DRAFT — pending final legal review. The structure below reflects what will be in effect; specific wording may be revised before the alpha cohort launch on 2026-05-22.

Privacy Policy

Effective date: 2026-05-22 (alpha cohort launch). Last updated: 2026-05-12.

1. Who we are

L-SPARK Corporation (the “Company”, “we”, “us”) operates the L-SPARK Benefits Finder, a conversational tool that helps Canadian small businesses identify federal and provincial funding programs that may fit their situation. L-SPARK Corporation is the data controller for personal and business information processed through this service.

Privacy questions, requests, and concerns: privacy@l-spark.com.

Privacy officer designation (Quebec Law 25): [LEO TO CONFIRM — default per Law 25 is the most senior officer of the organization. Suggested: name and title here, plus same privacy@l-spark.com contact.]

2. What we collect

When you use the Benefits Finder, we collect:

Conversational content— the messages you type into the chat (business description, sector, revenue, funding ask, team size, R&D activity, founder demographics if you volunteer them).
Derived facts— structured fields the system extracts from your messages to match against program eligibility (province, sector, funding need type, revenue band, employee count, capital ask, R&D activity).
Session metadata — a randomly-generated session identifier stored in a first-party browser cookie (lspark_session, 30-day expiry, HTTP-only, secure); IP address and user-agent string for the request; timestamps.
Admin authentication data (for L-SPARK staff only) — email, password hash, and MFA secret are managed by our authentication subprocessor (Clerk).

We do not request a user account during the alpha. We do not collect payment information, government identifiers, banking details, or health information.

3. Why we collect it

To match your business description against the funding-program corpus and surface relevant matches.
To maintain a session so the conversation persists across messages.
To monitor service performance, debug errors, and protect against abuse.
To improve the program-matching quality (we may review anonymized conversation patterns to refine the model and corpus).

4. Where it is stored

All conversation data is stored in the ca-central-1 (Montreal)AWS region. Inference is performed by Anthropic Claude via AWS Bedrock, also in ca-central-1. Web hosting is on Vercel's YUL1 (Montreal) edge.

5. Subprocessors

Subprocessor	Purpose	HQ	Processing region
Vercel	Hosting + edge CDN	USA	YUL1 (Montreal, Canada)
Anthropic via AWS Bedrock	Conversational AI inference	USA	ca-central-1 (Montreal, Canada)
Supabase	Application database + vector store	USA	ca-central-1 (Montreal, Canada)
Upstash	Rate-limit counter (Redis)	USA	ca-central-1 (Montreal, Canada)
Clerk	Admin authentication + MFA	USA	USA (admin access only — no founder data)

We may transfer business and personal information outside of Canada when subprocessors require it (e.g., Clerk operational metadata). By using the service you consent to these cross-border transfers, which are documented above.

6. Retention and deletion

Conversation data is retained for 12 months from your last use of the service, then permanently deleted. You may request deletion of your conversation data at any time by emailing privacy@l-spark.comwith the session identifier from your browser's lspark_session cookie. We will confirm deletion within 30 days.

7. Automated decision-making

The Benefits Finder uses an automated AI system (Anthropic Claude) to extract facts from your business description and match them against program eligibility criteria. The system's recommendations are informational only and do not replace advice from a funding consultant, the program administrator, or a qualified legal or financial advisor. If you believe a result is wrong or wish to have a human review the match, contact us at privacy@l-spark.com.

This disclosure satisfies the transparency requirements of Quebec's Loi 25 (Loi modernisant des dispositions législatives en matière de protection des renseignements personnels) and the proposed federal Consumer Privacy Protection Act (Bill C-27).

8. Your rights

Under PIPEDA, Quebec Law 25, and other applicable Canadian privacy law, you have the right to:

Access the personal information we hold about you.
Request correction of inaccurate information.
Request deletion of your conversation data.
Withdraw consent at any time.
Receive your data in a portable format (Quebec Law 25 data-portability right).
Lodge a complaint with the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.

Email privacy@l-spark.com to exercise any of these rights.

9. Cookies

We use one functional cookie — lspark_session — to maintain your conversation across messages. It is HTTP-only, Secure, SameSite=Lax, and expires after 30 days. We do not use advertising cookies, analytics cookies, or third-party tracking cookies.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via a notice on the homepage at least 30 days before they take effect. The current version is always available at https://lsparkbenefitsfinder.ca/privacy.

11. Contact

Privacy questions, access requests, or complaints:
Email: privacy@l-spark.com
Mail: L-SPARK Corporation, [STREET ADDRESS TO CONFIRM], Kanata, ON, Canada