Privacy policy

The three roles we play

For student work uploaded through an account, the school is the controller (responsible party under POPIA) and we are the processor (operator), acting on the school's instructions. We are a controller for our own business data - teacher accounts, billing, analytics and our marketing to teachers. And we are a controller for the direct student upload and results links, where a student interacts with us without an account; we state that plainly rather than claiming to be a processor for everything.

What we collect

About teachers: name and sign-in details, school and teaching context, marking preferences, subscription and usage records, support conversations, and IP and browser information for security. About students, on the school's behalf: name as written on the work, class or set, a school identifier or feedback email where a teacher records one, the submitted work itself including handwriting, the AI transcription and marks, feedback and annotations, and - where a student uses a link - an IP address and access times. We have no field for a date of birth, home address or any special category of information.

Artificial intelligence

We use the paid tier of Google's Gemini API to read work, transcribe answers, propose marks against your marking guide, draft feedback and summarise performance. Every output is a proposal a teacher can change, and nothing reaches a student until a teacher approves it. Under Google's paid-tier terms, Google does not use our prompts or its responses to improve its products or models; it logs content briefly only to detect misuse. We do not train any model on your data, and we are moving this processing to a European region.

Students and children's information

Almost every student whose work passes through Marking.ai is a child, and the school establishes the lawful basis for processing it. We never market to students, do not track whether a student opens a feedback email, do not build a profile of a student, and switch session recording off on the student upload and results pages. When a student opens a link, our analytics and support tools record the visit and browser type with the IP address anonymised at collection, and we are removing third-party scripts from those pages.

Testing our marking accuracy

We keep a set of examples used to test how well our marking performs. When a teacher corrects a proposed mark, that correction - with a copy of the relevant submission and marking guide - may be added to it. It is accessible only to our staff, never appears in the product, and is used to measure accuracy, not to train models. Because these are copies, an example can remain in the test set after the original submission is deleted. A school or teacher can opt out and we will remove existing examples; we are building this as an in-product setting.

Who we share information with

We do not sell personal information. We share it with the sub-processors listed on our sub-processor page, each under contract, and - for session recording and analytics - we identify teachers by an internal identifier rather than name or email, filter student names and free-text work out of analytics events, and anonymise IP addresses at collection. Recordings of teacher-facing pages can show student content, are held in the EU with restricted access, and are deleted after 30 days.

Where your information goes

Our database and file storage are in the EU (Frankfurt). Several providers, and Google's AI processing, are in the United States, under EU Standard Contractual Clauses and the UK Addendum. Marking.ai is a South African company whose staff access the systems remotely; for UK or EEA schools, transferring data to us is a restricted transfer covered by the UK International Data Transfer Agreement or the EU SCCs in our Data Processing Addendum.

How long we keep things, and deletion

We keep student work while the account exists and until the school instructs deletion; billing records for seven years; session recordings for 30 days; analytics events for 12 months. Deleting work in the product removes it from your account immediately, and permanent erasure of the underlying records is available on request - for schools, within 30 days under our Data Processing Addendum. We are building tooling to make in-product deletion permanent by default and to let you delete your own account.

Your rights, and contact

Depending on where you are, you can ask for access, correction, deletion, objection, restriction and portability, object to direct marketing at any time, and complain to a regulator. Requests about a student's work normally go to the school, which holds the record. Write to privacy@marking.ai and we respond within 30 days. Our manual under section 51 of the Promotion of Access to Information Act is at https://www.marking.ai/security/paia.

Marking.ai (Pty) Ltd, registration number 2024/023842/07, Unit 60, 32 Witney Street, Bryanston, Sandton, Gauteng, 2191, South Africa. Information Officer: Jamie Rood. Contact: privacy@marking.ai.