Scenario

GDPR overview

GDPR is addressed explicitly, in a dedicated section 7 of the privacy policy effective 16/07/2026. Scenario Inc. acts as controller for data it collects directly and as processor for Enterprise customers under a DPA. Legal bases are mapped purpose by purpose to Articles 6(1)(a), (b), (c) and (f). Rights under Articles 15, 16, 17, 18, 20, 21 and 7(3) are listed, with a one-month response window extendable by two months under Article 12(3) and a right to complain to a supervisory authority. Transfers rely on EU-U.S. Data Privacy Framework certification plus the UK Extension and the Swiss-U.S. DPF, backed by 2021/914 standard contractual clauses and the ICO addendum; redress runs through the EU data protection authority panel, the ICO, the Swiss FDPIC and binding arbitration. An Article 27 representative is appointed in Ireland. No DPO is appointed: Scenario states it meets none of the Article 37 criteria. Contact: privacy@scenario.com.

Who owns the data?

You keep all right, title and interest in the content you upload; Scenario claims no ownership and takes only a limited, non-exclusive worldwide licence to host, store, process and display it, ending when you delete the content or the account, subject to backup cycles. Generated assets are assigned to you outright, commercial use included, with no royalty beyond the subscription. Custom models are yours too: your training data and the weights specific to your tuning, while Scenario retains the base architecture and infrastructure and bars reverse-engineering the weights. Two caveats: no uniqueness or copyright is guaranteed on outputs, and any feedback you send is licensed perpetually and irrevocably.

Reuse rights

You can reuse your generated assets freely and commercially on any paid plan, with no permission to ask, no royalty and no attribution, provided the acceptable use policy is respected; free-plan outputs are restricted to personal and evaluation use. The reverse direction is where the plans part ways. On self-serve, the terms let Scenario use your content and aggregated, de-identified usage data to operate, secure and improve the services and its own AI models, and no opt-out setting exists. Data is never sold, never shared with other customers, and private generations are never made public. Enterprise customers under a signed MSA and DPA get the opposite commitment in writing: no content, prompt, generated asset or custom model used to train, fine-tune, evaluate, benchmark or improve any Scenario or third-party model without prior written consent, with workspaces restrictable to Enterprise-Ready models whose providers undertake not to retain or train on inputs. One gap is worth naming: the footer of every page and the enterprise page advertise No Data Reuse, which the self-serve terms do not support. With third-party models, input handling also depends on each provider.

Data retention & training

Hosting summary

Scenario states in its privacy policy that it is based in the United States and processes personal data on servers located there, hosted on AWS in US regions; its compute and inference sub-processors are US-based as well. The terms add that content and generated assets are stored on infrastructure located in the United States unless a plan or MSA provides otherwise. Protection is described concretely: TLS 1.2 or above in transit, AES-256 at rest, role-based access control, mandatory MFA for privileged production access, and logical isolation of each customer workspace. The underlying AWS facilities are certified ISO 27001, SOC 1, SOC 2 Type II and SOC 3. Content delivery runs through a global edge CDN, which is a distribution mechanism and should not be read as data residency. What is absent matters as much: no European data residency option is announced anywhere on the site. Transfers out of the EEA, the United Kingdom and Switzerland rest on Data Privacy Framework certification and standard contractual clauses rather than on local storage, so buyers with a strict residency requirement should raise it before signing.