Last updated 3 August 2026

Privacy at Margin

Margin is run by Uni Admissions Prep Ltd (company 17325935), registered at 28 Denton Close, Barnet, EN5 3AP. The company is the data controller for everything on this page. Write to shrey@tmua.co.uk about any of it.

Three things here touch your data: the essay marker, the email list, and an account if you buy the question bank. The marker and the guides need none of them.

Marking your essay

The six checks under “Check my essay” read your draft in the browser and send nothing anywhere. “Mark my essay” is different. Pressing it sends the question and the draft to Vercel’s AI Gateway. The gateway tries up to two models in turn until one replies, so a single press can reach more than one company. The first is Gemini, which Google both makes and runs. The second is gpt-oss, which OpenAI made and released as an open model: OpenAI does not run it for us, and Vercel picks which of its inference partners does. We do not choose that company and cannot tell you in advance which one answers.

Every request we send carries the gateway’s zero-data-retention and disallow-prompt-training flags. The gateway then hands the draft only to a provider that has agreed with Vercel to delete it once the request is answered and not to train on it, and it refuses the model outright rather than routing around those rules. A model that holds no such agreement is not in the list, because we would rather drop it than send your essay somewhere the promise above does not reach.

Margin writes no copy of the essay to any store, and the request carries nothing that identifies you. So that one connection cannot flood the model chain everyone else is queueing behind, we hold a salted one-way hash of your IP address in memory. It stops counting after sixty seconds and is thrown away the next time anyone marks an essay, and everything held this way is gone whenever our server restarts. It is written nowhere.

Keep your own life out of the box. It is for practice essays. Do not paste your name, your school, your UCAS details, or anything that reveals your health, religion, politics, sex life, ethnicity or a criminal matter. We never ask for any of that, and once a request is sent we have no way of pulling it back.

Sending it outside the UK

Google is based in the United States, and so are Vercel, Stripe and Supabase. We do not pin the gateway to a region, so we cannot promise you which country the company running gpt-oss answers from. Your email address sits in a Vercel Blob store in London (region lhr1).

Margin holds no contract with any of the model companies. Vercel does, and Vercel acts as our processor under its Data Processing Addendum, which incorporates the UK International Data Transfer Addendum to the standard contractual clauses. That is the safeguard the marker and this site rely on. Stripe and Supabase are separate processors under their own agreements. Ask and we will send you a copy of ours.

If you would rather nothing of yours left the UK at all, use the six checks and do not press “Mark my essay”.

What changed on 3 August 2026

Until that day the marker sent every essay first to two models run from China, a country the UK has made no adequacy finding for. Both left the chain on 3 August and are not in the list above. If you marked an essay before then we have no way to reach you about it, because we keep nothing that identifies you, and we cannot tell you what those companies kept: for part of that day the requests did not yet carry the deletion and no-training rules. Write to shrey@tmua.co.uk if you want to know more.

The email list

A signup records your email, the time you consented, the versions of the consent wording and of this notice, and whether you arrived directly, through a Margin guide, or from one of the free tools. You may also say whether this is your first LNAT or a retake; that is optional and only decides which guides you get. Vercel stores the record in a private Blob store in London.

Your account and paying

Buying the question bank needs an account. Signing up records your email address and a password, held by Supabase on our behalf; we never see the password. When you buy, Stripe takes the payment and receives your email address to send the receipt. Margin never sees your card. Stripe tells us that the payment succeeded and which product it was for, and that is what opens the bank for your account.

Signing in sets one cookie, lnat_session. It keeps you signed in and does nothing else. There is no cookie until you sign in, no advertising cookie, and no third-party tracker.

What is counted

Vercel Analytics receives page views and product events. It never receives your email, your essay or your password. The events around marking record that you started, checked, asked for a mark and got one back, which of three length bands your draft fell into, whether it was the sample essay or your own, and which guide you arrived from. Nothing in any of them identifies the draft or the person who wrote it. Margin runs no advertising.

Why we are allowed to do each of these

Marking, and the IP hash behind it: Our legitimate interests in running the free tool you pressed and keeping it available to everyone else.
The email list: Your consent, which you can withdraw at any time. Any email we send carries an unsubscribe link.
Your account and your purchase: Our contract with you. We cannot give you an account, take a payment or give you what you paid for without them.
Counting page views: Our legitimate interests in knowing which pages get read.

Objecting

Where we rely on legitimate interests, you can tell us to stop. Email shrey@tmua.co.uk and say so. You do not have to give a reason, and we stop unless we can show a reason that outweighs yours.

If you are under 18

Everyone Margin is built for is a child in data-protection terms, so the marker is built to need nothing about you: no account and no age. If you are under 13, ask a parent before joining the email list, because below that age the consent has to come from them. A parent or guardian can write to us about anything on this page.

How long we keep things

Your essay: No copy is written here, so we have nothing to keep. The provider that answers has agreed with Vercel to delete it once the answer is sent, which is the rule the zero-data-retention flag enforces.
The IP hash: Sixty seconds, in memory, then deleted.
A signup: Until you unsubscribe or ask us to delete it. When you unsubscribe we delete the readable email and the unsubscribe link. What stays is a one-way fingerprint of the address, so it is not added again by mistake, plus when you first joined, which guide or tool you came from and your attempt stage. Ask and we will erase all of it.
Your account: Until you ask us to close it. A record of the purchase itself is kept for as long as tax law requires.
Analytics events: For as long as Vercel retains them for this site.

Your rights

You can ask for access, correction, deletion, restriction or a portable copy of anything we hold, object to the processing we base on legitimate interests, and withdraw consent. Email shrey@tmua.co.uk. It costs nothing and you do not have to say why. You can also complain to the Information Commissioner’s Office. Giving us your email is a choice, never a condition of using anything on the site.