ExComS AI Marking Agent Privacy Policy
Last updated: 3 August 2026
This notice explains how the ExComS AI Marking Agent (“the Service”, “we”, “us”) handles personal data, and the rights you and your students have over it. The Service is an AI grading assistant for teachers, lecturers, and professional trainers. You define a marking rubric, upload student submissions, and the Service drafts per-criterion scores, rationale, and student feedback for you to review, correct, and confirm.
1. Who we are
The Service is provided by Express Communication Services Ltd, trading as ExComS, a company registered in the United Kingdom, and is developed by ExComS Innovation Center Ltd (company number 10982946). Express Communication Services Ltd is the data controller described in this notice.
- Company number: 08099517
- Registered office: 960 Capability Green, Capability Green, Luton, LU1 3PE
- ICO registration number: ZB224770
- Privacy contact: hello@excoms.ai
2. Controller and processor roles
Two kinds of personal data pass through the Service, and the roles differ.
- Your account data (your name, email, sign in identifiers, subscription status, usage records). For this data, ExComS is the data controller.
- Student submission content (the assignments you upload and everything derived from them: extracted text, scores, feedback, your corrections). Where you use the Service on behalf of a school, college, university, or training organisation, that institution is the data controller of student content and ExComS is its data processor, acting only on the instructions given through your use of the Service. If you use the Service as an individual professional, you are responsible for ensuring you are entitled to upload the submissions you process.
Institutions can request our data processing terms and a completed Data Protection Impact Assessment (DPIA) pack by emailing hello@excoms.ai.
3. What data we process
- Account data. Name, email address, and sign in identifiers, collected when you create an account (sign in is managed by our authentication provider, Clerk).
- Student submissions. Files you upload for grading (DOCX, PDF, or typed text). These may contain student names and coursework content. The uploaded file itself is deleted within seconds of grading (see section 7); the text extracted from it is retained in your account so you can review evidence and re-check grades.
- Rubrics and reference material. Your marking rubrics, and any teaching materials (mark schemes, model answers, worked examples) you attach to a rubric.
- Grading data. AI drafted scores, rationale, student facing feedback, your corrections and confirmations, and the audit trail of grading events.
- Billing data (paid plans). Paid subscriptions are sold through the Microsoft Commercial Marketplace. Microsoft is the merchant of record and handles payment. We receive subscription status to activate your plan; we do not receive or store your card or bank details.
- Technical data. Session tokens and limited operational logs (including IP address and error diagnostics) used to run and secure the Service.
We do not ask for special category data (for example health or biometric data). Where such data appears incidentally inside a submission, it is handled under the same protections and deletion rules as the rest of the submission. We encourage institutions to anonymise submissions before upload where practical.
4. Why we use it, and our legal basis
| Purpose | Legal basis (UK GDPR Article 6) |
|---|---|
| Provide the Service: grade submissions against your rubric, show results, support your review | Performance of a contract (account data); processing on the controller institution’s instructions (student content) |
| Learn your marking standard from your corrections so future drafts match it | Performance of a contract; this calibration profiles the marker’s standard, not the student |
| Activate and administer your subscription or trial | Performance of a contract |
| Keep the Service secure and reliable, prevent abuse, diagnose faults | Legitimate interests (running a secure service) |
| Communicate about your account, trial, or subscription | Legitimate interests / contract |
We do not use your content, or your students’ content, to train AI models.
5. AI processing and human confirmation
Grading drafts are produced by a large language model (Azure OpenAI Service, GPT-4o, UK South deployment). Every AI drafted mark is presented to you for review, and the Service requires a human marker to confirm each paper’s result, with a recorded attestation, before it stands as the awarded outcome. Marks are therefore not the result of solely automated decision making: the human marker’s review and confirmation is a designed part of the process, and you can override any AI draft.
6. Who we share it with (sub-processors)
We do not sell personal data and we use no advertising trackers. Our sub-processors are limited to:
- Microsoft Azure (Azure Container Apps, UK South region): application hosting.
- Azure OpenAI Service (UK South region): the AI grading model. No content sent to it is used for model training.
- MongoDB Atlas (hosted in the EU/UK): the database holding extracted text, rubrics, grading results, corrections, and audit records.
- Clerk: sign in and account authentication, under Clerk’s data processing terms.
- Microsoft Commercial Marketplace: billing for paid subscriptions, under Microsoft’s own terms.
7. How long we keep it
We keep this deliberately simple and under your control.
- Uploaded submission files are permanently deleted from our systems within seconds of grading. We do not keep the original file.
- Extracted submission text, scores, rationale, and feedback are retained in your account so you can review evidence, re-check grades, and run originality checks. They are deleted when you delete the paper, the batch, or the rubric, or when you reset your account. Deletion cascades: removing a rubric also removes its batches, results, corrections, and audit records.
- Reference material attached to a rubric is retained so later grading runs with that rubric can consult it, and is deleted when the rubric is deleted.
- Account data is retained for the life of your account.
- Retention is user triggered: content stays until you delete it. For institutional deployments, an automatic time based retention sweep can be enabled on request so that submission data is purged after a fixed number of days.
8. Where your data is processed
Application hosting and AI processing run on Microsoft Azure in the UK South region. Application data is stored on MongoDB Atlas in the EU/UK. We do not transfer your marking content outside the UK and EU in the course of providing the Service. Sign in and account data is processed by our authentication provider Clerk under its data processing terms, which include UK GDPR compliant transfer safeguards where transfers occur.
9. How we protect your data
Each marker’s data is isolated from every other marker’s at the application and database level, and this isolation is covered by automated tests. Data is encrypted in transit (HTTPS) and at rest (AES-256 on both the compute and database layers). Access to production systems is restricted to authorised personnel. No system is perfectly secure, but we take reasonable and proportionate measures to protect your information, and we will notify you and regulators of any breach as the law requires.
10. Your rights, and your students’ rights
Under UK GDPR you have the right to access, correct, erase, restrict, port, and object to the processing of your personal data. Contact hello@excoms.ai to exercise any of these.
Students should normally direct rights requests to their institution, which controls their submission data; we will assist the institution in fulfilling them, and the in product deletion controls (paper, batch, rubric, account reset) let the institution act on erasure requests immediately.
You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk), though we would appreciate the chance to resolve concerns first.
11. Children
The Service is for professional users aged 18 or over. Student submissions may relate to data subjects of any age; responsibility for the lawful basis of processing their work rests with the controller institution, supported by the safeguards in this policy.
12. Changes to this policy
We may update this notice. We will post the new version here, update the date above, and tell users about significant changes.
13. Contact
ExComS · hello@excoms.ai · https://excoms.ai/contact-us/
