How we handle student data

Mark That Paper helps teachers mark student work. Student work belongs to your school, and we treat it that way. This page explains, in plain English, how it is handled.

We are your data processor

We process student work on the school's instructions, to provide the marking service — not for our own purposes. We can put a Data Processing Agreement (DPA) in place with schools that need one — just get in touch.

The AI never trains on student work

AI marking uses Anthropic's Commercial API with Zero-Data-Retention. Anthropic does not train on this data, and inputs are not stored at rest after the response. We send the model the de-identified text of a submission — never the PDF file, and never via long-retention APIs.

We minimise and de-identify

Before any text is sent for marking, student names and obvious identifiers are removed. The link between a name and a piece of work is kept only in our own access-controlled database, isolated per teacher.

Sub-processors

We rely on a small set of trusted providers: Anthropic (AI marking), Supabase (database, authentication and file storage), Vercel (hosting) and Stripe (billing). Each is bound by its own data protection terms.

Storage, retention and deletion

Files and marks live in a database with row-level security, so a teacher only ever sees their own data. You can delete a class, assessment or submission at any time and it cascades. Data is hosted in Australia (Sydney region).

Security and breaches

Secrets are server-side only and never shipped to the browser; data is encrypted in transit and at rest. We maintain a breach-response plan aligned to the data-protection and breach-notification laws that apply to your school, and are ready to work through the security assessments your school requires.

You are the marker

Every AI score is a draft the teacher confirms or changes. Nothing is ever auto-finalised.

Students using Mark directly

Students can also get feedback on their own drafts with a student account. The same protections apply — de-identified before AI, never used for training — and we're explicit about academic integrity: see Using Mark honestly.