Sub-Processor Register
Last updated August 2026
This page lists the sub-processors engaged by Mark My Words Australia Pty Ltd (ABN 93 662 681 450) to process personal information on our behalf in connection with the delivery of our platform and services. A sub-processor is a third party that we engage to process personal information as part of providing our service to schools and teachers.
We review this register at least annually and update it when sub-processors are added, removed, or when their details change. Schools and teachers may contact us at hello@markmywords.au with any questions about our sub-processors or data handling practices.
Our AI is self-hosted in Australia
Mark My Words develops and hosts its own AI models on Microsoft Azure infrastructure located in Australia. We do not send student writing, assessment data, or other platform data to any third-party AI provider such as OpenAI, Google, or Anthropic. All AI processing occurs within Australia, on infrastructure we own and control.
Our AI Model Register lists each model we use, the version in service, what data it receives, and how we notify schools when a model changes.
Overseas processing summary
Most of our data processing occurs in Australia. The following sub-processors involve overseas data transfers:
- Slack — internal team communication only, processed in the United States
- Mailgun — delivery of platform email to teachers and school staff, processed in the United States
- Product Fruits — in-product onboarding and guidance for teachers and school staff, processed in the European Union
- Xero — accounting and invoicing data, processed in the United States
- Stripe — payment processing data, processed in the United States
None of these sub-processors receive student writing or assessment data. All student writing, assessment data and AI processing stays in Australia on infrastructure we own and control.
All overseas transfers are made in accordance with Australian Privacy Principle 8. We put in place contractual data protection terms with each overseas sub-processor requiring it to handle personal information consistently with the Australian Privacy Principles.
Sub-processor details
The following entries provide full details for each sub-processor.
Microsoft Azure
Processed in Australia- Purpose
- Hosting of the Mark My Words platform and storage of platform data.
- Data types disclosed
- All data processed by our platform, including teacher profile data, student writing samples, assessment data, and usage data — stored and processed on Azure infrastructure.
- Location of processing
- Australia (Australia East and/or Australia Southeast regions). Platform data is stored and processed in Australian Azure regions. Microsoft personnel located outside Australia may access data on a limited basis for support and service operations, subject to contractual safeguards.
All platform data is stored and processed in Azure's Australian data centres. Data is not stored outside Australia through this sub-processor.
Microsoft 365
Processed in Australia- Purpose
- Business email, document storage and internal collaboration.
- Data types disclosed
- Staff email communications, internal documents, and any school or teacher information included in business correspondence (for example, names, email addresses and school details shared in support or sales communications).
- Location of processing
- Australia (Sydney and/or Melbourne). Our Microsoft 365 tenant is provisioned in Australia. Under Microsoft’s Privacy and Security Product Terms, Exchange Online mailbox content, SharePoint site content, OneDrive files and Microsoft Teams chat messages are stored at rest only within Australia. Microsoft personnel located outside Australia may access data on a limited basis for support and service operations, subject to contractual safeguards. See their privacy statement.
Staff email and documents are stored at rest in Microsoft’s Australian data centres. Data is not stored outside Australia through this sub-processor.
Slack
Overseas processing- Purpose
- Internal team communication and collaboration.
- Data types disclosed
- Staff messages and files shared internally. School, teacher and partner information may be included where it is discussed in internal business communications (for example, names, email addresses and school details raised in support, sales or account discussions). Student writing and assessment data are not shared in Slack.
- Location of processing
- United States. Slack Technologies (a Salesforce company) stores customer data in the United States. See their privacy statement.
Slack is used for internal team communication only. Transfers are made in accordance with Australian Privacy Principle 8 and under contractual data protection terms with Slack.
Mailgun
Overseas processing- Purpose
- Delivery of transactional and notification email from the platform.
- Data types disclosed
- Recipient email addresses and the content of transactional email we send to teachers and school staff, such as account, login and processing notification emails. Student writing and assessment content are not sent through Mailgun.
- Location of processing
- United States. Mailgun (a Sinch company) processes email in its United States region. See their privacy statement.
Mailgun handles outbound platform email only. Transfers are made in accordance with Australian Privacy Principle 8 and under contractual data protection terms with Mailgun.
Product Fruits
Overseas processing- Purpose
- In-product onboarding, user guidance and feature announcements.
- Data types disclosed
- Teacher and school staff user identifiers and in-app usage data, such as which onboarding tours and guides a user has seen and which features they have used. Product Fruits does not receive student writing or assessment data.
- Location of processing
- European Union (Ireland). Product Fruits is a Czech provider and hosts data in the EU region by default. See their privacy statement.
Product Fruits supports in-app onboarding and guidance for teachers and school staff. Transfers are made in accordance with Australian Privacy Principle 8 and under contractual data protection terms with Product Fruits.
HubSpot
Processed in Australia- Purpose
- Customer relationship management, sales and communications with schools.
- Data types disclosed
- School and organisation names, teacher names and email addresses, deal values and subscription information, and sales and communication history with school contacts.
- Location of processing
- Australia (Sydney). Our HubSpot data is hosted in HubSpot's Australian data centre located in Sydney.
HubSpot data is hosted in Australia (Sydney). Data is not stored outside Australia through this sub-processor. HubSpot is a US-domiciled company and its personnel may access data from outside Australia for support purposes, subject to contractual safeguards.
Zendesk
Processed in Australia- Purpose
- Customer support ticketing and help desk.
- Data types disclosed
- Teacher and school contact details, the content of support tickets, and any information a user includes when raising a support request. Where a ticket relates to a school that came to us through a partner, a copy of the ticket may be shared with that partner.
- Location of processing
- Australia (Sydney). Our Zendesk data is hosted in Zendesk’s Australian data centre located in Sydney. See their privacy statement.
Zendesk data is hosted in Australia (Sydney). Data is not stored outside Australia through this sub-processor. Zendesk is a US-domiciled company and its personnel may access data from outside Australia for support purposes, subject to contractual safeguards.
Stripe
Overseas processing- Purpose
- Payment processing for subscriptions and invoices.
- Data types disclosed
- Billing contact name, school name, email address, and payment card details. Stripe does not receive student data or platform usage data.
- Location of processing
- United States and other Stripe data centre locations. Stripe is PCI-DSS Level 1 certified. See their privacy statement.
Stripe processes payment data in the United States and other locations. Stripe is certified to PCI-DSS Level 1, the highest level of payment security certification.
Seven Steps to Writing Success
Processed in Australia- Purpose
- Enabling the opt-in integration between Mark My Words and the Seven Steps portal.
- Data types disclosed
- Teacher name, school name, and school information. This data sharing occurs only where the user opts in when signing up for the Seven Steps portal. Student data is not shared.
- Location of processing
- Australia. Seven Steps to Writing Success is an Australian company and data is handled within Australia.
Seven Steps to Writing Success is an Australian educational partner. Data shared under this arrangement remains in Australia.
Xero
Overseas processing- Purpose
- Accounting, invoicing and financial record keeping.
- Data types disclosed
- School billing details including school name, contact name, email address, and invoice and payment information. Xero does not receive student data, platform data, or teacher data beyond what is included in billing records.
- Location of processing
- United States. Xero stores customer data in data centres located in the United States. See their privacy statement.
Xero holds billing and accounting records only. Transfers are made in accordance with Australian Privacy Principle 8 and under contractual data protection terms with Xero.
Hatch Accounting
Processed in Australia- Purpose
- Bookkeeping, invoicing and accounts administration.
- Data types disclosed
- School billing details including school name, contact name, email address, and invoice and payment information. Hatch does not receive student data, platform data, or teacher data beyond what is included in billing records.
- Location of processing
- Australia. Hatch Accounting is an Australian firm and financial data is handled within Australia.
Hatch Accounting is an Australian company. All financial data handled by Hatch remains in Australia.
Questions and updates
If you have questions about our sub-processors or wish to understand more about how your data is handled, please contact us:
- Email: hello@markmywords.au
- Phone: (+61) 403 651 221
- Address: 700 Connect, University of Melbourne, Victoria
Schools that wish to object to the use of a particular sub-processor, or to withdraw consent to data sharing, should contact us at hello@markmywords.au. We will acknowledge objections within 10 business days and will work with the school to identify a reasonable alternative where one is available. Where no alternative is available, the school may terminate the affected service in accordance with its agreement with us.
This register is reviewed and updated at least annually. Each published version of this register is dated above, and a record of previous versions and the changes made is available on request at hello@markmywords.au.