Draft for legal reviewLast updated 4 November 2026
Data protection
A summary for your data-protection officer: where marking data goes, what is kept, and for how long.
1. Where data lives
Three sub-processors, and no others:
- Cloudflare hosts the service. Accounts, marks, feedback and files are stored under Cloudflare’s EU jurisdiction (database, file storage and the document reader).
- Google, through the Gemini API on its paid tier, writes drafts, style suggestions and optional marking reviews. Under Google’s paid-tier terms it does not use prompts or responses to improve its products; it logs them for a limited time only to detect misuse, and may process or cache them in any country where it has facilities.
- Stripe takes card payments. We never see card numbers.
2. What we hold
- The lecturer’s account: name, email, institution, sign-in events (with hashed IP addresses), credits and payments.
- Their assignments: the brief, rubric and other files they upload, and their feedback style.
- Students’ scripts, as uploaded, until deleted (below); an optional Student ID the lecturer types (candidate or student numbers, not names); grades, notes and feedback.
3. How long we keep it
| Data | Kept until |
|---|---|
| A student’s script file | The lecturer finalises its feedback, deletes it, or 30 days after upload, whichever is first. Every deletion is logged and checked daily. |
| Context files (brief, rubric, examples) | The lecturer removes them or deletes the assignment. |
| Grades, notes and feedback | The lecturer deletes them: removed for good 30 days after you delete them, or at once if you delete your account. |
| Payment records | Six years, as UK law requires. |
| Database backups | 35 days each, in the EU, so deleted data leaves them 35 days after it is removed. |
4. What the AI does and never does
- It drafts; the lecturer grades and decides. Nothing reaches a student until the lecturer finalises it.
- It is never asked to infer, and must not mention, any protected characteristic.
- Optional marking reviews see each script only under an anonymous label, never a Student ID or file name, and are visible only to the lecturer unless they choose to share them.
- No decision about a student is made automatically.
5. Security
- Passwords checked against known breaches; optional two-step sign-in, required for administrators; sessions end after 30 minutes idle.
- Every request is checked against one set of access rules, each with a test; files are reached only by short-lived links.
- Every administrator action is written to an audit log.
6. Documents and questions
Our data protection impact assessment summary is available on request. Ask privacy@markingassist.com. See also the privacy notice.