Draft notice

This document is a plain-English summary, current as of May 2026. Schools entering a paid contract receive a full Data Processing Agreement (DPA). For the binding version contact parth@markaroo.co.uk.

Who we are

Markaroo is operated by Citrine & Sage Limited, registered in England, Company No. 16038867. For data-protection enquiries, write to parth@markaroo.co.uk.

The data we process

Why we process it

We do not use submitted answers or feedback to train external AI models.

Where data lives

All Markaroo application data is hosted on UK-based servers. AI grading inference runs through Google Cloud's Gemini service under contractual terms that prohibit training use. See the Data Security page for the full sub-processor list.

How long we keep data

Workspace data persists while the workspace is active. Deleted workspaces, and any data they contain, are removed from primary systems within 30 days and from backups within 90 days. Schools may request immediate erasure at any point.

Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing. To exercise these rights, email parth@markaroo.co.uk. You can complain to the ICO if you're dissatisfied with our handling of a request.

Cookies

Markaroo uses essential cookies for authentication and session management. No advertising cookies, no third-party trackers.

Changes to this policy

We'll update this page when our practices change and notify pilot schools by email of any material change.