Tomorrow’s Marks

Sub-processors

Last updated 5 October 2026 · Draft — awaiting legal review

In short

The 5 companies that handle personal data for us, what each one receives, and where. DeepSeek may train on what it receives; the rest do not. Changed 5 October 2026.

The list

  • Supabase Inc.

    Database, file storage and sign-in. Every record and every uploaded page is stored here.

    Receives
    Your email address, your study records, your uploaded pages.
    Where
    European Union (Frankfurt, Germany)
    Trains on it
    No

  • Vercel Inc.

    Runs the website and the app's server.

    Receives
    Requests passing through the app, including what you send it; server logs without page content.
    Where
    European Union (Frankfurt, Germany); a global network delivers the site's static files
    Trains on it
    No

  • DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.)

    Reads photographed pages and marks them: your written work, and any mark-scheme pages you upload.

    Receives
    The image or text of the page and our instructions — never your email, account or file name. The upload screen asks you to leave out pages with your name on them; if your name is still on a page, it is removed from the text we keep.
    Where
    People's Republic of China
    Trains on it
    Its terms allow it

  • Anthropic PBC

    Standby for reading and marking pages. Used only if we switch to it; nothing is sent to it today.

    Receives
    The same as DeepSeek when in use: the page and our instructions, nothing identifying you.
    Where
    United States
    Trains on it
    No

  • GitHub Inc.

    Runs our scheduled jobs and keeps an encrypted copy of the database for 30 days after each release.

    Receives
    The encrypted backup (it cannot be read without our key); job reports with counts, never your records.
    Where
    United States
    Trains on it
    No

When this list changes

We update this page before a new company receives any personal data, and change the date above. Tutors and centres with a data processing agreement can object to a new sub-processor, as it describes.