Generative APIs Privacy Policy

This Privacy Policy outlines how Scaleway (“we,” “us,” or “our”) processes personal data when you use our AI services (hereinafter “Generative APIs”). This policy supplements the Scaleway General Privacy Policy. Any terms defined in the General Data Protection Regulation (GDPR) (EU Regulation 2016/679) or our General Privacy Policy have the same meaning here.

Generative APIs comply with the General Data Protection Regulation (GDPR), ensuring that all personal data is processed in accordance with European Union laws. This includes implementing strong data protection measures, maintaining transparency in data processing activities, and ensuring customers’ rights are upheld.

1. Data Processor

The data processor for the Generative APIs service is Scaleway, with its registered office at 8 RUE DE LA VILLE L’EVÊQUE 75008 PARIS 8. We collect and process your personal data strictly to provide access and functionality to AI services.

2. Data collection and processing

We collect and process the following categories of data:

• Account information: To access Generative APIs, you must create a customer account. We collect identifying personal data (e.g., name, email) to manage your account and API access.
• API usage data: When you use Generative APIs, we collect certain anonymized data to monitor performance and improve our service. This includes:
  • API request metadata (HTTP calls, status codes, timestamps, etc.)
  • Token counts (input/output specific to large language models (LLMs), without prompt details)
  • Parameters defined by the user, excluding the actual content of the prompts (system, user, etc.)

3. How we use your data

The personal data collected is used exclusively for:

• Providing access to the Generative API services.
• Generating and managing API keys.
• Monitoring and improving the Generative API service through anonymized data for statistical analysis.

4. Data Retention

• Account data: Personal data related to your account is retained in accordance with our General Privacy Policy.
• API usage data: Aggregated and anonymized data is stored for up to 6 months for performance monitoring and improvement.

5. Data Transfers and Sharing

Your personal data may be stored in the following region: Paris, France.

Your personal data is not shared with third parties except:

• When necessary for service delivery (e.g., payment processing, support).
• When required by law or in response to valid legal requests.

As a European company, Scaleway’s AI services are not subject to extraterritorial laws such as the American Cloud Act. This means that your data hosted in Europe is protected by European laws, which provide a high level of data sovereignty and security.

6. Data Security

We implement appropriate technical and organizational security measures to protect your data against unauthorized access, alteration, disclosure, or destruction.

• Standard security measures
  • Secured authentication
    • Complex password
    • 2FA (customer’s choice)
    • SSH Key
  • Deletion with secured erasure code
  • Manage accessibility with security groups
  • Physical server security
• AI service security measures
  • Hosting: Models consumed for inference are hosted in secure data centers within the European Union (EU).
  • Encryption: All traffic between the customer and the inference service is encrypted using in-transit TLS encryption to ensure data protection during transmission.
  • Endpoint Security: Public-facing endpoints are secured with API key tokens.

7. Exercising Your Rights

You have a right of access, rectification of inaccurate or incomplete data, deletion for eligible data as well as a right of restriction of processing under certain circumstances and portability.

You can exercise your rights directly in the privacy section of your Scaleway account. For additional questions you can contact the address privacy@scaleway.com. For more details on your rights, please refer to our General Privacy Policy. If you believe that your rights have not been respected, you can also file a complaint with the competent supervisory authority.

8. Policy Updates

This policy may be updated as needed to comply with regulatory requirements. Updates will be communicated on this page, with the most recent changes being effective as of the date posted.