Article 28 UK GDPR · published in full
For the student data put into it, Markaloud acts as a processor: for your institution, which is the controller of your students’ personal data, or for you, if you subscribe on your own account. These are the sub-processors we engage to deliver the service. We notify customers in advance of any change to this list, and you may object.
Last updated: 8 October 2026 · privacy@markaloud.cloud
Otherworld Dev Ltd t/a Markaloud · ICO registration ZC216212
Sub-processors that see student work
Recordings and their transcripts are personal data. Apart from our hosting provider, only these three receive them.
| Sub-processor | Purpose | Data it sees | Location | Trains on your data? | Retention |
|---|---|---|---|---|---|
| OpenAI, L.L.C. | Speech-to-text (Whisper): turns the lecturer’s recording into a transcript | The recording and its transcript | United States | No. OpenAI’s Services Agreement §4.2: “OpenAI will not use Customer Content to develop or improve the Services, unless Customer explicitly agrees to such use.” We have not opted in. | Up to 30 days for abuse monitoring, then deleted |
| AssemblyAI, Inc. | Speech-to-text for the live preview while recording, and for vivas, where it tells the speakers apart | The recording and its transcript | United States | No. Model-improvement training is disabled on our account. | The live preview keeps nothing. Viva recordings are deleted within 48 hours, and Markaloud has each viva transcript deleted as soon as it comes back |
| Anthropic, PBC | Drafts the written feedback, with suggested marks against the rubric, from the transcript. It also tidies annotation comments, points out likely transcription errors, finds themes across a class in Analytics and answers the in-app help chat | The transcript, the rubric, the feedback it drafts and any passages of student work the lecturer highlights; for a class theme analysis, the student names the lecturer entered | United States | No. Anthropic’s Commercial Terms: “Anthropic may not train models on Customer Content from Services.” We have not opted in. | Deleted within 30 days |
Note on AssemblyAI retention. The live preview uses AssemblyAI’s streaming service, which keeps neither the audio nor the transcript. For a viva, AssemblyAI deletes the uploaded recording within 48 hours, and Markaloud asks it to delete the transcript as soon as the transcript comes back, before any feedback is drafted, rather than relying on AssemblyAI’s own retention.
AssemblyAI implements deletion by removing the transcript content and retaining a record consisting only of an identifier, timestamps and status; the transcribed text, word-level data and audio reference are erased and cannot be recovered.
Other sub-processors
Civo hosts the service, so everything we store, student work included, sits on its servers in the UK. Stripe never receives student data. Resend and Hostinger carry email, and a feedback-ready or batch notification names the student, class or assignment.
| Sub-processor | Purpose | Data it sees | Location | Retention |
|---|---|---|---|---|
| Civo Ltd | Hosting: the application, the database, recordings and the on-server backups | Everything the service stores, student work included | United Kingdom (Kao Data campus, Harlow) | For as long as the service keeps the data; on-server backups for up to 35 days |
| Stripe Payments Europe, Ltd. and Stripe Payments UK, Ltd. | Card payments for subscriptions and top-ups (not used for institutions on a pilot or paying by invoice) | Billing contact, payment card and VAT details. No student data. | Ireland and the United Kingdom, with support from Stripe, Inc. in the United States | Stripe’s standard financial record retention |
| Resend, Inc. | Sends the service’s email: sign-up and password emails, billing and usage notices, feedback-ready and batch notifications, and product emails | The recipient’s name and email address and what the email says. Feedback-ready and batch notifications include the student, class or assignment name the lecturer entered | United States; email is sent from its EU (Ireland) region, with account metadata and logs held in the US | Kept under Resend’s standard retention policy |
| Hostinger International Ltd. | Markaloud’s business mailboxes, and the fallback route for the service’s email | Email correspondence with us and, as the fallback route, the same emails Resend would send | European Union | Correspondence kept for the duration of the customer relationship |
Run by us, not a third party. Error monitoring (GlitchTip) and the off-site backups are self-hosted by Otherworld Dev in the UK, so no third party is involved. Error reports carry account and record identifiers, never what a submission says, and are kept for 90 days. Backups are encrypted before they leave the server, and the off-site copies are kept for up to 60 days (database) and 120 days (recordings).
Your institution’s own systems are not sub-processors of ours. Where you use Canvas or Microsoft Entra SSO, those remain your systems under your own agreements; we send feedback to them at your instruction.
International transfers
Transcription and feedback drafting are carried out by the three providers above, which process in the United States. These are restricted transfers under UK GDPR, and each is covered by the EU Standard Contractual Clauses as amended by the UK International Data Transfer Addendum, incorporated into that provider’s Data Processing Agreement:
We hold a Transfer Risk Assessment for each. Available to your DPO on request.
Security certifications
| Sub-processor | Certifications |
|---|---|
| OpenAI | SOC 2 Type 2; ISO/IEC 27001:2022, 27017, 27018, 27701, 42001 |
| AssemblyAI | SOC 2 Type 2; ISO/IEC 27001 |
| Anthropic | SOC 2 Type I and II; ISO/IEC 27001:2022; ISO/IEC 42001:2023 |
| Civo | ISO/IEC 27001:2022 — certificate GB24111207, scope “Civo Public Cloud & AI”; SOC 2 Type II; Cyber Essentials. The Harlow facility additionally holds ISO/IEC 27001, ISO 9001, 14001, 22301, 45001, 50001, SOC 2 Type 2, PCI DSS and Cyber Essentials Plus, and Uptime Institute M&O. |
| Stripe | PCI DSS Level 1; SOC 1 and SOC 2 |
What we don’t do
We give customers 30 days’ notice before adding or replacing a sub-processor. If you object to a change, you may terminate without penalty for the remainder of your term.