Privacy Policy

Markflow is an AI-assisted marking tool built for teachers. This policy explains what data we collect, how we use it, who we share it with, and what rights you have. Markflow is operated by a sole trader based in Western Australia, Australia. Our primary legal framework is the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where teachers outside Australia use Markflow, we apply the same standards to their data.

Markflow's direct users are teachers. Teachers create accounts, set up assessments, and upload student work. Students are never direct users of Markflow — they do not create accounts or interact with the product. This policy covers data relating to both teachers (account holders) and students (whose work teachers upload).

Before using Markflow, teachers should ensure their use is consistent with their school's data governance policies and any applicable student privacy obligations in their jurisdiction.

Teacher account data

• Name and email address (via Google sign-in or magic link)
• School name
• Subscription status and billing history
• Usage data (assessments created, credits used, last active)

Assessment and class data

• Class names, year groups, and student rosters (first name, last name)
• Assessment names, types, questions, and marking rubrics
• Uploaded files including question papers, marking keys, and student submissions
• Marks, scores, feedback comments, and flags generated during marking

Technical data

• Authentication tokens and session data
• Standard server logs (IP address, browser type, request timestamps)

We do not collect passwords. Authentication is handled via Google SSO or email magic link only.

• To provide the Markflow marking and feedback service
• To process AI-assisted marking and generate feedback comments
• To manage your account, subscription, and credits
• To communicate with you about your account or the service
• To improve the reliability and performance of Markflow

We do not use your data or student data for advertising, and we do not sell data to third parties.

When a teacher initiates an AI marking run, student submission content is transmitted to the following third party services for processing:

• Anthropic (Claude API) — used to analyse student work, suggest marks, generate reasoning, and draft feedback comments.
• Google Cloud Vision — used to extract text from handwritten student submissions via optical character recognition (OCR).

Student submission data is transmitted to these services only during an active AI marking run and is not stored by Markflow beyond what is needed to display results to the teacher.

Markflow intends to support Google Classroom roster import in a future release. When available, Markflow will request read-only access to class roster data via the classroom.rosters.readonly scope. This data will be used solely to populate class lists within Markflow and will not be shared with third parties or used for any other purpose.

Google Classroom data will be handled in accordance with Google's API Services User Data Policy. Teachers will be prompted to explicitly authorise this access and can revoke it at any time via their Google account settings.

This feature is not yet active. This section will be updated when it becomes available.

All Markflow data is stored in Supabase, with our primary database located in the Sydney, Australia region. This means your data and student data remains in Australia.

• Row-level security — teachers can only access their own data
• Private storage buckets for uploaded files
• Encrypted connections (HTTPS/TLS) for all data in transit
• Authentication via Google OAuth or email magic link — no passwords stored

In the event of a data breach likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

When a teacher deletes their Markflow account, all associated data is permanently deleted — including class rosters, student names, assessment data, uploaded files, marks, and feedback. This deletion is immediate and irreversible.

Teachers can request deletion of specific data at any time by emailingprivacy@markflow.com.au. We will action all deletion requests within 30 days as required by the Australian Privacy Principles.

Standard server logs may be retained for up to 90 days for security and debugging purposes.

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your data
• Lodge a complaint about how we have handled your data

To exercise any of these rights, contact us atprivacy@markflow.com.au. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) atoaic.gov.au.

Markflow uses session cookies to keep you signed in. We do not use advertising cookies, third party tracking pixels, or analytics services that profile individual users. We do not display advertisements.

We may update this policy from time to time. When we make significant changes, we will notify teachers via email or an in-app notice. Continued use of Markflow after a policy update constitutes acceptance of the revised policy.

For any privacy-related questions, requests, or complaints: