Coming soon: we're building something new Get in touch →

Privacy policy

Last updated: 1 October 2026

1. Who we are

Marky ("we", "us", "our") provides AI-powered exam marking software for schools. We are the data processor for student data and the data controller for teacher and school administrator data. Our contact email is hello@markyedu.com.

2. What data we collect

We collect and process the following categories of personal data:

  • Teacher & administrator accounts: Name, email address, school name, role, and login credentials (hashed).
  • Student data: Name, candidate number, class group, and exam paper submissions (uploaded by teachers) with the marks and feedback on them. Where the school records them, also email address, date of birth, target and predicted grades, and the characteristics the school uses to plan support: SEND status, pupil premium and free school meals eligibility, English as an additional language, looked-after status and accessibility needs. SEND and similar information is special category data. Where students use the student tools, their activity is stored too: practice attempts, tutor conversations, any wellbeing check-ins they choose to make and, where the school uses class discussions, the questions and replies they post. Student data is processed on behalf of the school under a data processing agreement.
  • Parent accounts: Name, email address, and linked student relationships.
  • Usage data: Pages visited, features used, and timestamps.
  • Sign-in and security records: When someone signs in, or tries to, we record the time, the account and the internet (IP) address the request came from. Our servers also log the IP address of each request they receive.
  • Contact form submissions: Name, email address, school, and message content.

3. How we use your data

  • To provide AI-powered marking, analytics, and feedback services.
  • To manage user accounts and access control.
  • To generate reports, grade predictions, and revision materials.
  • To respond to enquiries and provide support.
  • To help keep pupils safe. What a pupil writes in a wellbeing check-in, to the AI tutor or in a class discussion is checked against a fixed list of words that can signal a safeguarding concern. A match is recorded and the school's named safeguarding lead is emailed. The email names the pupil but does not include what they wrote. Only the safeguarding lead and the school's administrators can open the record.
  • To keep accounts secure. We use sign-in records and IP addresses to limit repeated wrong-password attempts, to spot and investigate suspected misuse, and to give a school's administrators a record of who signed in. We do not use IP addresses for advertising or to follow people across other sites.
  • To measure our marking accuracy, by comparing the marks Marky proposed with the marks the teacher gave on the same scripts. That measurement is published on the accuracy page and does not involve training any model on student work.

4. Legal basis for processing

We process personal data under the following legal bases (UK GDPR):

  • Contract: To deliver the services agreed with your school.
  • Legitimate interest: To improve our service and ensure security.
  • Consent: Where required, such as for optional communications.
  • Legal obligation: To comply with UK law, including education regulations.

5. Student data & AI training

Student data is never used to train AI models. Student papers and results are processed to deliver marking results to the school and to measure our marking accuracy, as described in section 3. Retention is covered in section 8, and in the school's data processing agreement.

6. Data storage & security

  • All data is stored in the UK, in the London region. This covers the application database, uploaded papers and audit logs.
  • AI processing is carried out by our AI sub-processor and is not pinned to a single region: page images of exam papers may be processed in any region that provider operates, including outside the UK and the EU. Stored data does not leave the UK region.
  • Data is encrypted in transit (TLS) and at rest (AES-256).
  • Access is controlled via role-based permissions with audit logging.
  • Marky staff can view a school's records to support it, but cannot change them. The only exceptions are a few support tasks: starting an audited, read-only support session, taking a backup, resetting a lost phone's two-step sign-in, approving a change of sign-in address when the school has no other administrator, and setting the limits on pupils' AI use.
  • We conduct regular security reviews and maintain incident response procedures.

7. Data sharing

We do not sell personal data. We share data only with:

  • Cloud infrastructure provider: Hosting and storage (data processing sub-processor).
  • AI model providers: Uploaded papers are sent to our AI sub-processor to be transcribed and marked. This includes the cover page, so where a student has written their name or candidate number on the script that writing is part of what is sent, and it is read back so the paper can be attributed to the right student. Identifiers are used for attribution only. Our AI sub-processor does not use this data to train its models. It may hold the content of a request for a short time while providing its service, for example in a short-term cache, under its data processing terms.
  • Payment processor: Card payments for the individual Student Revision plan and student paper top-ups are taken on the payment processor's own hosted page, which receives the card details needed to take the payment. Marky never sees or stores card numbers.
  • Email delivery provider: Every email Marky sends, including account, invitation, results, billing and safeguarding alert emails, goes through a third-party email relay, which handles the recipient address and message content for delivery only.
  • Contact form provider: Enquiries submitted through the contact form (your name, email address, school and message) are delivered by a third-party form-handling service. It is used only to pass the enquiry to us and holds no student data.

A complete, current list of our sub-processors, naming each provider, is available to schools on request and is provided as part of our data processing agreement. We will give notice before adding or replacing a sub-processor.

8. Data retention

Student data is retained while the school uses Marky, and the school's head administrator account can export it at any time through the subject access request (DSAR) export. Nothing is deleted automatically when a subscription ends: the school keeps access and can still sign in and export. We delete the school's papers and results when the school asks, and confirm once that is done. Copies of scripts staged for batch marking are held in the same London storage and deleted automatically 7 days after they are staged, whether or not deletion has been requested. Backup copies are kept for up to 60 days and then deleted automatically, so anything you ask us to delete has gone from every backup within 60 days. Account data is retained for as long as the account exists. When a subscription ends the account is not deleted: you can still sign in and export your data, and it is removed 30 days after an administrator deletes it, or when you ask us to. A deleted staff account is anonymised rather than removed, so the reports and targets that teacher wrote stay with the school's records. A school can also set how long marked work, wellbeing check-ins and pupils who have left are kept; once it does, they are deleted automatically when that period ends. A safeguarding record, including a copy of the words that raised it and any check-in or tutor conversation it came from, is part of the school's safeguarding file: it is not removed by these time limits, and is kept until the school erases that pupil's record. AI tutor conversations are deleted 30 days after the last message. Security audit logs, which include IP addresses, are kept for 12 months. Contact form submissions are retained for up to 2 years. Sign-in and security records, including the IP address of each sign-in, are kept for 12 months and then deleted automatically. Server logs, which include the IP address of each request, are kept in London for 30 days and then deleted automatically.

9. Your rights

Under UK GDPR, you have the right to:

  • Access your personal data (Data Subject Access Request).
  • Rectify inaccurate data.
  • Request erasure of your data.
  • Restrict or object to processing.
  • Data portability.
  • Withdraw consent at any time.

Schools can export all student data via our DSAR export feature. To exercise your rights, contact hello@markyedu.com.

10. This website

This marketing website sets no cookies of its own and uses no advertising or tracking pixels. It is served through Cloudflare, which processes visitors' IP addresses to deliver the site, counts page views with its web analytics (which does not use cookies or track visitors across sites), and may set a security cookie (cf_clearance) to protect the site from automated abuse. The Marky application (accessed after login) is governed by the data practices described above.

11. Children's data

Marky processes student data on behalf of schools. Schools are responsible for obtaining appropriate consent or establishing a legal basis for student data processing. Where students use Marky through their school, their accounts are created and managed by the school.

Individual student and parent accounts. Where a student aged 13 or over, or a parent or guardian, registers directly rather than through a school, Marky is the data controller for that account. We ask for a date of birth, used only to apply the age rules: accounts are for students aged 13 or over, a student aged 13 to 15 must name a parent or guardian, and at 16 and over that is optional. Everything else in this policy applies to those accounts in the same way.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to schools via email. The "last updated" date at the top reflects the most recent revision.

13. Contact

For privacy-related enquiries, contact us at hello@markyedu.com.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).