Privacy Policy

Last updated: 23 October 2026

We handle personal data in line with Singapore's PDPA 2012, Malaysia's PDPA 2010, Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486), Taiwan's Personal Data Protection Act, US COPPA and FERPA, Australia's Privacy Act 1988 and Canada's PIPEDA. The "teaching region" you choose only changes grade names, rubrics, comment templates and topic banks; it does not change where or how data is stored. The Chinese version has the same meaning.

1. What we collect

• Account: your email, the name you give and optional details (such as how you heard about us). There are no passwords; you sign in with Google or a one-time email code. Codes are stored only as one-way hashes and expire after 10 minutes.
• Google sign-in: if you use it, we receive only your Google account ID, verified email and name. We never receive your Google password, contacts or other Google data.
• Teaching content: essay photos you upload, recognised text, feedback and your edits.
• Student information: student names (or numbers or pseudonyms) and grades you enter in your classes.
• Purchases: if you buy a credit pack, Paddle as Merchant of Record collects your name, email, billing address and payment details under the Paddle Privacy Policy. We receive only the order number, pack, amount, currency, billing country and order status. We never see card details.
• Usage and technical data: feature usage, credit deductions, chats with the assistant, feedback you send, and access logs such as IP address and browser and device type, used for security, troubleshooting and improving the product.

2. How we use it

• Only to provide recognition, marking and class management; to calculate and grant credits and process purchases and refunds; to send sign-in codes, service notices and replies to your feedback; and for security and product improvement.
• We do not sell or rent any teacher or student data, show no ads, build no profiles beyond what marking needs, and do not use your or your students' data to train AI models.

3. Student data

• By entering student names or uploading student essays you confirm that you are the responsible teacher and have any authorisation required by your school and local law (for example, school approval or parental notice). For student data we act on behalf of the teacher and school, on the teacher's instructions, for marking purposes only.
• Please enter only the minimum needed for marking; do not enter students' addresses, contact details or ID numbers.
• Whenever class data is sent to an AI model, real student names are first replaced with pseudonyms such as "该生" or "学生1" and restored afterwards. This protection is always on. Names handwritten on essay photos cannot be replaced at the image level, so we suggest students write only a number or pseudonym.
• We do not knowingly collect personal data directly from children. If a student has registered, we delete that account and its data. Parents or schools can ask the teacher, or email us, to access, correct or delete a student's data.

4. Where data is stored and who processes it

Your data is stored in Singapore. We use these processors, which act only on our instructions:

• Alibaba Cloud, Singapore region: servers, database and private object storage for essay images and backups.
• Alibaba Cloud Model Studio, Singapore region: essay images go to the 通义千问 model for handwriting recognition; recognised text, marking requirements and pseudonymised student information go to the DeepSeek model for feedback. Under its terms, API inputs are processed transiently and not used for training.
• Google: only to verify your identity if you choose Google sign-in.
• Paddle (Paddle.com Market Limited, United Kingdom): only when you buy a credit pack, as Merchant of Record for payment, tax, receipts and refunds.
• Resend (a US company; we use its Tokyo region): sign-in codes and service emails, limited to your email address and the message content.

The operator maintains the servers remotely over encrypted connections and may access data from outside Singapore while doing so, with the same level of protection and only as needed to run the Service. Wherever you access the Service from, your data is transferred to Singapore. Where local rules require separate notice or consent for cross-border transfer, we show a notice and ask for your consent before you use the Service.

5. Retention and security

• Essay images, recognised text and feedback are kept until you delete the student, class, assignment or account, and are then removed from the database, server disk and object storage. Export files are kept on the server for no more than 30 days.
• Order records (order number, pack, amount, currency, billing country, time, refund status) are kept for up to 7 years for tax and accounting purposes, including after account deletion. They contain no student data or teaching content.
• The database is backed up daily and backups are deleted after at most 30 days, so deleted data disappears from backups within 30 days.
• Server access logs are kept for about 2 months. Only the most recent sign-in IP is stored on your account, for security, and it is deleted with the account.
• We use access controls and encryption in storage and transit. No system is perfectly secure. If a breach is likely to significantly affect you, we will notify you within the time required by applicable law and report to regulators where needed (for example, within 3 calendar days under Singapore's PDPA).

6. Your rights

• You can view, edit and delete classes, students, assignments and feedback in the app at any time, and export feedback to Word.
• You can delete your account and all its data under 我的 → 个人设置 (Me → Settings). This cannot be undone.
• You can email us to access or export your personal data, correct it, withdraw consent or complain. We reply within 30 days.
• You may also complain to your local data protection authority, such as Singapore's Personal Data Protection Commission (PDPC).

7. Cookies

We use only cookies needed to keep you signed in. There are no advertising or cross-site tracking cookies and no third-party analytics or ad scripts. Paddle's checkout sets its own cookies when you open it, under Paddle's policy.

8. Changes

We update the date above when this policy changes. Material changes, such as to charges or data use, are announced in the app in advance and, where needed, we ask for your consent again.

9. Contact (Data Protection Officer)

• Data Protection Officer: the developer of Hanmargin
• Email: cyanming2016@gmail.com