Quebec's Law 25; you can ask for its summary through the form .

How long

Profile and account: as long as you keep them. You can delete an answer, the whole questionnaire or the entire profile in your profile, at any time. Deleting the whole account in My account also erases all its profiles and its tracking. Only an anonymized version is kept (see below).
A profile created without an account and left unused for 12 months is anonymized, then deleted.
Payment information is kept for 6 years to meet our tax obligations: plan, amount, date, email and Stripe identifiers. If you delete your account, the link to your profiles and the name shown on the donors page are removed; the rest is used only for accounting. Six years after the membership ends or after the payment, the email and Stripe identifiers are erased.
Partner listing: as long as the partnership is active. It disappears from the home page upon cancellation.
Your documents: 12 months after their last use, then deleted. You can delete them anytime; deleting the profile deletes them within 24 hours.
Your contributions that were not shared: deleted with your profile (within 24 hours) or after 12 months. A shared contribution contains no personal information and stays in the program's file.

Retention and research

When you clear your questionnaire or delete a profile or your account, what you delete is destroyed, including everything that identifies you: name, first name, phone, email, PIN, city, project description, notes and exact amounts. We keep an anonymized version that can no longer identify you: for example the administrative region, the first two digits of the industry sector, a range for the number of employees, the project types, the programs viewed and the month of creation. For a household, the exact income is destroyed; a broad income range is kept only if you gave your income with your consent. This version has no link to your profile or your account.

This anonymized version is kept for 10 years, then destroyed. It is used for statistics, for studies shared with researchers and for our annual report. It is never sold and never used to train an AI. We only publish aggregated data, where every number covers at least 10 people. We keep a register of these anonymizations and reassess every year the risk that a person could be recognized.

Your rights

You can request access to your information, its correction, its deletion, a copy in a common format (portability), and withdraw your consent. Most of this can be done directly in your profile or in My account: the "Export my data" button downloads, as a JSON file, your account (without your PIN), your profiles and answers, the assistance you received, your program tracking and your payments. For the rest, write to us through the form.

Cookies

The site uses three cookies, with no advertising identifier and no tracking across sites. The first remembers your profile so you can find your results again. The second, set only by the Google Play app, tells us this device has the app. The third records whether the page is shown in the installed app or in a browser; its value is "app" or "web", and we use it to count, on our own servers, how much each platform is used. They are part of the service, and accepting them is part of the terms of use. Cloudflare's traffic measurement works without cookies. Your choice to close the information banner is kept in your browser, not on our side.

Incidents

If a confidentiality incident presents a risk of serious injury, we notify the people affected and the competent authority (Commission d'accès à l'information, the federal Privacy Commissioner or a provincial commissioner), and we record it in our register of incidents.

Changes

We date every version of this policy. If a change affects how your information is used, we will notify you by email before it applies.