GrantHop Privacy Policy

Effective date: October 1, 2026

Exacto Systems Inc. o/a Finnovate.io (“we,” “us” or “our”) operates GrantHop. This Policy explains how we collect, use, disclose and protect personal information in connection with granthop.com and the GrantHop platform. Personal information is information about an identifiable individual. Organizational information may also contain personal information. This Policy does not waive privacy rights or replace consent or other authority required by applicable law.

1 Information we handle

Account and contact information: names, email addresses, organizational affiliation, user roles, account authentication information and information provided when you contact us.

Workspace content: grant documents, attachments, prompts, generated drafts, task assignments, deadlines, approvals, comments and other information submitted or created by users, to the extent the relevant features are available. Content may contain personal information about employees, volunteers or other individuals.

Technical and usage information: usage analytics, browser or device type, logins, feature activity and error logs. Cookies and similar technologies are described in section 6. We receive information directly from users, from their organizational administrators or colleagues, and from connected services they authorize.

2 Why we use information

We use information to create and administer accounts; provide shared organizational workspaces; process documents and deliver requested extraction, drafting, task and reminder functions; manage permissions and approvals; respond to support requests; diagnose failures and assess feature reliability; protect accounts and investigate misuse; and comply with legal obligations. We use only information reasonably necessary for these purposes.

We send operational messages such as account, security and service notices. Any promotional messages are sent in accordance with applicable law, with required consent and an unsubscribe option. Refusing optional promotional messages does not prevent use of the Platform. We do not use this Policy as blanket consent for unrelated purposes. If we propose a new purpose requiring consent, we will explain it and obtain that consent before proceeding.

3 Organizations and individual users

The Organization determines what it submits, who may access its workspace, and how it uses the results. Organizational administrators and authorized colleagues can access information according to their roles and permissions. Contact your Organization about its own collection, disclosure, access and retention practices. We handle account and operational information for the purposes described here and process submitted workspace information to provide the service to the Organization. Our respective legal responsibilities depend on applicable law; the Organization’s responsibilities do not remove ours.

Organizations must have appropriate authority and provide required notices and obtain required consents before submitting information about others. Submit only what is necessary. GrantHop is not intended for sensitive beneficiary case files, health records, children’s personal information or government identifiers unless we separately agree in writing to appropriate arrangements. Redact unnecessary personal information before upload.

4 AI processing

Where an AI feature is used, relevant document text, prompts and associated context may be transmitted to the identified AI provider to produce the requested result. Do not submit content you are not authorized to send for that processing. AI output may reproduce personal information in source materials, so review it before sharing.

We do not use Organization Content to train general-purpose AI models, and we do not authorize our AI providers to use it for that purpose. Providers may retain limited information for security or abuse monitoring.

5 Who receives information

We disclose information to authorized users and administrators in the same Organization as needed for collaboration; service providers that help us operate the Platform; connected services you authorize; and recipients required or permitted by law. Service providers may include hosting, storage, authentication, AI processing, email delivery, monitoring and support providers. We require appropriate contractual protections and limit their access to the purposes for which they provide services.

We may disclose information to comply with lawful demands, protect legal rights and security, or investigate unlawful activity, where permitted by law. In a proposed or completed business transaction, information may be disclosed subject to appropriate confidentiality, use restrictions and other legal safeguards. We do not sell personal information or disclose it for third-party targeted advertising.

GrantHop does not disclose Organization Content to funders merely because you upload it. If you activate a sharing or integration feature, the information you authorize may be disclosed to that recipient. Review its terms and privacy practices.

6 Cookies and similar technologies

As you interact with this Site, we may use automatic data collection technology and services that record and collect information that identifies your computer, tracks your use of this Site and collects certain other information about you and your surfing habits. This data collection technology may include cookies, web beacons and other similar technologies on this Site to enhance functionality and navigation for our visitors.

A cookie is a text file that websites send to a visitor’s computer or other Internet-connected device to uniquely identify the visitor’s browser or to store settings in the browser. Web beacons are an invisible image file used for tracking purposes. Web beacon type functions allow us to count the number of users who have visited a particular web page or to access certain cookies. We may use web beacons on this Site to count users and to recognize users by accessing our cookies. Being able to access our cookies allows us to personalize this Site and improve your experience at our Site. We may also include web beacons in HTML- formatted e-mail messages that we send to determine which e-mail messages were opened. Information tracked through these mechanisms includes, but is not limited to: (i) your IP address; (ii) the type of web browser and operating system being used; (iii) the pages of the Site a user visits; and (iv) other sites a user visited before visiting our Site.

We may also employ cookies and action tags (also known as single pixel gifs or web beacons) to collect information about your use of, and activities on, our Site for our use but also for use by third parties that serve advertisements about Exacto Systems Inc. For instance, we may use third party service providers, such as Google AdSense or AdWords, to serve advertisements on our behalf across the Internet. These advertising service providers may collect information about your visits to our Site, and your interactions with our Services. In addition to the information about your visits to our Site, such advertising service providers may also use the information about your visits to other sites to target advertisements for services available from Exacto Systems Inc.

You can set your internet browser up so that you are notified when cookies are stored, you can decide in each individual case whether you want to accept cookies, or you can refuse to accept any cookies. However, if you do not accept cookies, you may be restricted in how you are able to use our Site. You can delete cookies which are already stored on your browser at any time. You will find more details on how to do this in the operating guide for your Internet browser program.

As described above, you may be able to set your browser to refuse cookies. If you refuse cookies you may still receive online advertising, but it may be less personalized.

7 Processing locations

We host our servers and store data with our service provider in the United States. Where information is processed outside your province or country, it may be subject to the laws of that jurisdiction and lawful access by its authorities. We remain responsible for protections required by applicable law when engaging service providers. Contact our Privacy Officer for information about those arrangements.

8 Retention and deletion

We retain personal information only as long as reasonably necessary for the disclosed purposes, legal obligations and legitimate dispute or security needs. When information is no longer needed, we delete it securely or anonymize it in accordance with applicable law.

Account closure or a deletion request may not immediately erase copies in backups or records we are legally required to retain. Deleting an individual’s account does not necessarily delete organizational records shared with other users. We address requests concerning such records with the Organization as appropriate, while respecting applicable individual rights. Keep independent copies of records you must retain.

9 Security and incidents

We use safeguards appropriate to the sensitivity of the personal information and the risks of processing. No service can guarantee complete security. Protect your credentials and promptly report suspected unauthorized access. We assess security incidents, keep required records, and notify affected individuals, organizations and regulators when applicable law requires. This statement does not limit our legal safeguarding or breach-response obligations.

10 Consent access correction and complaints

We obtain consent where required and rely on other authority only where applicable law permits. Providing information needed to operate the service enables the uses explained at the point of collection and in this Policy; it does not authorize undisclosed optional uses. You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. We will explain any effect on the service, including where a requested feature cannot function without the information.

You may request access to or correction of personal information we hold about you, ask about our practices, request deletion where applicable, or make a complaint by contacting our Privacy Officer. We may verify your identity and organizational authority before responding. We respond within applicable legal time limits and explain any lawful refusal or exception. Requests about information submitted by an Organization may require coordination with it, but this does not remove your rights against us. You may also complain to the Office of the Privacy Commissioner of Canada or the competent provincial or other regulator.

11 Children and external services

GrantHop accounts are intended for adult representatives of Organizations. The Platform is not directed to children. Do not upload children’s personal information without a separately agreed arrangement that addresses the required protections. If you believe such information has been submitted inappropriately, contact us. External websites and independently operated services have their own privacy policies; review them before sharing information.

12 Policy updates and contact

We will post updates with a revised effective date and give appropriate notice of material changes. If a change introduces processing that requires additional consent, we will obtain it before carrying out that processing. Continued use alone does not substitute for consent where express consent is required.