Privacy Policy

GrantSpring helps nonprofits with website readiness reviews, story and campaign support, Google for Nonprofits preparation, and Google Ad Grants readiness support. This Privacy Policy explains what information we collect when you use grantspring.ca, how we use it, and how to contact us about it.

GrantSpring collects information you submit through the readiness checker and the contact form on this website. Depending on what you choose to share, this may include:

• Organization name and website URL
• Contact name, email address, and phone number
• Country your organization is registered in
• Preferred contact method (email, phone, WhatsApp, video call)
• Answers to the Google Ad Grant readiness questions
• Whether you are interested in a strategy call
• Any message or notes you choose to send us

We do not require you to create an account to browse the site, and we do not knowingly collect information from children.

GrantSpring uses the information you submit to:

• Respond to your inquiry or message
• Review your website and readiness needs for Google for Nonprofits and Google Ad Grants
• Provide recommendations tailored to your organization
• Prepare proposals or quotes for services you ask about
• Support ongoing services you engage us for, including website, story, campaign, and Ad Grant work

GrantSpring does not sell personal information. We do not rent or trade your contact details to third parties for their own marketing.

Payments may be processed by third-party payment providers such as Stripe, PayPal, or another payment processor. These providers handle card and payment account information directly under their own privacy and security practices. GrantSpring does not store full card, bank, or payment account details on our systems.

We rely on a small set of trusted service providers to operate the website, host data, and deliver notification emails about submissions you send us. These providers process information only on our behalf and only as needed to deliver their service.

These providers are: our database and hosting platform, our transactional email provider, Google PageSpeed Insights (mobile usability measurement), Cloudflare Turnstile (bot protection), and the controlled fetching service used by the Website Foundation Scan. Information is transferred to our internal GrantSpring Command Center CRM so our team can follow up with you.

If you ask us to review a website, we record the address you submit, confirm you are authorized to request the review, and retrieve a small number of publicly accessible pages from that site. We look only at pages anyone can visit. We never sign in, never submit forms, and never send cookies or credentials.

What we store: the page addresses reviewed with any query string removed, the outcome of each check, and short excerpts of public page text (200 characters or fewer) with email addresses, phone numbers, and postal codes masked before they are saved. What we never store: the raw code of your pages, full addresses containing query strings, or any content behind a login.

Automated scoring. The score is produced automatically and is preliminary. Where we could not confirm something, we say so rather than counting it against you, and when too little of a site can be reviewed we withhold the number entirely. A score is a starting point for a conversation. It is not a determination of grant eligibility, is not made by Google or any funder, and has no legal effect. You can always ask a person to review the result.

Report delivery. To email you a full report we first confirm you control the email address by sending a single-use link that expires after 15 minutes. The link is personal — please do not forward it.

Agreeing to receive your report is separate from agreeing to receive marketing. Marketing is never a condition of getting your report, is never pre-ticked, and requires a second confirmation click before we send anything. We keep a record of exactly what you agreed to and when.

You can withdraw consent at any time using the unsubscribe link in any marketing email or by emailing us. When you unsubscribe we keep an irreversible one-way fingerprint of your email address on a do-not-contact list, so that we can honour your request permanently without keeping your address itself.

We measure aggregate usage of the scan (for example, how many scans finish, and which broad score range they fall into). These measurements never include your name, email address, organization, website address, or any link or session identifier. If you arrive from a campaign link, we record only the campaign labels in the address.

• Page evidence from a scan — 30 days
• Scan check results and job records — 90 days
• Scan reports and scores — 12 months
• Contact details from a scan — 12 months after your last interaction, then permanently anonymized
• Records of what you consented to — while consent is active, and 24 months after you withdraw it
• Secure report links and sessions — deleted shortly after they expire (links last 15 minutes, sessions 7 days)
• Do-not-contact fingerprints — kept indefinitely, by design

You can request correction or deletion of the information you have submitted to GrantSpring at any time by emailing info@grantspring.ca. We will respond within a reasonable time frame.

Verifying a deletion request. To protect you, we never delete a record just because someone supplies an email address or a reference number. You must either be signed in to an active report session, or click a single-use confirmation link we email to the address on the record. We reply the same way whether or not an address exists in our system, so that no one can use a deletion request to discover who has contacted us.

Questions about this Privacy Policy or how your information is handled? Reach us at info@grantspring.ca.

We may update this Privacy Policy from time to time to reflect changes to our services or legal requirements. The latest version will always be available at this URL with an updated date.