Who this policy covers
This policy explains how e-Marking handles information when you visit the website, register an account, contact us or use a staff or school portal. The service is operated by Site coordinator. Contact the coordinator through the website contact form for privacy questions and requests.
This is an independent examination simulation for fictional Roblox schools. It is not a real awarding body. Candidate entries, exam papers and disciplinary cases should use fictional characters or roleplay identities, not real pupils' records. Do not upload real medical records, safeguarding reports, identity documents or other sensitive personal information.
Information we collect
Account information includes your name or display name, email, assigned role, school association, account status and password hash. If you sign in with ChatGPT, the hosting platform supplies your authenticated identity and email, and may supply your display name. We do not receive your ChatGPT password.
School registration and contact forms collect the name, school or organisation, email and message you enter. Schools and authorised users provide fictional candidate entries, coursework, scripts, marks, annotations, appeal reasons and investigation statements. Audit records identify users who perform recorded actions. Email drafts and sent history contain recipients, message text, application references, sending status and provider identifiers.
For security, the app stores session and account-link token hashes and short-lived rate-limit records. Rate limits use hashed request identifiers which may incorporate the IP address provided by the hosting platform. The hosting and email services may also process technical request or delivery records under their own policies.
Why we use information
We use information to identify users, control access, allocate marking, operate private school portals, assess roleplay papers, handle applications, appeals and enquiries, send requested service correspondence and prevent misuse. Our legitimate interests are administering and securing this voluntary simulation service and responding to people who ask for help. We limit information to what is needed for these purposes and consider people's privacy interests, especially where children may use the service.
The contact form is not a marketing subscription. Account and application messages relate to your use of the service. Reading this policy or submitting a form is not consent to unrelated marketing.
Who can access information
Coordinators administer accounts and records. An exams officer can access their own school's portal records. Examiners access assigned work; senior reviewers can access records required for their review, quality-control and flag-handling duties. School access does not give other schools access to your records.
The hosted service uses OpenAI Sites and Cloudflare infrastructure for hosting, identity, database and document storage. When configured, Resend processes account-link emails and messages sent from the portal. A configured Reply-to inbox receives replies under that mailbox provider's arrangements. The application does not sell contact information or include advertising trackers.
Infrastructure providers may process information in countries outside the UK. The coordinator can provide details of the hosting and email arrangements and applicable transfer safeguards on request. Moving the service to another host may change these arrangements; this notice will need updating when that happens.
Cookies and security
The application uses an essential exam_session cookie for email sign-in. It lasts up to 24 hours and is restricted to secure connections. Hosting and ChatGPT sign-in can use additional authentication cookies managed by the platform. The app has no optional analytics or advertising cookies of its own.
Passwords are stored as salted hashes. Session and recovery tokens are stored as hashes. A linked email service key is encrypted in the database using a server-held encryption key. Staff can set a temporary password, but existing passwords are not displayed. Role checks control access to private APIs and documents. No online service can guarantee absolute security; report suspected unauthorised access through the contact form.
How long information is kept
Portal records remain while they are needed for active accounts, school administration, unresolved applications, marking, appeals, enquiries and security accountability. These records have no automatic scheduled deletion in the current application: removal is managed by the coordinator. Deactivating an account prevents access but does not delete its marking history. Ask the coordinator to review or remove information which is no longer needed.
Email sessions expire after 24 hours and verification or password-reset links after 30 minutes. Expiry prevents their use; it does not mean every expired database record is immediately erased. Rate-limit records expire after 15 minutes and are cleared during later requests. A coordinator factory reset deletes application accounts, uploaded documents, portal records, email history and saved connection settings. Hosting, mailbox or email-provider records may have separate retention arrangements.
Your privacy rights
Depending on the circumstances and applicable law, you may request access to your information, correction, erasure, restriction or portability. You can also object to uses based on legitimate interests, including the service-administration purposes described above. These rights have conditions and exceptions; we may need to verify your identity before responding. Contact the coordinator through the website contact form and describe your request without including passwords.
If information is processed on consent, you may withdraw that consent without affecting earlier lawful processing. If you are unhappy with how a privacy concern is handled, you can contact the UK Information Commissioner's Office at ico.org.uk or the appropriate authority where you live. These rights apply to personal information, including account and contact details, even though examination records are intended to be fictional.
Updates and contact
The date at the top shows when this policy text was last updated. Material changes will be explained through an appropriate service notice. Use the website contact form for questions, complaints, information requests or to report accidentally uploaded real personal data.