Privacy

The short version

• Essays are marked by Anthropic’s Claude, in the United States. Nothing is used to train anyone’s model.
• Student names are stripped out before marking, and teachers are asked to label scripts with a nickname rather than a real name.
• Marked work is deleted after 30 days. Uploaded photos go after 2.
• No advertising, no analytics, no trackers, and nothing is sold or shared with anyone not listed on this page.

Who is responsible

MarksUp is run by one person, a practising English teacher in the United Kingdom, who is the data controller for everything described here. Questions, requests and complaints: privacy@marksup.uk.

What is collected, and why

Your account

• Email address — to identify your account and to send you a receipt if you buy anything.
• Your name, if you give one — optional, and shown only to you.
• Your password, stored only as a scrypt hash. It cannot be read back, by us or by anyone who steals the database.
• How much you have marked and how many tickets you hold, so the counts on your account page are right and so a payment can be explained if you query it.

If you write to us

• Your name, email address and message from the contact form, kept so the message is not lost and so we can reply.

Contact messages are deleted by hand once they have been dealt with. Ask and yours goes immediately.

The work you upload

• Photographs, PDFs or typed text of essays, and the transcript made from them.
• The mark and the feedback produced, and your own mark if you disagree and record one.

Student essays are children’s personal data and are treated as such. Before an essay is sent for marking, MarksUp removes names and candidate numbers it can identify, and tells you what it took out so you can check. The label you give a script is yours to choose, and the upload page asks you not to use the student’s real name.

This is a safeguard, not a guarantee. If a name is written in the middle of an essay, or a student has signed their work inside a paragraph, it may survive. Use nicknames.

Who else sees it

Marking is done by a large language model, which means the transcript of the essay is sent to the company that runs it. On the settings a teacher can reach, that is one company:

• Anthropic (United States) — reads the handwriting and marks the essay. Anthropic’s API terms say submissions are not used to train their models.

Other providers are wired in but are available only to the site administrator, for testing: Google (Gemini), OpenAI and DeepSeek. Your work does not reach them unless you are told otherwise.

Also involved:

• Oracle Cloud, London — the server. Your account and your marking are stored in the United Kingdom.
• Stripe — payments. Stripe takes your card details directly; MarksUp never sees them.
• Google — only if you choose to sign in with Google, and only your email address and name.
• Google Fonts — your browser fetches two typefaces from Google’s servers, which discloses your IP address to Google in the process. No essay data is involved.

Marking involves a transfer of data to the United States. Anthropic and Stripe both operate under the standard safeguards for such transfers.

Nothing is sold, and nothing is shared for advertising.

How long it is kept

Deletion is done by a job that runs every night, not on request only — marking older than the window goes whether anyone asks or not. You can also delete any piece of marking yourself, at once, from Your marking.

One thing is kept indefinitely, and it contains nothing about anybody: a record of the mark the model gave and the mark the teacher gave, with the paper and the date. No names, no labels, no essay text, nothing that could identify a student or a teacher. It exists so the accuracy of the marking can be measured over a year, and it outlives the scripts it came from on purpose.

Cookies

Two, both strictly necessary, neither used for tracking:

• marksup_session — keeps you signed in. Expires after 30 days.
• marksup_oauth — set briefly while you sign in with Google, to prevent a request being forged. Gone within minutes.

There are no analytics cookies, no advertising cookies and no third-party trackers, which is why this site has never shown you a cookie banner.

Your rights

Under UK GDPR you can ask for a copy of your data, ask for it to be corrected or deleted, object to how it is used, or complain to the regulator. In practice:

• Delete a piece of marking — do it yourself from Your marking, at any time.
• Delete your account, or get a copy of your data — email privacy@marksup.uk and it will be done within 30 days, usually the same week.
• Complain — the Information Commissioner’s Office, ico.org.uk. You are welcome to raise it here first, but you do not have to.

If you are a student, or a parent, and you think a piece of your work is on this site, write to the address above and it will be found and removed.

Teachers: one thing worth knowing

If you use MarksUp on work produced by your own students, your school is very likely the data controller for that work and you are handling it on their behalf. Whether you may put it through an outside service is a question for whoever holds the data protection role at your school, not for us. It is a short conversation and much easier to have beforehand.

Changes

If this policy changes in a way that matters, the date at the top changes and anyone with an account is told by email. Corrections to wording are made quietly.