Mark Maker — Privacy Policy

Effective date: 24 August 2026 Last updated: 9 October 2026

Mark Maker ("Mark Maker", "we", "us", "our") is an online tool that helps South African teachers and students generate CAPS/IEB-aligned test papers, marking memos and related material. This policy explains what personal information we collect, why we collect it, who we share it with, and the choices and rights you have.

We are committed to protecting your personal information and to processing it lawfully under the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Who is responsible for your information

The responsible party (data controller) is:

• Gabriel Katz, trading as Mark Maker
• Based in Johannesburg, Gauteng, South Africa
• Information Officer: Gabriel Katz
• Privacy contact: support@markmaker.co.za

If you have any question about this policy or about how we handle your information, contact us at the address above.

2. The information we collect

We only collect information we need to run the service.

a. Account information. When you register, we collect your email address, a password (stored only as a secure cryptographic hash — we never see or store your actual password), and your role (teacher or student).

b. Content you provide. When you generate a paper you may provide a topic, teacher notes / resources, and optional source materials — text you paste (extracts, scenarios, data) or files and images you upload (for example PDFs or diagrams). You control what you submit; please do not paste sensitive personal information about identifiable individuals into these fields unless you have a lawful basis to do so.

c. Generated content and history. We store the papers and memos you generate so you can access them in your history, subject to limits based on your plan. If you add a school logo, we keep it on your account so it can appear on your covers on any device, and any images printed in a paper are stored with that paper so it opens complete from your history. These images are kept in private storage that only your account can reach.

d. School account information. If your school holds a Mark Maker licence, we also store which school your account belongs to, your role in it (administrator, head of department, or teacher), and which departments you are assigned to. This is what allows your school to manage its own seats and departments. See section 5a for who at your school can see what.

e. Sign-in device information. To warn you if someone else signs into your account, we store a one-way cryptographic hash of your browser and operating system, together with a short description such as “Chrome on Windows” and the date. We do not store your IP address or location for this purpose, and the hash cannot be reversed to identify your device elsewhere.

f. A parent or guardian's email address. Where a student under 18 registers, we ask for the email address of the parent or guardian who consented. It is used once, to send them a notice that the account exists, and is then kept only as a record that the notice was sent. See section 11.

g. Bot-protection checks. When you sign up, sign in or reset your password, Cloudflare Turnstile checks that a real person is using the form rather than an automated script. To do this it looks at signals from your browser. Usually you will see nothing at all. We do not receive or store the underlying signals — only whether the check passed.

h. Usage and billing records. We keep records needed to operate your account and billing — your plan / tier, credit and generation counts (a usage ledger), and subscription status.

i. Payment information. Payments are processed by our payment provider, Paystack. Mark Maker does not collect or store your full card number, CVV, or bank details — these are handled directly by Paystack under their own security standards. We receive only limited transaction and subscription information (for example, that a payment succeeded and when a subscription renews or is cancelled).

j. Technical and log data. Our hosting and infrastructure providers automatically process technical data such as your IP address, browser and device type, and request logs, for security, fraud prevention and reliability. Your browser also stores small amounts of data locally on your device (see Section 9, Cookies and local storage).

We do not run advertising, and we do not sell your personal information.

3. How and why we use your information

We process your information for the following purposes and on the following POPIA bases:

We do not use your generated content or source materials to build advertising profiles.

4. AI generation

Mark Maker uses Anthropic's Claude models to generate papers and memos. To create your content, the information you submit for a generation — such as your topic, teacher notes and any source materials — is sent to Anthropic to be processed and returned to you. Anthropic acts as a processor for this purpose. By default, and per Anthropic's Commercial Terms, content submitted through the Anthropic API is not used to train their models (this default does not change unless we were to explicitly submit it as feedback, which we do not do). We ask that you avoid submitting unnecessary personal information about identifiable people in generation inputs.

5. Who we share your information with

a. Your school, if your account is part of a school licence

If your school holds a Mark Maker licence and your account belongs to it, certain people at your school can see limited information about your use of the service. We think you should know exactly what that is.

Your school administrator (usually the principal or the person who manages the licence) can see, for every member of the school: your email address, your role and departments, and for each paper you generate the subject, grade, topic, paper type, mark total and date. They can add and remove people from the school and change roles.

A head of department can see the same information, but only for teachers in the departments they head.

What they cannot see: the content of your papers or memos is never visible to anyone at your school through Mark Maker. Our system is built so that paper content is not reachable from the school view at all — not merely hidden from it. Your school also cannot see your password, your device information, or papers you generated before joining the school.

Joining a school is your choice. If you already have a Mark Maker account, a school cannot add you to it without your agreement: you will be shown an invitation explaining what becomes visible, and you may decline it. If you registered using an address your school had already added, joining that school was part of creating the account.

If you leave a school, or are removed from it, your account and your own papers remain yours and the school loses access to your activity.

b. Service providers

We do not sell your personal information. We share it only with the service providers ("operators" / processors) needed to run Mark Maker, and only as far as necessary:

Each provider processes your information only on our instructions and under their own security and privacy obligations. We may also disclose information if required by law, to protect our rights, or as part of a business transfer, in each case as permitted by POPIA.

6. Cross-border transfers

Because our providers operate internationally, your information may be stored or processed outside South Africa — in particular, account and history data is stored in the European Union (Supabase, eu-west-1), and generation inputs are processed in the United States (Anthropic). Where we transfer personal information across borders, we do so in line with section 72 of POPIA — relying on the recipient being subject to laws or binding agreements that provide an adequate level of protection, and/or on the transfer being necessary to perform our contract with you.

7. How long we keep your information

We keep personal information only as long as necessary for the purposes above:

• Account information — for as long as your account is open.
• Generated papers and history — while your account is open, subject to the history limits of your plan (older items may fall away as newer ones are saved).
• Your school logo — until you remove it or delete your account. Images in a paper — for as long as that paper is in your history; they are deleted with it.
• Usage and billing records — for as long as needed to operate your account and to meet financial record-keeping and legal obligations, which is 5 years after a transaction, to meet accounting and tax record-keeping requirements.
• When you delete your account — we soft-delete your account and then remove or de-identify your associated personal data on our regular purge cycle, except records we are legally required to retain (for example, transaction records for tax purposes).

8. Your rights under POPIA

Subject to POPIA, you have the right to:

• Access the personal information we hold about you;
• Correct or update information that is inaccurate or incomplete;
• Delete your account and associated personal information;
• Object to certain processing;
• Withdraw consent where we rely on it (this won't affect processing already carried out); and
• Complain to the Information Regulator.

You can exercise several of these directly in the app — you can export your data and delete your account from your account settings — or contact us at support@markmaker.co.za and we will respond within a reasonable time.

You may lodge a complaint with the Information Regulator (South Africa):

• Website: https://inforegulator.org.za
• Email (complaints): POPIAComplaints@inforegulator.org.za
• Postal: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Using the prescribed forms

You can exercise these rights by contacting us at support@markmaker.co.za, or by using the tools in your account — you can export or delete your own data at any time without making a formal request. If you prefer to use the prescribed forms, you may submit Form 2 (request for correction or deletion of personal information) or Form 1 (objection to processing), both available from the Information Regulator's website, to the same address. We will treat a request in any of these forms the same way.

Requesting records under PAIA

Separately from POPIA, the Promotion of Access to Information Act (PAIA) gives you a right to request access to records we hold. Send any such request to support@markmaker.co.za, marked for the attention of the Information Officer, describing the records you are looking for and the right you are seeking to exercise. We will respond as required by the Act. Our PAIA manual, which sets out what records we hold and how to request them, is available at markmaker.co.za/paia.html.

9. Cookies and local storage

Mark Maker uses your browser's storage for the app to work — not for advertising. This includes:

• an authentication token to keep you signed in;
• application state, such as your saved form settings and whether you've collapsed the Quick Guide.

We do not use third-party advertising or cross-site tracking cookies. You can clear this storage in your browser at any time, though doing so will sign you out and reset your saved preferences.

10. Security

We take reasonable technical and organisational measures to protect your information, including encrypted connections (HTTPS), storing passwords only as secure hashes, access controls, and relying on reputable providers with their own security standards. No system is perfectly secure, but we work to protect your information and to address any security incident appropriately, including notifying you and the Information Regulator where the law requires.

11. Children's privacy

Mark Maker is designed for use by teachers and by students, and student accounts may be used by learners under 18. Where we process the personal information of a child (a person under 18), we rely on the consent of a competent person — ordinarily a parent or guardian — as required by section 35 of POPIA.

When a student registers, we ask them to confirm that a parent or guardian consents to their use of Mark Maker, and to give us that adult's email address. We write to that address once, after the student first signs in, to say that the account exists and how to have it removed. We do not use it for anything else, we do not add it to any mailing list, and we do not share it. If a parent or guardian asks us to delete the account or their address, we do so. If you are under 18, please use Mark Maker only with the permission and guidance of a parent, guardian or teacher. If you believe a child's information has been provided to us without the necessary consent, contact us at support@markmaker.co.za and we will take appropriate steps to address it.

Teachers remain responsible for how they use generated material with their learners and for any personal information they choose to include in their inputs.

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of Mark Maker after an update means you accept the revised policy.

13. Contact us

For any privacy question or to exercise your rights:

Gabriel Katz, trading as Mark Maker Johannesburg, South Africa support@markmaker.co.za