RoboGrant9000 Privacy Policy

This policy explains what personal information CHUDAK INC. o/a RoboGrant9000 collects, why we collect it, who processes it, and the rights you have. It is structured around PIPEDA's ten fair-information principles (each section notes the principle(s) it implements), and a PIPEDA cross-reference table appears at the end.

Effective date: June 1, 2026 Version: 1.0

The short version

• RoboGrant9000 is a grant-research and grant-writing service for Canadian nonprofits. Your organization is our customer; the people on your team who use the portal are its authorized users.
• Your organization's data is stored in Canada (our primary database and document storage run in the AWS Canada–Central region in Montréal).
• To do the work — AI research, drafting, sign-in, payments — some information is processed outside Canada, mainly in the United States, by the service providers listed in this policy. We tell you exactly who they are and what they receive.
• We use your information to provide the service. We do not sell it, and we do not use it for advertising.
• Under our AI providers' commercial terms, the data we send them through their APIs is not used to train their AI models.
• You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Write to support@robogrant9000.com.

1. Who we are, and who is accountable

(PIPEDA Principle 1 — Accountability)

RoboGrant9000 is operated by CHUDAK INC., a corporation incorporated in Ontario, Canada, operating as ("o/a") RoboGrant9000, with a registered office at 2300 Yonge Street, Suite 1600, Toronto, Ontario M4P 1E4, Canada ("CHUDAK INC.", "RoboGrant9000", "we", "us"). We provide an AI-assisted grant-research and grant-writing service to Canadian nonprofit organizations through the portal at https://robogrant9000.com.

We have designated a Privacy Officer who is accountable for our compliance with this policy and with Canadian privacy law. That person is the founder. As PIPEDA permits, we provide the Privacy Officer's name on request; you can reach the role directly at the address below.

How to reach us about privacy: email support@robogrant9000.com with "Privacy" in the subject line. This is a live, monitored mailbox.

Our role and your organization's role

RoboGrant9000 is a business-to-business service. Our customer is your organization — one nonprofit per account. Your organization decides what information to put into the service (for example, which documents to upload), and we process that information to deliver the service to your organization. Where your organization uploads documents that contain other people's personal information — staff, clients, volunteers, donors — your organization is responsible for having the authority to share that information with us, and we handle it only to provide the service. This allocation of responsibility is restated contractually in the Terms of Service and our data-processing terms, and the three documents are kept aligned.

2. Whose information this policy covers

• Portal users (seat holders): people your organization invites to use the service.
• Billing admins: the person (or people) who manage your organization's subscription and seats — the Terms of Service calls them "billing admins."
• Invitees: people whose email address your organization enters to send a seat invitation, even before they accept.
• Third parties in your documents: people whose personal information appears in material your organization uploads (for example, names in an annual report or financial statement).

3. What we collect

(PIPEDA Principles 2 and 4 — Identifying Purposes; Limiting Collection)

We collect only what we need to run the service. In plain terms:

Account and sign-in information. Your name, email address, and sign-in credentials, managed by our authentication provider (Clerk). If you sign in with Google, we receive your Google account identity (name and email) through that sign-in. We also hold your organization membership, your role (billing admin and/or portal seat), and the email addresses of people invited to take a seat.

Organization profile and registration data. Your organization's legal name, CRA business number, charitable registration status, website, and the communities and regions you serve. Most of this is information about an organization rather than a person, but we treat it with the same care.

Uploaded documents. Financial statements, T3010 filings, past proposals, annual reports, and similar files your organization uploads (PDF, Word, Excel, CSV, and common image formats, up to 50 MB each). These may contain your organization's internal and financial information, and sometimes personal information about staff, clients, or donors. We extract the text of these documents so the AI can use it in research and drafting.

Research outputs and drafts. The organization profile our research builds, the evidence and sources it collects (every statistic is stored with its source, exact quote, and dates), grant-opportunity tracking records and fit scores, and the drafts the AI generates.

Public web information. To support research, the AI gathers publicly available statistics and reports from the open web (Statistics Canada and other public sources, stored with citations). This is information about sectors, regions, and communities — not normally about identifiable people — and we do not use web research to build profiles of individuals.

Conversations with the AI. Your chat messages and the AI's responses, including a stored summary of the AI's reasoning ("thinking") for each response. Conversations are attributed to the individual user who wrote them, and they are kept even if the related draft or tracker entry is later removed — your history stays available to your team.

Usage and billing data. Per-user usage records (which AI features were used, when, and the associated processing volume and internal cost), and subscription and billing records. Payment details — payer email, payment method, invoices — are held by our payment processor (Stripe); we never see or store full card numbers.

Operational and audit records. Logs of sensitive account and billing actions (who did what, when), and records of payment-system events. These protect your organization and us.

Error telemetry. Our error-monitoring tool (Sentry) is enabled in production. It captures technical error reports limited to error details and internal record identifiers — not personal information. We limit error reports to non-personal technical data.

We do not collect information for advertising, and we do not buy data about you from anyone.

4. Why we collect it

(PIPEDA Principle 2 — Identifying Purposes)

Each category above maps to a purpose in the service:

If we ever want to use your information for a new purpose not described here, we will tell you first and seek consent where the law requires it.

5. Consent

(PIPEDA Principle 3 — Consent)

Your organization consents to the collection, use, and disclosure of information as this policy describes by creating an account and accepting our Terms of Service, which incorporate this policy — including the AI processing and the cross-border transfers in sections 6–8, which are integral to how the service works. Individual users consent by signing in and using the service after being granted access.

You can withdraw consent by closing the account or asking us to delete the information we hold (section 12). Withdrawing consent for processing that the service depends on (for example, AI processing of your documents) means we can no longer provide that part of the service.

6. How the AI processing works — what leaves our systems

(PIPEDA Principles 2, 3, and 8 — Purposes; Consent; Openness)

This is the part of the service most worth understanding clearly.

To produce research, drafts, and chat responses, we send relevant parts of your organization's information to our AI providers for processing:

• Anthropic (United States) receives your organization's profile (mission, programs, financial summary, communities served, writing voice), extracts of your uploaded documents, draft contents, your chat messages, and your CRA business number (for eligibility checks), to perform drafting, chat, and extraction.
• Voyage AI (United States) receives text passages from your organization's knowledge base, research evidence, and search queries, to convert them into the numerical form ("embeddings") that powers search and retrieval inside the service.
• xAI (United States) receives your organization's profile context and research queries to perform live web research over public sources on our behalf — discovering grant opportunities and gathering sector and community statistics — on xAI's infrastructure.

Two commitments matter here:

1. No model training on your data. Under the commercial terms we use with these providers, data submitted through their APIs is not used to train their AI models.
2. Human review, human sign-off. The AI drafts; your team reviews, edits, and decides what to submit. The AI's research citations carry their sources, quotes, and retrieval dates so your team can check them.

We also store, with each AI chat response, a summarized record of the model's reasoning. This is part of your conversation history and is covered by the same protections as the rest of your data.

No automated decisions about people. The service does not make decisions about individuals by automated means. Fit scores and eligibility assessments are estimates to help your team prioritize opportunities; people at your organization review the AI's work and make the decisions, and funders decide funding outcomes.

7. Who else processes your information (service providers)

(PIPEDA Principles 1 and 8 — Accountability for transfers; Openness)

We use a small set of service providers ("subprocessors") to run RoboGrant9000. We remain accountable for your information when it is in their hands, and we use contractual terms with each of them. Your data's primary home is Canada — the database and document storage below come first for a reason.

We do not disclose your information to anyone else except: (a) where your organization directs us to; (b) where the law requires us to (for example, a valid court order — in which case we will notify your organization unless we are legally barred from doing so); or (c) in connection with a sale or reorganization of our business, in which case your information remains protected by terms at least as protective as this policy.

8. Where your information goes — cross-border transfers

(PIPEDA Principles 1 and 8; Quebec Law 25)

Stored in Canada, processed partly outside it. Your organization's data is stored in Canada (Supabase on AWS ca-central-1). But, as the table above shows, providing the service involves processing in the United States and on global infrastructure: AI processing, embeddings, sign-in, payments, hosting, background job execution, and error monitoring.

When your information is processed outside Canada:

• it is protected by our contracts with each provider, which require protection comparable to what this policy promises;
• it may nonetheless be subject to the laws of the country where it is processed, and could be accessible to courts and authorities there under local law.

We chose a Canadian primary data store deliberately, and we will keep it in Canada.

Québec organizations. For personal information about individuals in Québec, before that information is processed outside Québec we conduct a privacy impact assessment as Québec's Law 25 (Act respecting the protection of personal information in the private sector, C.Q.L.R. c. P-39.1, s.17) requires — weighing the sensitivity of the information, the purposes for which it is to be used, the contractual and other protection measures that apply, and the legal framework of the destination, including the United States providers listed above. We maintain a register of confidentiality incidents as Law 25 requires, and a French-language version of this policy is available to Québec customers on request.

9. Limits on use, disclosure — and who at RoboGrant9000 can see your data

(PIPEDA Principle 5 — Limiting Use, Disclosure, and Retention)

We use your information only for the purposes in section 4. We do not sell personal information. We do not use your data to advertise to you or anyone else. We do not use one customer's data to serve another customer.

Provider staff access. RoboGrant9000 is a high-touch service. Our staff can access your organization's data through an internal administration console and service-level database access — on a need-to-know basis for provisioning your account, quality assurance, and support. That access is limited to what the task needs, and sensitive actions are logged. Our staff are bound by confidentiality obligations.

10. How long we keep it, and how deletion works

(PIPEDA Principle 5 — Limiting Use, Disclosure, and Retention)

While your account is active: we keep your organization's data for the life of the account so the service can do its job. Conversation history is deliberately durable — it stays available to your team even when a related draft or tracker entry is removed. Usage records and audit logs are kept for the life of the account for billing accuracy and security accountability.

When your subscription ends: your organization's data is not deleted automatically. For 30 days after the subscription ends, your billing admin can ask us for an export of your organization's data (see the Terms of Service). Deletion then happens on request, as described next.

Deletion on request: when your organization makes a verified deletion request — or after the 30-day post-termination export window described above — we delete your organization's database records (profile, intake, documents metadata, research, evidence, drafts, conversations, tracking, usage and audit records) and the uploaded files in storage within 30 days.

What survives deletion:

• Billing and tax records held by us and by Stripe, kept as long as financial and tax law requires;
• Sign-in records at our authentication provider until removed there as part of the deletion process;
• short-lived technical logs at our service providers (for example, background job logs), which expire on those providers' standard schedules;
• anything we must keep to meet a legal obligation or defend a legal claim.

11. How we protect it

(PIPEDA Principle 7 — Safeguards)

• Encryption in transit (TLS) and at rest, on our infrastructure providers' platform-standard encryption.
• Tenant isolation: every organization's records are separated at the database level by row-level security — the database itself refuses cross-organization access, and we test this isolation automatically in our build pipeline.
• Least privilege: elevated database credentials exist only in server-side code; per-seat access is enforced both in the application and in the database; seat limits are enforced by the database itself.
• Payment security: payment events are signature-verified and idempotent; we never hold card numbers (Stripe does).
• Audit logging of billing and other sensitive actions.
• Secrets management: credentials live in platform secret stores, never in prompts, client code, or the repository.

No system is perfectly secure, and we won't pretend otherwise. We do not currently hold a SOC 2 or similar certification, and we don't claim one.

12. Your rights: access, correction, deletion, withdrawal

(PIPEDA Principles 4, 6, 9 — Limiting Collection; Accuracy; Individual Access)

Any individual whose personal information we hold can:

• Ask what we have. We will tell you what personal information we hold about you, what we use it for, and who it has been disclosed to.
• Ask us to correct it. If something is wrong or incomplete, we will fix it. (Much of your data is directly editable in the portal — that is usually fastest.)
• Ask us to delete it. Subject to the survivals in section 10.
• Withdraw consent. Subject to the service consequences in section 5.

How: email support@robogrant9000.com with "Privacy request" in the subject. We will verify your identity, respond within 30 days as PIPEDA requires (s.8(3)), and tell you if we need more time (the law allows an extension in limited cases) or if a legal exception prevents us from fulfilling part of the request — and which one. There is no fee for a reasonable request.

Because our customer is your organization, requests about organization data (for example, deleting the whole account) must come from your organization's authorized administrator. Requests about your own personal information can come from you directly.

Accuracy note: the AI's research outputs carry citations — source, exact quote, publication and retrieval dates — and a verification pass re-opens cited sources to confirm each quote. Evidence is labelled in drafts as verified or pending verification (a pending label means exactly that — not yet confirmed), and claims the system could not support are flagged to your team as unresolved, never silently included. This is an accuracy mechanism for the work product, and human review remains part of the design; for your account information, the correction right above applies.

13. Cookies

(PIPEDA Principles 3 and 8 — Consent; Openness)

We use only strictly necessary cookies — the session cookies our authentication provider (Clerk) sets to keep you signed in securely. We do not use advertising cookies, analytics trackers, or social-media pixels. If that ever changes, we will update this policy and, where required, ask for consent first.

14. Email from us (CASL)

(Canada's Anti-Spam Legislation)

The only email the platform sends today is transactional and operational: sign-in and seat-invitation emails, grant-deadline reminders and operational notices, and billing receipts and payment notices. These relate directly to your account and the service you are paying for, and are not the marketing commercial electronic messages that CASL (S.C. 2010, c. 23) targets.

We do not send marketing email. If we ever introduce it, we will do so on an express-consent, easy-unsubscribe basis as CASL requires (ss.6 and 11) — you will be asked, not defaulted in.

15. If something goes wrong (breach notification)

(PIPEDA — breach of security safeguards)

If a breach of our security safeguards creates a real risk of significant harm to individuals, we will notify the affected individuals and report to the Privacy Commissioner of Canada as soon as feasible, as PIPEDA requires (s.10.1). We will notify other organizations or government institutions that can reduce the risk of harm (s.10.2), and we will keep and maintain a record of the breach (s.10.3). We will also promptly notify the affected customer organization, with what we know: what happened, what information was involved, what we have done, and what we recommend.

16. Questions, complaints, and challenging our compliance

(PIPEDA Principle 10 — Challenging Compliance)

If you have a question, concern, or complaint about how we handle personal information, contact our Privacy Officer at support@robogrant9000.com. We will investigate and respond, and if something in our practices needs fixing, we will fix it.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca, 1-800-282-1376). Québec residents may also contact the Commission d'accès à l'information du Québec.

17. Changes to this policy

When we change this policy, we will update the effective date at the top and give customer organizations at least 30 days' notice of material changes (by email to the billing admin and/or a notice in the portal) before they take effect — the same notice standard as the Terms of Service. Continued use of the service after the effective date means the updated policy applies. Because this policy forms part of the Terms of Service, the two are kept in lockstep.

Appendix — PIPEDA principle cross-reference

Québec Law 25 touchpoints: §1 (privacy officer), §6 (no automated decisions about individuals), §8 (cross-border privacy impact assessment, register of confidentiality incidents, French-language version on request), §15 (breach record-keeping), §17 (transparency).