Privacy Policy

This is the Privacy Policy for Markscanner, a web-based marking assistant for math teachers. We try to keep this short and readable rather than dense and legal. If anything here is unclear, email [email protected] and we’ll clarify.

Our purpose

Markscanner is built to help teachers, tutors, schools, and educational institutions grade student work more efficiently, consistently, and thoughtfully. We handle student information only to provide educational grading-support services, including organising submissions, matching work to students, generating draft marks and comments, creating feedback sheets, supporting teacher review, maintaining account security, and operating the service.

We do not use student names, roster information, uploaded work, grading results, or feedback for advertising, marketing profiles, resale, or unrelated commercial purposes.

What we collect

• Account information — your email, name, and authentication details, such as a password hash or sign-in provider ID.
• Class and roster data — student names and identifiers you add to your classes so Markscanner can match submissions to the right student.
• Uploaded student work — scanned PDFs and images of quizzes, tests, assignments, rubrics, and related assessment materials you upload for grading.
• Grading output — draft marks, comments, feedback sheets, teacher edits, and approved results generated or stored through the service.
• Billing information — handled by our payment processor; we store subscription status and related billing records, not full card details.
• Usage and diagnostic data — anonymised analytics, basic usage information, and server-side logs needed to operate, secure, debug, and improve the service.

How we use it

We use the data above to operate Markscanner: to organise classes and submissions, match work to students, generate draft grading output, support teacher review, create feedback sheets, manage subscriptions, provide support, secure the service, and keep the system running.

We do not sell your data. We do not use student information for advertising, marketing profiling, or unrelated commercial purposes.

Student work and AI providers

Scanned student work may be sent to AI providers selected by Markscanner or enabled in your account settings only for the purpose of producing draft marks, comments, explanations, and feedback.

We do not use student work, prompts, files, grading output, or feedback to train Markscanner models, and we do not permit our AI providers to use that content to train their general models. We call our AI providers through paid API tiers and configure available settings to disable use of customer content for model training.

Some AI providers may temporarily process or retain API inputs and outputs for abuse monitoring, security, reliability, debugging, or legal compliance unless a zero-retention or modified-retention setting is available and enabled. We use provider settings and contractual terms intended to prevent student work from being used for model training.

AI-generated marks, comments, and feedback are draft outputs. Teachers remain responsible for reviewing, editing, approving, and using grading results.

Sub-processors

Markscanner relies on third-party service providers to deliver the service. Each is listed with the role it plays:

• Supabase — database, authentication, and file storage.
• Google Gemini API / Google Cloud — vision-language model used for grading, used through paid API configurations intended for business processing of customer data.
• OpenAI — vision-language model available as an alternative provider.
• Anthropic (Claude) — vision-language model available as an alternative provider.
• Cloudflare — site hosting, CDN, security, and anonymised analytics.
• Browserless — headless-browser PDF rendering for feedback sheets and blank tests.
• AWS Simple Email Service — transactional email, including account, security, support, and service notices.
• Stripe — subscription billing and payment processing.

Where data is stored and processed

Our primary database and file storage are hosted in Canada through Supabase. Some sub-processors, including AI providers, email providers, analytics, and payment processors, may process data outside Canada depending on the provider, model, feature, and account settings.

We use provider settings and contractual terms intended to prevent student work from being used for model training.

Retention and deletion

You can delete uploaded work, grading results, and rosters from your account at any time.

If you cancel your account, your account data will remain available for export for at least 30 days unless we are legally required to remove access sooner. After that period, we may delete or disable access to the account and associated data.

Backup copies may remain for a limited period as part of normal backup, security, and disaster-recovery processes. Backups are rotated on a normal schedule and expire within 90 days.

We retain information only as long as needed to provide the service, meet legal or security requirements, resolve disputes, enforce agreements, or maintain necessary business records.

Schools and institutions

If Markscanner is used under a school, board, department, tutoring centre, or institutional agreement, that organisation may have additional rights and responsibilities regarding user accounts, student data, retention, deletion, access requests, and compliance with applicable education and privacy laws.

Teachers, tutors, schools, and institutions are responsible for ensuring they have the authority required by their institution, school board, district, or applicable law to upload student work, roster information, rubrics, and assessment materials to Markscanner.

Your rights

If you’re based in Canada, you may request access to or correction of personal information we hold about you. You may also request deletion or withdraw consent to certain uses of personal information, subject to legal, security, backup, contractual, and operational requirements.

Similar rights may apply under comparable laws elsewhere.

Email [email protected] and we’ll respond within 30 days where required by law.

Security and privacy incidents

Data is encrypted in transit using HTTPS and at rest in our hosted databases and storage. Access to production systems is limited to maintainers of Markscanner and protected by two-factor authentication where available.

We use reasonable administrative, technical, and organisational safeguards designed to protect user content and student information. No online service can be guaranteed to be completely secure.

If we become aware of a privacy or security incident involving personal information, we will investigate, take reasonable steps to contain and remediate it, keep required records, and notify affected users, institutions, regulators, or other parties where required by law.

Children

Markscanner is sold to teachers, tutors, schools, and educational institutions, not to students directly. Students are not intended to create accounts or use the service directly unless expressly permitted by their school or parent/guardian and by Markscanner.

Student work is uploaded and handled by the teacher, tutor, school, or institution using the account. We do not knowingly collect personal information directly from children for direct-to-student accounts.

Changes to this policy

When we update this policy, we’ll change the “Last updated” date above. For material changes, we’ll notify active account holders by email or through the service.

Contact

Questions or requests: [email protected]. Markscanner is operated from London, Ontario, Canada.