Legal

Data Handling & Privacy

Last updated: August 2026

Overview

Markaloud processes audio recordings of academic feedback and generates structured written feedback using AI. This page explains what data is collected, how it is processed, and the safeguards in place to protect student and staff information.

What Data We Process

Data Type	Purpose	Storage
Audio recordings	Transcription via speech-to-text	Stored on our servers
Transcripts	Feedback generation input	Stored on our servers
Rubric criteria	Structuring feedback output	Stored on our servers
Generated feedback	Returned to the teacher	Stored on our servers

Third-Party Sub-Processors

Markaloud uses third-party services to deliver the product. Data Processing Agreements (DPAs) are in place with all sub-processors. The full sub-processor register is set out in our Data Processing Agreement; the highlights are below.

OpenAI — Transcription (Whisper API)

Audio is sent to OpenAI's API for speech-to-text conversion
OpenAI does not use API data to train models
Audio is processed and not retained after transcription
Data Processing Agreement (DPA) in place
Processed in the US

Anthropic — Feedback Generation (Claude API)

Transcripts are sent to Anthropic's API for feedback structuring
Anthropic does not use API data to train models
Data is processed and not retained beyond the request
Data Processing Agreement (DPA) in place
Processed in the US; UK/EU endpoint available on request

AssemblyAI — Viva Transcription (Speech-to-text with speaker diarisation)

Viva audio is sent to AssemblyAI's API for transcription with automatic speaker identification
AssemblyAI does not use API data to train models
Audio is processed and not retained after transcription
Data Processing Agreement (DPA) in place
Processed in the US

Resend — Transactional Email

Used to deliver login codes, password-reset messages, and account notifications
Only your name, email address, and the notification content are processed
Processed in the US

Hostinger — Hosting Infrastructure

The application, database, audio files, and encrypted backups are hosted on a Hostinger VPS
Disk-level encryption at rest
Processed in the European Union

Sentry — Error Monitoring (when enabled)

Captures application errors and diagnostic events
Content of your submissions is excluded from error reports; only user and resource identifiers are captured
30-day event retention (Sentry's standard)
Processed in the US

Stripe — Payments (institutional customers only, post-pilot)

Payment card, billing contact, and VAT details are processed when your institution signs a paid subscription
Stripe UK is the primary processor, with support from Stripe Inc. in the US under Stripe's intra-group transfer agreement

Data Flow

1. Teacher records or uploads audio

2a. Audio → OpenAI Whisper API → transcript returned

2b. Viva audio → AssemblyAI API → speaker-labelled transcript returned

3. Transcript + rubric → Anthropic Claude API → feedback returned

4. Audio, transcript, and feedback stored on Markaloud servers (Hostinger VPS, EU)

5. No submission content retained by OpenAI, Anthropic, or AssemblyAI after processing

Data Protection Measures

All data transmitted over encrypted connections (TLS 1.2 or above)
Audio files, database, and backups on disk-encrypted infrastructure at rest
Passwords hashed using bcrypt with per-user salts — plaintext never stored
API keys stored server-side only — never exposed to the browser
No student names are required or stored by default
Data Processing Agreements in place with all sub-processors
No data is used for AI model training by any provider
Registered with the Information Commissioner's Office (registration number C2001194)

UK GDPR Compliance

Markaloud processes personal data as defined under the UK General Data Protection Regulation (UK GDPR). Audio recordings containing verbal feedback about identifiable students constitute personal data.

Lawful basis:Legitimate interest in providing efficient academic feedback, or as specified in the institution's data processing agreement
Data minimisation: Only data necessary for transcription and feedback generation is processed
Storage limitation: Institutions can request deletion of all associated data
International transfers:Data is transferred to sub-processors outside the UK under the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses, or under UK adequacy regulations where applicable

Institutional Responsibilities

Institutions deploying Markaloud act as the data controller for student data. Markaloud operates as a data processor. Institutions are responsible for:

Ensuring appropriate lawful basis for processing student data
Including Markaloud in their institutional privacy notices
Conducting a Data Protection Impact Assessment (DPIA) if required
Informing students that verbal feedback may be processed by AI tools

Future Roadmap

We are actively working to minimise third-party data sharing:

Self-hosted transcription: Planned migration to on-premises speech-to-text, eliminating the need to send audio to external providers
UK/EU processing: Evaluating UK/EU-hosted AI endpoints as they become available
On-premises deployment: Option for institutions to host Markaloud entirely within their own infrastructure

For questions about data handling or to request a Data Processing Agreement, contact us at support@markaloud.cloud.

View our Data Processing Agreement template · Terms of Service

Markaloud is a trading name of Otherworld Dev Ltd. Registered in England & Wales, Company No. 17175223. Registered office: 4th Floor, 14 Museum Place, City Centre, Cardiff, Wales, CF10 3BH.

Data Type

Purpose

Storage

Audio recordings

Transcription via speech-to-text

Stored on our servers

Transcripts

Feedback generation input

Stored on our servers

Rubric criteria

Structuring feedback output

Stored on our servers

Generated feedback

Returned to the teacher

Stored on our servers

Third-Party Sub-Processors

OpenAI — Transcription (Whisper API)

Audio is sent to OpenAI's API for speech-to-text conversion
OpenAI does not use API data to train models
Audio is processed and not retained after transcription
Data Processing Agreement (DPA) in place
Processed in the US

Anthropic — Feedback Generation (Claude API)

Transcripts are sent to Anthropic's API for feedback structuring
Anthropic does not use API data to train models
Data is processed and not retained beyond the request
Data Processing Agreement (DPA) in place
Processed in the US; UK/EU endpoint available on request

AssemblyAI — Viva Transcription (Speech-to-text with speaker diarisation)

Viva audio is sent to AssemblyAI's API for transcription with automatic speaker identification
AssemblyAI does not use API data to train models
Audio is processed and not retained after transcription
Data Processing Agreement (DPA) in place
Processed in the US

Resend — Transactional Email

Used to deliver login codes, password-reset messages, and account notifications
Only your name, email address, and the notification content are processed
Processed in the US

Hostinger — Hosting Infrastructure

The application, database, audio files, and encrypted backups are hosted on a Hostinger VPS
Disk-level encryption at rest
Processed in the European Union

Sentry — Error Monitoring (when enabled)

Captures application errors and diagnostic events
Content of your submissions is excluded from error reports; only user and resource identifiers are captured
30-day event retention (Sentry's standard)
Processed in the US

Stripe — Payments (institutional customers only, post-pilot)

Payment card, billing contact, and VAT details are processed when your institution signs a paid subscription
Stripe UK is the primary processor, with support from Stripe Inc. in the US under Stripe's intra-group transfer agreement

Data Flow

1. Teacher records or uploads audio

2a. Audio → OpenAI Whisper API → transcript returned

2b. Viva audio → AssemblyAI API → speaker-labelled transcript returned

3. Transcript + rubric → Anthropic Claude API → feedback returned

4. Audio, transcript, and feedback stored on Markaloud servers (Hostinger VPS, EU)

5. No submission content retained by OpenAI, Anthropic, or AssemblyAI after processing

Data Protection Measures

All data transmitted over encrypted connections (TLS 1.2 or above)

Audio files, database, and backups on disk-encrypted infrastructure at rest

Passwords hashed using bcrypt with per-user salts — plaintext never stored

API keys stored server-side only — never exposed to the browser

No student names are required or stored by default

Data Processing Agreements in place with all sub-processors

No data is used for AI model training by any provider

Registered with the Information Commissioner's Office (registration number C2001194)

UK GDPR Compliance

Lawful basis:Legitimate interest in providing efficient academic feedback, or as specified in the institution's data processing agreement

Data minimisation: Only data necessary for transcription and feedback generation is processed

Storage limitation: Institutions can request deletion of all associated data

International transfers:Data is transferred to sub-processors outside the UK under the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses, or under UK adequacy regulations where applicable

Institutional Responsibilities

Institutions deploying Markaloud act as the data controller for student data. Markaloud operates as a data processor. Institutions are responsible for:

Ensuring appropriate lawful basis for processing student data

Including Markaloud in their institutional privacy notices

Conducting a Data Protection Impact Assessment (DPIA) if required

Informing students that verbal feedback may be processed by AI tools

Future Roadmap

We are actively working to minimise third-party data sharing:

Self-hosted transcription: Planned migration to on-premises speech-to-text, eliminating the need to send audio to external providers

UK/EU processing: Evaluating UK/EU-hosted AI endpoints as they become available

On-premises deployment: Option for institutions to host Markaloud entirely within their own infrastructure