We handle your data and your students' data with the same care you expect in academic practice. This policy explains what we collect, why, and your rights.
Last updated: April 2026
Our core commitments
Marking Assist is an educational technology platform operated by the Marking Assist development division. We provide AI-assisted marking support tools for higher education professionals in the United Kingdom.
For data protection purposes, we are the data controller responsible for your personal data.
You can contact us at the email address on our Contact page.
We collect the following categories of data:
Account data: Name, email address, and password (hashed — we never store plaintext passwords). Collected when you register.
Usage data: Which features you use, when you log in, assignment and submission metadata (titles, education level, file types). Used to operate the service and improve the platform.
Submission files: Files you upload (PDF, Word, PowerPoint, plain text). These are stored in private, per-user secure storage. They are used solely to generate AI feedback and are not shared with any third party.
Student data: If student submissions contain personally identifiable information (names, student IDs), this data is processed as part of the submission file. We do not extract or store student identifiers separately.
Payment data: We do not store payment card data. Payments are processed by Stripe, which operates under its own privacy policy and PCI DSS compliance framework.
We use your data to:
- Operate and deliver the Marking Assist service
- Generate AI feedback drafts from your uploaded submissions
- Maintain version history and audit trails for your marking records
- Process credit purchases and account management
- Respond to support requests
- Improve the platform (using anonymised, aggregated usage analytics)
We do not:
- Sell your data to any third party
- Use your submissions or student data to train any AI model
- Share your data with third parties except as described below
Marking Assist uses Google Gemini AI to generate feedback drafts. When you generate feedback, your submission file and the context you have provided (rubric, marking guide, grader notes) are sent to the Gemini API for processing.
Google's data processing terms apply to this processing. We have configured our usage to opt out of data use for model training where this option is available under Google's API terms.
Student submission content is processed transiently — it is sent to the AI API, processed, and the output is returned. Submission files are not permanently stored by Google's AI systems.
If you have concerns about processing student data via third-party AI, you should ensure you have appropriate institutional data governance sign-off before using the platform with real student work.
Under UK GDPR, we process your data on the following legal bases:
- Contract performance: Processing necessary to deliver the service you have signed up for (running your account, generating feedback, storing your marking records).
- Legitimate interests: Improving the platform, maintaining security, and preventing fraud — where these interests do not override your rights.
- Legal obligation: Where we are required to retain or disclose data by law.
We do not rely on consent as a legal basis for core service processing, but we will ask for your consent where required (for example, for optional communications).
Your data is stored in Supabase, a managed database and storage service with servers located in the European Union. Supabase is GDPR-compliant and operates under a Data Processing Agreement with us.
All submission files are stored in private, per-user storage buckets with Row Level Security (RLS) policies — only your account can access your files.
Passwords are hashed using industry-standard bcrypt hashing. We use TLS encryption for all data in transit.
We retain your data for as long as your account is active. If you delete your account, we will delete your personal data and submission files within 30 days, except where we are required to retain records by law.
Under UK GDPR, you have the right to:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate data.
- Erasure: Request deletion of your personal data ("right to be forgotten").
- Restriction: Request that we restrict processing of your data in certain circumstances.
- Portability: Request your data in a portable format.
- Object: Object to processing based on legitimate interests.
- Withdraw consent: Where processing is based on consent, withdraw it at any time.
To exercise any of these rights, please contact us via the Contact page. We will respond within one calendar month.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been handled unlawfully.
Marking Assist is a tool for higher education professionals — lecturers, markers, and academic staff. It is not intended for use by children under 18.
If submission files contain work by students who are under 18 (for example, in some further education contexts), you are responsible for ensuring appropriate data governance permissions are in place at your institution before uploading that data.
We may update this Privacy Policy from time to time. Material changes will be notified by email to registered users and by a notice on the platform. Continued use of the platform after such notice constitutes acceptance of the updated policy.
This policy was last updated: April 2026.
Contact us at: Loading…
Or write to us at the address registered with Companies House. You can also contact the Information Commissioner's Office (ICO) at ico.org.uk if you have a concern.