The directory runs in your browser. Your profile, your shortlist and your language choice live on your device first. No ads, no advertising pixel, no cookies, and we don't sell a single byte.
Last updated October 7, 2026Law 25 (Québec) · PIPEDANo ads, no cookies, no session replay
The short version
Local-first. Your founder profile and shortlist live in your browser's localStorage. If you save your profile, run the audit or sign in to the workspace, a copy is kept in our database so we can restore it and reply to you.
No account required. There is no signup flow, no password, no email gate to use the directory.
Cookie-free audience measurement. We count page views and a few named actions (audit started, letter subscribed, workspace opened) with PostHog in cookieless mode: no cookie, nothing stored on your device, IP address not kept, no session replay, no heatmaps. No Google Analytics, Meta or HubSpot trackers.
No selling, ever. Founder data is not a product. We share nothing with the funds in this directory.
Email only when you give it. We see your email only if you type it into a form (contact, audit report, workspace sign-in, newsletter) or write to us directly.
Delete anytime. Clear your browser storage to erase local data, and write to us to delete what we keep on our side. We confirm within 30 days.
Who this policy covers
Finance for Quantum, operated by CFO Fractal.
The Finance for Quantum is a free service operated by CFO Fractal, a Canadian firm of independent finance leads working with startup founders across Canada. When this policy says we, it means CFO Fractal. When it says you, it means anyone visiting the directory, using the workspace, or contacting us through the site.
CFO Fractal is headquartered in Québec, Canada. This policy is written to meet our obligations under Québec's Act respecting the protection of personal information in the private sector (Law 25) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
What we store, and where
The full list. Nothing hidden.
Here is every piece of information the directory can touch, where it lives, and why it exists. If it's not on this list, we don't have it.
cvd_lang
Your language choice (EN / FR). Lets us render the site in the language you picked on your next visit.
On your device
cvd_founder_profile_v1
Your founder profile. Stage, sector, ticket, city, traction, raise details. What you typed into the profile wizard, so the directory can show you personalized matches. It stays in your browser unless you save it or run the audit; then a copy is kept in our database (Airtable) so you can restore it on another device.
On your device
cvd_shortlist_v1
Funds you saved. The list of fund IDs you bookmarked. Powers your workspace and the compare view.
On your device
cvd_session_id_v1
A random session ID. Generated on first visit to keep state consistent across page loads. Sent with your profile when you save it, so both stay linked.
On your device
cvd_save_hint_seen_v1, cvd_prompt_dismissed_v1
UI state flags. So we don't keep nagging you with the same save hint or prompt you already dismissed.
On your device
Forms (contact, submissions)
If you use the contact form or submit an investor. What you send (your email, the message, the details you chose to share) is stored in our database (Airtable), and a notification carrying it is posted to our internal Slack so we can reply. If you write to us directly, the email stays in our inbox.
If you write us
Server logs (standard)
Web logs from our host. Like any site, our hosting provider (Netlify) logs the IP address of incoming requests for a short period to defend against abuse. We don't read them, analyze them, or link them to any profile.
With our host
Audit, help, workspace
If you run the audit, ask for help or sign in to the workspace. Audit answers and score are saved with your profile in our database, the report is emailed to you, and we get an email and a Slack notification. A help request is emailed to you and to us, with a Slack notification. Workspace sign-in stores a one-time code and your workspace state in our database; the cloud cap table, if you use it, is stored with Supabase.
If you use it
Want to erase your local data now? Open your browser's site settings for this domain and click Clear site data. Or visit the workspace and use the reset controls. Either way, everything we stored on your device is gone.
Finance for Quantum Weekly
The newsletter, only if you ask for it.
Our weekly email about quantum funding. Nothing is sent unless you tick the consent box and confirm your address from the email we send you.
What we keep
Your email address and a consent record. Your language, the page you subscribed from, the date and wording of your consent, and the dates you confirmed or unsubscribed.
Newsletter
Legal basis
Your express consent, given by ticking the box and confirmed by email (double opt-in), as required by Law 25, PIPEDA and Canada's anti-spam law (CASL), and by the GDPR for readers in Europe.
Newsletter
Processors
Airtable holds the subscriber list and Resend delivers the emails. Both are based in the United States, so your address may be processed there. Neither may use it for anything else.
Newsletter
How long
As long as you are subscribed. After you unsubscribe we keep your address and the record of your consent and of its withdrawal (dates, wording, source, language), so we can honor your objection and never write to you again by mistake. On request we delete that history and keep only your address, flagged do-not-contact.
Newsletter
Unsubscribe
One click, immediate. Every issue has an unsubscribe link, and your mail app's unsubscribe button works too. A bounce or a spam complaint also takes you off the list.
Newsletter
Measurement
Open and click tracking is off on our sending domain. Links to our own site carry a campaign tag (utm_source=ffq-weekly) so we know which section was useful, without identifying you.
Newsletter
Who processes your data
The services we rely on, named.
Each one only gets what it needs for its task. Most are based in the United States, so your data may be processed outside Québec and outside the European Union.
Netlify
Hosting and server functions. Serves every page and runs the forms; keeps request logs with your IP address for a short period.
Email delivery. Audit reports, help confirmations, workspace sign-in codes, profile restore links and the newsletter.
Outside Québec
Slack
Internal notifications. New profiles, contact messages, investor submissions, audit results and help requests, with the email and message they carry.
Outside Québec
Anthropic
Writing and search help. The question you type in the Ask palette and the draft you ask us to polish on a fund page are sent to Anthropic's API to produce the answer.
Outside Québec
Stripe
Payments. Checkout happens on Stripe's pages; we only read the payment session to unlock your downloads.
Outside Québec
Supabase
Workspace cap table. The cloud copy of the cap table you build in the workspace, when you are signed in.
Outside Québec
Google Fonts
Web fonts, on every page. Loading them sends your IP address and browser details to Google.
Outside Québec
Fontshare
Web fonts, workspace pages only. Loading them sends your IP address and browser details to Fontshare (Indian Type Foundry).
Outside Québec
PostHog
Audience measurement, without cookies. Page views and a few named actions (never what you type), sent through our own domain. Nothing is stored on your device and your IP address is not kept. PostHog is based in the United States.
Outside Québec
What we don't do
Explicit, because defaults matter.
A privacy policy is only as strong as what it refuses to allow. Here's ours.
What we do
Keep the directory free and account-free, forever.
What we do
Keep your profile and shortlist on your device by default, and on our side only when you save them.
What we do
Reply to direct emails and delete them on request.
What we don't do
Run advertising pixels, heatmaps, session replay, or cross-site trackers.
What we don't do
Set advertising cookies or share data with ad networks.
What we don't do
Share your profile or shortlist with any fund in this directory.
What we don't do
Sell, rent, or license founder data to third parties. Ever.
What we don't do
Use your email for marketing unless you explicitly opt in.
Your rights
Law 25 and PIPEDA give you these. We honor them on demand.
Because your data mostly lives on your device, you can exercise most of these yourself in seconds. For anything on our side (profile, messages, newsletter subscription), one message to us settles it.
Right of access. Ask what personal information we hold about you. If you only browsed, the honest answer is nothing on our servers. If you saved a profile, subscribed to the newsletter or emailed us, we share what we hold.
Right to correct or update. Want to edit what we hold? Edit your profile in the workspace directly, or write to us for anything in an email thread.
Right to deletion ("right to be forgotten"). Clear your browser storage to erase local data. Email us to delete anything we keep on our side (database, inbox, notifications). We confirm within 30 days.
Right to portability. Ask for a copy of the data we hold. Given how little we hold, this is usually a short export. No fee.
Right to withdraw consent. Any consent you gave (to receive a reply, a follow-up or the newsletter) can be withdrawn at any time: the unsubscribe link in any newsletter, a reply saying unsubscribe, or an email to us.
The person responsible for privacy at CFO Fractal is Gaetan Brillaud, our founder. No privacy-bot, no ticket system. Email and you'll get a human reply, usually within two business days.
Privacy officer
Write us for access, correction, deletion, or anything else.
Include "Privacy" in the subject so we route it fast. Mention what you want (access, correction, deletion, export) and we'll confirm within 30 days.
We update this page when we add a new data practice or change an existing one. The "Last updated" date at the top always reflects the most recent version. For any material change (one that expands what we collect or how we use it), we'll note it in a banner on the directory homepage for at least 30 days so you can review before it takes effect.
Questions? Concerns? Compliments?
We're easy to reach. One of the perks of being a small, independent firm.