1. Who we are and our role
Social Media for Schools Ltd, company number 12499067, trading as ReMarkAble AI, provides the service and can be contacted at privacy@remarkableai.co.uk.
For individual accounts, enquiries, security and our own business administration we normally act as a data controller. For pupil and school data submitted through a school account, the school, college or trust normally acts as controller and we act as its processor. The actual role depends on who decides why and how the information is used, not only on the label in a contract.
Our school processing terms are in the School Data Processing Agreement.
2. Information we process
- Accounts: name, email address, age range, role or persona, school relationship, authentication and subscription status.
- School records: school, class and department membership, roster display names or references, staff permissions and invitations.
- Assessment content: uploaded images, handwriting or typed work, OCR transcripts, question details, marks, grades, feedback, teacher review and release status.
- Pupil characteristics: only where a school has specifically enabled an agreed reporting feature; this can include SEND, EHCP, pupil-premium, EAL, looked-after and prior-attainment indicators.
- Support and safety: enquiries, complaints, reported concerns, incident records and communications.
- Technical and usage data: IP address, device/browser information, security events, logs, page or feature events, cookie choice and diagnostic data.
- Payments: customer, subscription and transaction records. Full card data is handled by our payment processor rather than ReMarkAble.
Pupil work may unintentionally contain names, faces, health information, safeguarding disclosures or other sensitive material. Users should avoid including unnecessary information, but our controls do not assume that every submission has been anonymised.
3. Why we use information and our lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Create accounts and provide requested marking, feedback and reports | Contract; or the school controller’s documented instructions |
| Operate school classes, permissions, moderation and teacher-release workflows | Contract and legitimate interests; or the school controller’s documented instructions |
| Protect accounts, prevent misuse and maintain service reliability | Legitimate interests and, where applicable, legal obligation |
| Respond to support, complaints, safeguarding and rights requests | Contract, legitimate interests, legal obligation or vital interests, depending on the circumstances |
| Send optional marketing and use optional analytics or advertising technologies | Consent where required; consent can be withdrawn at any time |
| Maintain financial and corporate records | Legal obligation and legitimate interests |
| Evaluate accuracy and improve the service using ratings, testing and de-identified or aggregated evidence | Legitimate interests, subject to data minimisation and the rights of affected people |
We do not rely on a general statement that using the service means consenting to all processing. Where consent is the basis, it is requested separately and can be withdrawn without affecting earlier lawful processing.
4. Children and school accounts
ReMarkAble is likely to be used by children. We apply high-privacy defaults, limit access by role, provide teacher oversight for school feedback and seek to explain processing in age-appropriate terms. A shorter Children’s Privacy Notice is available.
For a direct online account belonging to a child under 13, verified parent or guardian consent is required before assessment processing. In a school context, the school determines and communicates its lawful basis and any Article 9 condition; ReMarkAble follows the school’s documented instructions. A parent’s consent is therefore not automatically the basis for every school use.
5. AI assessment and human oversight
Submitted work is transcribed and analysed against selected curriculum or mark-scheme material. The service generates suggested marks, grades, strengths and next steps. AI output can be wrong, incomplete or affected by image quality and question selection.
ReMarkAble is not intended to make a solely automated decision with legal or similarly significant effects. Teachers must review output before using it for formal grading, reporting, intervention or any decision that materially affects a pupil. School feedback is not released to a pupil until an authorised member of staff chooses to release it.
6. Recipients and subprocessors
We disclose only the information reasonably required for the relevant service:
| Recipient | Purpose | Information |
|---|---|---|
| Cloud database and storage provider | Authentication, database and file storage | Account, school, uploaded-work and assessment data |
| AI service provider | Transcription (OCR) and AI-assisted assessment | Submitted images or text and generated output; contractually not used to train the provider’s models |
| Website hosting and delivery provider | Hosting and content delivery | Network, request and application data |
| Error monitoring provider | Error and reliability monitoring | Diagnostic events; default PII collection is disabled |
| Email delivery provider | Transactional and service email | Email address, delivery metadata and message content |
| Customer relationship management provider | Enquiries, school relationships and account support | Staff/contact details and relevant account events; not pupil work |
| Payment processor | Payment processing | Customer and transaction information; we do not receive full card details |
| Google, Meta and Microsoft | Optional analytics or advertising measurement | Online identifiers, device/browser and event data, only according to the user’s cookie choice |
You can ask us for the names of these providers at dpo@remarkableai.co.uk. Schools receive the named list in their Data Sharing Agreement.
We may also disclose information to professional advisers, regulators, courts, law-enforcement or safeguarding authorities where authorised or required by law, or where necessary to protect someone’s vital interests.
7. International transfers
Some suppliers process information outside the United Kingdom. We use applicable UK adequacy regulations or safeguards such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, with transfer risk assessments and supplementary measures where required. You may request further information from dpo@remarkableai.co.uk.
8. Retention
| Information | Normal period |
|---|---|
| Identifiable uploaded work, OCR text and detailed assessment feedback | Up to 12 months from submission, unless deleted earlier or a school contract requires a shorter period |
| Active account, school, class and permission records | For the account or school-service term |
| Closed account and school-service data | Deleted or irreversibly de-identified within 30 days, except legal records and protected backup copies awaiting ordinary rotation |
| Payment and accounting records | Normally 7 years where required for tax and accounting purposes |
| Consent and material agreement records | For the agreement term and the period needed to establish or defend legal rights |
| Security, diagnostic and support records | According to risk and operational need, normally no longer than 24 months unless an incident or legal requirement justifies longer |
| Demonstrably anonymised aggregate statistics | May be retained without a fixed period because they no longer identify an individual |
We periodically review these periods. A legal hold, safeguarding need or statutory duty may require limited information to be kept longer; if so, it is restricted to that purpose.
9. Cookies, analytics and marketing
Essential storage supports authentication, security and the recording of privacy choices. Optional analytics and marketing technologies are disabled unless the user chooses them. Authenticated pupils are not deliberately identified to analytics services by their ReMarkAble account ID. Details and controls are in the Cookie Policy.
10. Security
We use proportionate technical and organisational measures including encrypted transport, provider encryption-at-rest controls, role-based access, row-level database restrictions, logging, restricted administrative functions, secure development practices and incident handling. No internet service can guarantee absolute security.
11. Your rights
Depending on the circumstances, UK data-protection law gives you rights to:
- be informed and obtain access to personal information;
- correct inaccurate or incomplete information;
- request erasure or restriction;
- receive applicable information in a portable format;
- object to processing based on legitimate interests or direct marketing;
- withdraw consent where processing relies on consent; and
- ask for human review of a qualifying solely automated decision.
Contact privacy@remarkableai.co.uk. For school-controlled pupil data, we may refer the request to the relevant school and assist it. We may need proportionate identity verification. You may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.
12. Changes and contact
We review this notice when the service, suppliers or law changes. Material changes will be brought to account holders’ attention before they take effect where reasonably practicable. Questions can be sent to privacy@remarkableai.co.uk or by post to ReMarkAble AI, c/o Hermes Digital Ltd, Building 4, Ingles Yard, Jointon Road, Folkestone, Kent CT20 2RY.