feat(ai): publish our data privacy policy (#3722)

* feat(ai): publish our data privacy policy

* feat(ai): revised per legal comment

* feat(ai): fixed per review

Co-authored-by: Benedikt Rollik <[email protected]>
Co-authored-by: ldecarvalho-doc <[email protected]>

---------

Co-authored-by: Benedikt Rollik <[email protected]>
Co-authored-by: ldecarvalho-doc <[email protected]>

Author: 3 people

ai-data/generative-apis/reference-content/data-privacy.mdx

@@ -0,0 +1,91 @@
+---
+meta:
+  title: Understand the Generative APIs Privacy Policy
+  description: This Privacy Policy outlines how Scaleway processes personal data when you use Generative APIs.
+content:
+  h1: Generative APIs Privacy Policy
+  paragraph: This page explains how Scaleway processes personal data when you use Generative APIs.
+tags: generative-apis ai-data data-privacy
+dates:
+  validation: 2024-09-19
+  posted: 2024-09-19
+---
+
+This Privacy Policy outlines how Scaleway ("we," "us," or "our") processes personal data when you use our AI services (hereinafter "Generative APIs"). This policy supplements the Scaleway [General Privacy Policy](https://www.scaleway.com/en/privacy-policy/). 
+Any terms defined in the General Data Protection Regulation (GDPR) (EU Regulation 2016/679) or our [General Privacy Policy](https://www.scaleway.com/en/privacy-policy/) have the same meaning here.
+
+Generative APIs comply with the General Data Protection Regulation (GDPR), ensuring that all personal data is processed in accordance with European Union laws. This includes implementing strong data protection measures, maintaining transparency in data processing activities, and ensuring customers’ rights are upheld.
+
+## 1. Data Processor
+
+The data processor for the Generative APIs service is Scaleway, with its registered office at 8 RUE DE LA VILLE L'EVÊQUE 75008 PARIS 8. We collect and process your personal data strictly to provide access and functionality to AI services.
+
+## 2. Data collection and processing
+
+We collect and process the following categories of data:
+
+- Account information: To access Generative APIs, you must create a customer account. We collect identifying personal data (e.g., name, email) to manage your account and API access.
+- API usage data: When you use Generative APIs, we collect certain anonymized data to monitor performance and improve our service. This includes:
+    - API request metadata (HTTP calls, status codes, timestamps, etc.)
+    - Token counts (input/output specific to large language models (LLMs), without prompt details)
+    - Parameters defined by the user, **excluding the actual content of the prompts (system, user, etc.)**
+
+## 3. How we use your data
+
+The personal data collected is used exclusively for:
+
+- Providing access to the Generative API services.
+- Generating and managing API keys.
+- Monitoring and improving the Generative API service through anonymized data for statistical analysis.
+
+<Message type="note">
+- We do not collect, read, reuse, or analyze the content of your inputs, prompts, or outputs generated by the API.
+- Your data is not accessible to other Scaleway customers.
+- Your data is not accessible to the creators of the underlying large language models (LLMs).
+- Your data is not accessible to third-party products, or services.
+</Message>
+
+## 4. Data Retention
+
+- Account data: Personal data related to your account is retained in accordance with our [General Privacy Policy](https://www.scaleway.com/en/privacy-policy/).
+- API usage data: Aggregated and anonymized data is stored for up to 6 months for performance monitoring and improvement.
+
+## 5. Data Transfers and Sharing
+
+Your personal data may be stored in the following region: Paris, France. 
+
+Your personal data is not shared with third parties except:
+
+- When necessary for service delivery (e.g., payment processing, support).
+- When required by law or in response to valid legal requests.
+
+As a European company, Scaleway’s AI services are not subject to extraterritorial laws such as the American Cloud Act. This means that your data hosted in Europe is protected by European laws, which provide a high level of data sovereignty and security.
+
+## 6. Data Security
+
+We implement appropriate technical and organizational security measures to protect your data against unauthorized access, alteration, disclosure, or destruction. 
+
+- Standard security measures
+    - Secured authentication
+        - Complex password
+        - 2FA (customer's choice)
+        - SSH Key
+    - Deletion with secured erasure code 
+    - Manage accessibility with security groups
+    - Physical server security
+- AI service security measures
+    - Hosting: Models consumed for inference are hosted in secure data centers within the European Union (EU).
+    - Encryption: All traffic between the customer and the inference service is encrypted using in-transit TLS encryption to ensure data protection during transmission.
+    - Endpoint Security: Public-facing endpoints are secured with API key tokens.
+
+## 7. Exercising Your Rights
+
+You have a right of access, rectification of inaccurate or incomplete data, deletion for eligible data as well as a right of restriction of processing under certain circumstances and portability.
+
+You can exercise your rights directly in the privacy section of your Scaleway account. For additional questions you can contact the address [email protected]. 
+For more details on your rights, please refer to our [General Privacy Policy](https://www.scaleway.com/en/privacy-policy/).
+If you believe that your rights have not been respected, you can also file a complaint [with the competent supervisory authority](https://www.edpb.europa.eu/about-edpb/about-edpb/members_fr).
+
+### 8. Policy Updates
+
+This policy may be updated as needed to comply with regulatory requirements. Updates will be communicated on this page, with the most recent changes being effective as of the date posted.

menu/navigation.json

@@ -706,6 +706,10 @@
                   {
                     "label": "Rate limits",
                     "slug": "rate-limits"
+                  },
+                  {
+                    "label": "Data privacy",
+                    "slug": "data-privacy"
                   }
                 ],
                 "label": "Additional Content",