← ✏️ Markah

Privacy Policy

Last updated: 21 October 2026

1. Introduction

Markah ("we", "our", or "us") is operated by Niskala, Kuala Terengganu, Malaysia. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Markah platform at markah.my.

By using Markah, you agree to the practices described in this policy. This policy is prepared in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

2. Information We Collect

Account information: When you register, we collect your email address and a hashed password (or a Google account identifier if you sign in with Google).

Essay photos and text: You may upload photos of handwritten essays for handwriting recognition and grading. Photos are stored on our servers with the class they belong to, so you can check the transcription against the original and re-grade an essay. When a teacher corrects an essay's transcription, we also keep a copy of that essay image with the corrected text, stored without the student's name, to improve handwriting-recognition accuracy. You can delete a class at any time from your Account page, which permanently deletes its essays, grades and photos. All essay photos are deleted when the account is deleted.

Grading results: The extracted essay text, criterion scores, feedback, and related metadata are stored in your account so you can review and export them later.

Usage data: We track the number of essays graded per account to enforce the free-tier limits. We do not use cookies for advertising or tracking purposes.

Site analytics: We use Cloudflare Web Analytics to count page visits. It does not use cookies, does not track you across other websites, and does not identify you personally.

Visit counts: We also count page visits ourselves, as daily totals of the page visited, the website that linked to it and the device type (mobile, tablet or desktop). We do not use cookies for this and do not store your IP address or any identifier. Your browser remembers the first Markah page you opened; if you then create an account, that page and the linking website are saved with your new account so we can see which pages help teachers find Markah.

Early-access sign-ups: If you join an early-access list (for example Semak Assignment), we store your email address, the role and level of study you choose, your answer about pricing, whether you offered to share sample work, and the page and website you arrived from. We use this only to contact you about that feature and to decide whether to build it. Reply to any of our emails or write to support@markah.my and we will delete it. If you offer to share sample work, we will contact you first and explain how it would be used before you send anything.

3. How We Use Your Information

  • To provide the Markah grading service
  • To send account-related emails (welcome message, password reset)
  • To enforce usage limits and prevent abuse
  • To improve the accuracy and quality of the grading AI

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Third-Party Service Providers

We use the following third-party providers to operate Markah. Each receives only the minimum data necessary to perform their function:

  • Google Cloud Vision — used as a backup for handwriting recognition when a photo cannot be read by our primary provider. In that case the essay photo is sent to Google's API for processing. Google's privacy policy applies: policies.google.com/privacy
  • OpenAI — used for handwriting recognition and for rubric-aligned grading and feedback. Essay photos and the extracted essay text are sent to OpenAI's API for processing. OpenAI's privacy policy applies: openai.com/policies/privacy-policy
  • Railway — cloud hosting. Our servers and database run on Railway's infrastructure.
  • Google OAuth — optional sign-in method. If you use "Continue with Google", Google authenticates your identity.

5. Data Retention

Your account data (email, grading sessions, essay results) is retained for as long as your account is active. You may delete your account at any time by contacting us at contact@niskala.my. Upon deletion, all associated data is permanently removed within 30 days.

Essay photos are stored with the class they belong to until you delete that class or your account, so transcriptions can be checked and essays re-graded. Images kept with transcription corrections are stored without the student's name. All essay photos, including those kept with corrections, are deleted when the associated account is deleted.

6. Data Security

We use industry-standard measures to protect your data, including:

  • HTTPS encryption for all data in transit
  • Bcrypt hashing for passwords (we never store plain-text passwords)
  • JWT-based authentication with 30-day token expiry
  • Database access restricted to our application servers only

7. Your Rights (PDPA Malaysia)

Under the Personal Data Protection Act 2010, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate or incomplete data
  • Request deletion of your data
  • Withdraw consent for data processing

To exercise any of these rights, email us at contact@niskala.my.

8. Children's Privacy

Markah is intended for use by teachers, not students. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has created an account, please contact us and we will remove it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of Markah after changes constitutes acceptance of the updated policy.

10. Contact

For privacy-related questions or requests, contact:
Niskala
Email: contact@niskala.my
Kuala Terengganu, Malaysia