Skip to navigationSkip to main contentSkip to footerScaleway Docs HomepageAsk our AI
Ask our AI
Log inSign up

Understand the Transactional Email Privacy Policy

This Privacy Policy outlines how Scaleway (“we,” “us,” or “our”) processes personal data when you use our Transactional Email service (hereinafter “Transactional Email” or “TEM”). This policy supplements the Scaleway General Privacy Policy (External link), the Scaleway Data Processing Agreement (DPA) (External link), and the Transactional Email Specific Conditions (PDF). Any terms defined in the General Data Protection Regulation (GDPR) (EU Regulation 2016/679) or our General Privacy Policy (External link) have the same meaning here.

Transactional Email complies with the General Data Protection Regulation (GDPR), ensuring that all personal data is processed in accordance with European Union laws. Email content is only processed for as long as needed to send it, all data stays in the European Union, and your emails are never used for tracking, profiling, or AI model training.

1. Data collection and processing

We only collect and process the data required to send your emails reliably and securely. We collect and process the following categories of data:

  • Account information: To use Transactional Email, you must create a customer account. We collect identifying personal data (e.g., name, email) to manage your account and API access.
  • Email content: The body and headers of your emails, including recipient display names sent through the API. This content is encrypted and only processed temporarily, for as long as needed to deliver the email. It is not kept in your email activity history.
  • Sending metadata: For each email, we store:
    • The envelope sender (MAIL FROM) and recipient (RCPT TO) addresses
    • The subject
    • The IP address that submitted the email
    • The email status, timestamps, and each delivery attempt with the recipient server’s response
    • Identifiers generated by Transactional Email (email, event, domain, Project and Organization IDs)
  • Logs and monitoring data: SMTP and API logs, bounce and complaint information, and service metrics.
  • Webhook data: If you create a webhook, event payloads are sent to your endpoint through Scaleway Topics and Events. Payloads never contain the email body.

Transactional Email does not store custom or full SMTP headers. Only the envelope sender and recipient are extracted from them.

Outgoing emails are automatically scanned for spam and malware to protect the reputation of the platform and of your domain. This analysis is fully automated, runs on Scaleway infrastructure, and no one reads your content.

2. How we use your data

The personal data collected is used exclusively for:

  • Sending your emails to the recipient’s mail server.
  • Providing your email activity history, logs, webhooks, and metrics.
  • Protecting the service against spam, malware, and abuse.
  • Managing your account and API keys.
Note
  • Transactional Email does not add tracking pixels, rewrite links, track clicks, or measure recipient engagement. Your headers and message body are sent as-is, except for technical headers that identify the sending domain.
  • We will never add tracking or modify your content without your explicit request.
  • Your data is not used for training or improving Scaleway or third-party AI models, for generative AI features, or for profiling or advertising.
  • Your data is not accessible to other Scaleway customers, or to third-party products or services.

3. Data retention

  • Email content: Deleted as soon as processing ends, at the first of these events:

    • The recipient server accepts the email
    • The first hard bounce
    • After 36 hours of failed attempts (soft bounces)

    Emails classified as spam are deleted after 72 hours, and emails held by a blocked domain after 15 days. Encrypted backups are retained for 7 days.

  • Sending metadata, logs, and activity history: Retained for as long as your Transactional Email domain is active. Scaleway plans to reduce this retention period in 2027 and, eventually, to make it configurable by customers.

  • Webhook data: Retained for 15 days.

Note

You can request the deletion of specific email records, recipient addresses, or logs without deleting your domain by opening a Support ticket. Written confirmation of the deletion is available on request.

4. Data transfers and sharing

Transactional Email is only available in the following region: Paris, France (fr-par). Email content, metadata, logs, webhook data, and backups are stored and processed in France.

No Transactional Email data is replicated, cached, or backed up outside the European Union.

Transactional Email does not use any dedicated subprocessor to process the content or metadata of your emails. Data center providers only host the physical infrastructure, within the European Union.

The complete list of Scaleway subprocessors is available on the subprocessor list (External link), where you can subscribe to be notified at least 30 days before any change.

Your personal data is not shared with third parties except:

  • When necessary for service delivery (e.g., payment processing, support).
  • When required by law or in response to valid legal requests.

Your emails are delivered to the recipient’s mail server (MX), which is chosen independently by the recipient’s domain. Once the recipient server accepts an email, its storage is outside Scaleway’s control.

As a European company, Scaleway is not subject to extraterritorial laws such as the American Cloud Act. This means that your data hosted in Europe is protected by European laws, which provide a high level of data sovereignty and security.

5. Data security

We implement appropriate technical and organizational security measures to protect your data against unauthorized access, alteration, disclosure, or destruction.

  • Standard security measures
    • Secured authentication
      • Complex password
      • 2FA
    • Controlled and logged access to systems and data
    • Separation of customer environments
    • Confidentiality obligations for all staff
    • Physical server security
  • Transactional Email security measures
    • Encryption in transit: An encrypted connection is mandatory for SMTP (SSL/TLS on ports 465 and 2465, STARTTLS on port 587), and the API is only available over HTTPS.
    • Encryption at rest: Email content is encrypted during processing and in backups.
    • Credentials: SMTP and API access use IAM API keys that you can scope with dedicated permission sets, restrict by IP address, and revoke or rotate at any time.
    • Domain authentication: Support for SPF, DKIM, and DMARC.
    • Reputation protection: Reputation score monitoring, global traffic management, bounce and blocklist management, shared IP pools and managed dedicated IPs.

6. Policy updates

This policy may be updated as needed to comply with regulatory requirements. Updates will be communicated on this page, with the most recent changes being effective as of the date posted.

Still need help?

Create a support ticket
No Results