Privacy Notice

Markaloud transcribes the lecturer's spoken marking and drafts written feedback from it, with suggested marks against the rubric when one is used. The lecturer reviews and edits everything before it reaches a student. This notice explains the personal data involved, why it is used, how long it is kept and the rights you have over it. It covers two kinds of data:

• Data about you, as someone with a Markaloud account: your account, billing, the emails we send you, records of how you use the service and anything you send us. We decide how this data is used, so we are its controller.
• Data about students, and anyone else, in the work you mark: recordings of your spoken marking, transcripts, the feedback and marks drafted from them, and the names you enter. For this data we are a processor: we only use it to provide Markaloud, on behalf of whoever is responsible for it.

Markaloud is a trading name of Otherworld Dev Ltd, a company registered in England and Wales (company no. 17175223) with its registered office at 4th Floor, 14 Museum Place, City Centre, Cardiff, CF10 3BH. We are registered with the Information Commissioner's Office as a data controller (registration number ZC216212).

For anything about personal data, including the rights set out below, contact privacy@markaloud.cloud.

If your institution has an agreement with us, it is the controller of the student data in its account and we are its processor, under our Data Processing Agreement. If you subscribe on your own account, we process student data on your instructions, under the processor terms in our Terms of Service. Either way, the controller decides the lawful basis for using the data and tells students about it.

Markaloud uses no third-party analytics, advertising or tracking cookies, and we do not sell personal data.

This covers the recordings of your spoken marking, their transcripts, the feedback and marks drafted from them and your edits to them, rubric scores, the student, class and assignment names you enter, your annotation comments and the passages of student work you highlight. Student names are optional.

The student's own document is never stored on our servers. A PDF you mark stays in your browser, a Word or other file is converted to PDF on our server and deleted straight away, and a submission fetched from Canvas, or an annotated PDF sent back to it, only passes through.

We use this data only to provide Markaloud to you or your institution, never for our own purposes, and none of it is used to train AI models. Markaloud does not make decisions about students by automated means alone: the AI drafts feedback and suggests marks, and the lecturer reviews them and decides what the student receives.

Recordings are deleted at a daily clean-up once they are older than:

• Free plan: 90 days
• Educator and Educator Pro: 365 days
• Institution accounts: the period the institution sets, from 90 days to 6 years (1 year unless it changes it)

When a paid plan ends, whether it is cancelled or moved to Free because payments failed, the Free plan's 90 days apply from then on, so the next daily clean-up deletes every recording more than 90 days old. To keep any of them, download them first from Settings, under Your Data.

Transcripts, feedback, marks, annotation text and rubrics are kept until you delete them or your account. Deleting your account deletes all of it straight away.

While you record, the recording is also kept in your browser, so that a crash or a lost connection does not lose it. It is cleared once it has been transcribed, when you sign out, or after a week.

Backups are encrypted before they leave the server. Database backups are kept for 14 days on our hosting server and 60 days off-site, and backups of recordings for 35 days and 120 days, so deleted data can remain in a backup for up to 60 days (120 days for a recording) before it is gone.

What each provider below keeps, and for how long, is given in its entry.

Markaloud uses these third-party services to deliver the product, with a Data Processing Agreement in place with each, and none of them may use the data to train AI models. The same register is published at markaloud.cloud/subprocessors and in our Data Processing Agreement.

Error monitoring (GlitchTip) and the off-site backups are self-hosted by Otherworld Dev in the UK, so no third party is involved. Error reports carry account and record identifiers, never what a submission says, and are kept for 90 days. Backups are encrypted before they leave the server, and the off-site copies are kept for up to 60 days (database) and 120 days (recordings).

Your institution's own systems, such as Canvas or Microsoft Entra ID, are not our sub-processors, and we only send data to them when you ask us to. We share personal data with no one else unless the law requires us to.

Student work and account data are stored in the United Kingdom. OpenAI, AssemblyAI and Anthropic process what they receive in the United States, Resend holds account metadata and logs there, and Stripe is supported by Stripe, Inc. there. These transfers are covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it. Hostinger processes data in the European Union, which UK adequacy regulations cover. You can ask for details of these safeguards at privacy@markaloud.cloud.

Under UK data protection law you have these rights over your personal data:

• Access. You have the right of access to a copy of your personal data. Settings, under Your Data, downloads your submissions, transcripts, feedback and rubrics as JSON, and we can provide the rest on request.
• Correction. You can have inaccurate data corrected.
• Deletion. You can have your data deleted. Deleting your account in Settings does this straight away.
• Restriction. You can ask us to restrict how we use your data.
• Objection. You can object to uses based on our legitimate interests, and stop product emails at any time.
• Portability. You can have your data in a machine-readable form, which the JSON export provides.
• Automated decisions. You have rights over decisions made about you by automated means alone. Markaloud makes no such decisions about anyone.

To use any of them, email privacy@markaloud.cloud. We will reply within one month. If you are a student asking about feedback on your work, the institution or lecturer that marked it is responsible for that data, so please contact them first. If you contact us, we will pass your request on to them and help them answer it.

If you are unhappy with how we have handled your data, please tell us at privacy@markaloud.cloud so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

• All data is sent over encrypted connections (TLS 1.2 or above)
• Backups are encrypted before they leave the server, and recordings and the database can only be reached by the application, never from the internet
• Passwords are stored only as bcrypt hashes with per-user salts
• API keys for the AI providers are kept on the server and never sent to the browser
• Student names are optional
• Data Processing Agreements are in place with all sub-processors, and none of them may use the data to train AI models

Markaloud sets only the cookies it needs to sign you in and keep your session secure. One of them remembers, for 180 days, that a browser has signed in to your account before, so that failed attempts by someone else to sign in as you can't lock you out. It sets no analytics, advertising or tracking cookies. Some settings, such as tips you have dismissed and your answer to the cookie banner, are kept in your browser's local storage, and a recording in progress is kept in the browser until it has been transcribed, as described above.

Institutions using Markaloud are the controller of their students' data and are responsible for:

• Having a lawful basis for processing student data
• Including Markaloud in their privacy notices to students
• Carrying out a Data Protection Impact Assessment where one is needed
• Telling students that their feedback is drafted with AI assistance

Our Data Processing Agreement template sets out what we do as your processor.

If we change this notice we will update the date at the top, and we will email account holders about any change that affects them significantly.