FundMyCourse.ca Privacy Policy

Effective Date: March 27, 2026 Last Updated: September 26, 2026 Version: 1.6

Plain-Language Summary

FundMyCourse.ca helps you find scholarships and education funding. To do that, we need to know some things about you — like what you are studying and where you live. This policy explains what we collect, why, and what we do with it in straightforward terms.

FundMyCourse.ca is operated by BBN Labs Inc., which is responsible for the personal information described in this policy.

The short version: We collect only what we need to match you with funding. We store it securely. We never sell it. You can delete it any time.

1. About This Policy

This Privacy Policy explains how FundMyCourse.ca ("we," "us," "our"), operated by BBN LABS INC, a Canadian federal corporation, collects, uses, discloses, and protects personal information. This policy applies to all users of the FundMyCourse.ca website and related services.

FundMyCourse.ca is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and complies with all 10 Fair Information Principles established under that legislation. We also comply with Canada's Anti-Spam Legislation (CASL) for all commercial electronic messages.

For users in Quebec, we additionally comply with Law 25 (An Act to modernize legislative provisions as regards the protection of personal information). For users in Alberta and British Columbia, we comply with the respective Personal Information Protection Acts (PIPA).

Privacy Officer: The Director of BBN LABS INC serves as Privacy Officer. Contact: info@fundmycourse.ca

2. The 10 PIPEDA Fair Information Principles

Our privacy practices are built on the 10 Fair Information Principles required by Schedule 1 of PIPEDA. Each principle is addressed throughout this policy and summarized here.

Principle 1: Accountability

BBN LABS INC is responsible for all personal information in our possession or under our control. Our Privacy Officer (the Director of BBN LABS INC) is accountable for compliance with this policy and with PIPEDA. We maintain documented internal procedures and ensure that any third-party service providers we use are contractually bound to protect your information to standards equivalent to our own.

You may contact our Privacy Officer at info@fundmycourse.ca with any questions or concerns.

Principle 2: Identifying Purposes

We identify the purposes for collecting personal information at or before the time of collection. The specific purposes are detailed in Section 4 of this policy. If we ever need to use your information for a new purpose not previously identified, we will obtain your consent before doing so.

Principle 3: Consent

We obtain your meaningful, informed consent before collecting, using, or disclosing your personal information. We use plain language (not legal jargon) to explain what we are collecting and why. You can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may limit our ability to provide certain services (for example, scholarship matching requires knowing your province and education level).

For details on how consent works for minors, see Section 7.

Principle 4: Limiting Collection

We collect only the personal information necessary to fulfill the identified purposes. We do not collect Social Insurance Numbers, bank account details, detailed financial records, medical records, credit scores, biometric data, or precise geographic location. See Section 3 for a complete list of what we do and do not collect.

Principle 5: Limiting Use, Disclosure, and Retention

Personal information is used only for the purposes for which it was collected, as described in Section 4. We do not sell, rent, trade, or otherwise share personal information with third parties for their own marketing purposes. Ever. Data retention periods are described in Section 8.

Principle 6: Accuracy

We take reasonable steps to ensure personal information is accurate, complete, and up-to-date for the purposes for which it is used. You can review and update your information at any time through your account settings.

Principle 7: Safeguards

We protect personal information with security safeguards appropriate to the sensitivity of the information. Technical safeguards include encryption in transit (TLS) and role-based access controls. Organizational safeguards include documented security procedures and periodic internal security reviews. Physical safeguards are handled by our hosting provider (see Section 5). See Section 9 for full details.

Principle 8: Openness

This privacy policy is publicly available on our website. We provide clear information about our privacy practices to anyone who asks.

Principle 9: Individual Access

You have the right to access your personal information held by FundMyCourse.ca. To access or export your data, email info@fundmycourse.ca and we will respond within 30 calendar days. A self-serve export from account settings is planned; until it ships, email is the way to exercise this right.

Principle 10: Challenging Compliance

You have the right to challenge our compliance with this policy and with PIPEDA. Complaints should be directed to our Privacy Officer at info@fundmycourse.ca. We will investigate all complaints and respond within 30 calendar days. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

3. What Personal Information We Collect

3.1 Information You Provide Directly

3.2 Information Generated Through Your Use of the Service

3.3 Information Collected Automatically

3.4 Information We Do NOT Collect

We do not collect and will never ask for:

• Social Insurance Numbers (SIN)
• Bank account numbers or financial account details
• Credit card numbers or other payment details (the site has no paid features, so we never ask for them)
• Detailed income or tax information
• Medical records or health information
• Credit scores
• Biometric data (fingerprints, facial recognition, etc.)
• Precise GPS location
• Social media passwords or private messages

4. How We Use Your Information

We use your personal information for the following purposes, and no others:

1. Scholarship and funding matching: Comparing your profile with eligibility criteria in our database to surface relevant opportunities.
2. Account management: Creating, maintaining, and securing your account.
3. Discovery aids: Powering your saved list, in your browser and, if you are signed in, with your account, so you can keep track of which opportunities you flagged.
4. Service improvement: Analyzing aggregated, anonymized usage patterns to improve search, matching, and user experience.
5. Communication: Important account and service messages, and email digests only if you subscribe to them. Apart from those, we currently send no emails: no marketing emails and no reminder emails.
6. Legal compliance: Responding to lawful requests from government authorities as required by Canadian law.

We do NOT use your information for:

• Targeted advertising
• Selling to data brokers
• Sharing with educational institutions without your explicit consent
• Profiling for credit, insurance, or employment decisions
• Any purpose not listed above without obtaining your consent first

5. How and Where We Store Your Information

5.1 Where Your Data Is Stored

Your personal information, including your account details, the education profile you give us, and any optional sensitive fields you choose to share, is stored on a virtual private server operated by our hosting provider, Hostinger. That server is located in Boston, Massachusetts, United States (see Section 13.1). A copy of each nightly database backup, which includes this account data, is also kept on a second server we operate in Ontario, Canada (see Section 5.3). If where we store personal information materially changes, we will update this policy.

5.2 Encryption and Security

• In transit: All data transmitted between your browser and our servers is encrypted using TLS (version 1.2 or 1.3, depending on your browser).
• Passwords: Stored as salted, one-way cryptographic hashes. We cannot see your password and do not store it in readable form.
• Access controls: Access to the database and servers is restricted to authorized personnel.

5.3 Backups

We back up the database every night. Backups are kept for 14 days on the hosting server in Boston and for 31 days on a second server we operate in Ontario, Canada. Backup files are not encrypted; both copies are readable only by our administrator account. Backups follow the deletion schedule in Section 8.

6. Who We Share Your Information With

6.1 The Short Answer

Nobody. We do not sell, rent, trade, lease, or otherwise disclose your personal information to any third party for their own purposes. This is a founding commitment of FundMyCourse.ca and will not change.

6.2 Third-Party Service Providers

We use a limited number of third-party services to operate the platform. These services process data on our behalf and are contractually bound to use it only for the purposes we specify:

We do not use any third-party analytics service that tracks individual users. All usage analytics are processed in-house using anonymized, aggregated data. We measure aggregate platform performance (for example, "how many people clicked Apply on this scholarship today") without storing any personal information or tracking individuals across sessions.

6.3 Legal Disclosure

We may disclose personal information if required to do so by law, regulation, or court order, or if we believe in good faith that disclosure is necessary to protect the safety of any person or to prevent illegal activity. We will notify the affected user of any such disclosure unless prohibited by law from doing so.

6.4 Business Transfer

If FundMyCourse.ca is acquired, merged, or undergoes a change of ownership, your personal information may be transferred as part of that transaction. We will notify you by email and by prominent notice on our website before your information is transferred and becomes subject to a different privacy policy. You will have the option to delete your account and data before any such transfer.

7. Children and Minors

FundMyCourse.ca serves students of all ages, including high school students in Grades 9-12 who are typically aged 13-17. We take the protection of young users seriously.

7.1 Children Under 13

We do not knowingly collect personal information from children under the age of 13. If a user indicates during registration that they are under 13, we advise them to involve a parent or guardian before continuing.

If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete that information promptly. If you are a parent or guardian and believe we have inadvertently collected information about your child, please contact us at info@fundmycourse.ca and we will delete the information within 30 days.

This approach aligns with PIPEDA requirements for meaningful consent from minors.

7.2 Users Aged 13-17

Under PIPEDA, individuals aged 13-17 can generally provide their own consent if they can reasonably be expected to understand the nature and consequences of the collection, use, or disclosure. Our approach:

1. Registration uses plain, age-appropriate language to explain what information we collect and why.
2. We recommend that users aged 13-17 discuss account creation with a parent or guardian.
3. Consent forms are written at a reading level appropriate for the user's stated age.
4. We do not collect sensitive financial information from users under 18 without parental consent.
5. Users aged 13-17 have the same rights to access, correct, and delete their information as adult users.

7.3 Users 18 and Over

Standard informed consent processes apply.

8. Data Retention

9. Security Measures

We implement the following safeguards to protect your personal information:

Technical Safeguards

• TLS encryption (version 1.2 or 1.3) for all data in transit
• Salted, one-way hashing for passwords
• Role-based access controls
• Daily database backups, access-restricted in the same way as live systems (see Section 5.3)

Organizational Safeguards

• Principle of least privilege for data access
• Regular review of access permissions

Breach Response

In the event of a data breach that poses a real risk of significant harm, we will:

1. Notify the Office of the Privacy Commissioner of Canada as soon as feasible.
2. Notify affected users directly by email and by notice on our website.
3. Describe the nature of the breach, the information involved, and the steps we are taking.
4. Provide guidance on what affected users can do to protect themselves.

10. Cookies

10.1 What Cookies We Use

That is the whole list.

10.2 What We Do Not Use

• We do not use third-party tracking cookies. We do not use any third-party analytics service that tracks individual users.
• We do not use advertising cookies.
• We do not use cookies for cross-site tracking.
• We do not use fingerprinting or any other covert tracking technology.
• Our usage analytics run on software we host ourselves and do not use cookies.

10.3 What We Keep in Your Browser Instead

Some features save their state in your browser's local storage, which stays on your device: your saved scholarships list and simple preferences such as whether you have dismissed a notice. If you are not signed in, your saved list is kept in your browser, not in an account; to show it, the Saved page asks our server for each saved award's details, the same way it loads any page, and we do not store that list. If you are signed in, it is also stored with your account (see Section 3.1). Clearing your browser's site data removes everything kept in your browser.

10.4 Your Cookie Choices

Because the only cookies we set are the essential sign-in cookies, we do not show a cookie banner. You can block or delete cookies in your browser settings at any time. Blocking cookies only affects signing in; browsing, searching and the quiz work without any cookies.

For more details, see our Cookie Policy.

11. Your Rights

As a user of FundMyCourse.ca, you have the following rights regarding your personal information:

We will respond to all rights requests within 30 calendar days. There is no fee for exercising these rights.

12. CASL Compliance (Canada's Anti-Spam Legislation)

FundMyCourse.ca complies with Canada's Anti-Spam Legislation (CASL) for all commercial electronic messages (CEMs).

12.1 Consent for Commercial Messages

We obtain your express consent before sending any commercial electronic messages, including:

• Partner scholarship highlights
• Newsletter content
• Feature announcements

Express consent is obtained through a clear, affirmative opt-in action (e.g., checking a box during registration that is unchecked by default). We never use pre-checked boxes. We never bundle consent for commercial messages with consent for essential service messages.

12.2 Implied Consent

We may rely on implied consent to send commercial messages only in the following limited circumstances, as permitted by CASL:

• You have made an inquiry about our services within the past 6 months.

12.3 Transactional and Service Messages

The following messages are NOT commercial electronic messages under CASL and do not require express consent:

• Scholarship deadline reminders for scholarships you have saved
• Account security notifications (password reset, login alerts)
• Service disruption notices
• Responses to your support requests
• Changes to our terms or privacy policy

12.4 Unsubscribe Mechanism

Every commercial electronic message we send includes:

• A clear, prominently displayed unsubscribe link
• An unsubscribe mechanism that works for at least 60 days after the message is sent
• Processing of unsubscribe requests within 10 business days (CASL maximum)

12.5 Sender Identification

Every commercial electronic message we send includes:

• The name of the sender (FundMyCourse.ca)
• Our mailing address
• A working contact method (email or web link)

12.6 Record-Keeping

We maintain records of:

• When and how consent was obtained for each recipient
• The content and sending date of each commercial message
• All unsubscribe requests and the dates they were processed

13. Quebec Law 25 Compliance

For users who are residents of Quebec, the following additional provisions apply under Quebec's Act respecting the protection of personal information in the private sector (Law 25):

• We have designated a person responsible for the protection of personal information (our Privacy Officer).
• We conduct Privacy Impact Assessments (PIAs) before implementing any new system or project that involves personal information of Quebec residents.
• We publish information about our privacy governance policies and practices.
• We provide notice of any privacy incidents involving Quebec residents to the Commission d'acces a l'information du Quebec (CAI) and to the affected individuals.
• Quebec residents have the right to data portability in a commonly used technological format.

13.1 Cross-Border Transfer Notice

Under Section 17 of Law 25, we are required to inform Quebec residents when personal information is communicated outside Quebec for processing.

The server that hosts this site is located in Boston, Massachusetts, United States. It stores your account and profile data: your name, email address, education profile, the awards you save while signed in, and any optional sensitive fields you choose to give us, such as Indigenous identity or disability status. Nightly backup copies of this data are also kept on a second server we operate in Ontario, Canada (see Section 5.3). The same Boston server runs our usage analytics, which are processed in-house using analytics software we host ourselves; they are not shared with a third-party analytics service such as Google Analytics. Your account and profile data and our usage analytics are therefore communicated outside Quebec and are subject to the laws of the United States, including lawful-access requests by United States authorities. If you subscribe to email digests, your email address and saved-search context are processed by Brevo, whose servers are located in the European Union; by subscribing, that information is also communicated outside Quebec for the purpose of sending your digest. We will update this section before engaging any additional cross-border processor.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do:

1. We will update the "Last Updated" date at the top of this document.
2. For material changes, we will notify you by email at least 30 days before the changes take effect.
3. For material changes, we will also display a prominent notice on the website.
4. Continued use of the service after the effective date of changes constitutes acceptance of the updated policy.
5. If you do not agree with the changes, you may delete your account before the effective date.

We will not retroactively change how we handle information collected under a previous version of this policy without your consent.

15. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices:

Privacy Officer FundMyCourse.ca (operated by BBN Labs Inc.) Email: info@fundmycourse.ca

We will acknowledge receipt of your inquiry within 5 business days and provide a substantive response within 30 calendar days.

If you are not satisfied with our response, you may contact:

Office of the Privacy Commissioner of Canada Website: www.priv.gc.ca Phone: 1-800-282-1376

Commission d'acces a l'information du Quebec (for Quebec residents) Website: www.cai.gouv.qc.ca