1.Who the controller is
The data controller is Malnox Security SRL, based in Bucharest, Romania. You can contact us about any personal data matter at privacy@malnox.com.
We have not appointed a Data Protection Officer (DPO), because we do not carry out activities that require one under Art. 37 GDPR. Data-related correspondence goes directly to the legal team.
2.What we collect through the website
The website uses no tracking cookies, advertising pixels or third-party analytics scripts. We do not sell or transfer data to advertising networks.
The contact form runs entirely in the browser: what you type is not automatically sent to a server by the application. The form composes an e-mail for you to send from your own client to the address shown.
- Minimal technical data: IP address and user-agent are processed by the hosting infrastructure to deliver the page and prevent abuse, retained for at most 30 days.
- Language preference: kept in the URL and, optionally, in localStorage. It does not identify a person and is not transmitted outside the browser.
- Account and licences: the account, licences, devices and audit log are stored on our server (api.malnox.com) so they are also available in the desktop app.
3.What the installed product collects
Nothing from the contents of your files. The detection path contains no network calls: no DNS lookups, no file hashes sent, no content sent. The verdict is computed entirely on your machine.
Logs, quarantine and the local database stay on disk in %ProgramData%\Malnox. On uninstall we keep this folder on purpose: quarantine and the audit log are evidence, not cache.
- Components that can reach the network are disabled by default and cannot modify a verdict: SIEM, the AI analyst, signature updates, intel packages.
- The AI analyst is permanently marked advisoryOnly. When explicitly enabled it sends metadata only, never file content, and the API key is redacted in the interface through keyFingerprint.
- SIEM export is opt-in, with a destination you configure, a queue bounded at 512 events and no forwarding to us.
4.Installation health, sent to your account
When you are signed in to a Malnox account, the app sends a summary of this installation's health to api.malnox.com every five minutes. There is exactly one purpose: the admin console must be able to answer “is protection working on my machines?”. Without this summary an administrator would have to check every PC by hand.
What is sent, in full: an installation identifier, the overall state (ok / attention / problem), how many engines are active out of the total, the security score, the licence state, whether a signature package is applied, whether the learning engine is running, how many indicator files are loaded, whether self-defence is intact and whether the kernel filter is running.
What is never sent: file names, paths, document contents, file hashes, e-mail addresses found by the DLP engine, process names, browsing history or anything else that could describe what you do on the machine. The server keeps a single row per installation, overwritten on every report — it is a snapshot of the current state, not an activity log.
- Legal basis: contract performance (Art. 6(1)(b) GDPR) for paid licences and legitimate interest in showing you the state of your own installations (Art. 6(1)(f)) for the Free plan with an account.
- Who sees it: you, in the local console, and the operators of your account, in the admin console. We do not use it for any other purpose and do not pass it to anyone.
- How to stop it: sign out of the app. No session means no reporting — it is not a hidden setting, it is the absence of authentication. You can also ask for existing rows to be deleted at privacy@malnox.com.
- Retention: the row is continuously overwritten and deleted together with the installation or the account. A row untouched for more than 24 hours is marked “unknown” in the console, because an old state says nothing about the current one.
5.Legal basis and retention
For commercial and support correspondence the basis is our legitimate interest in answering your request (Art. 6(1)(f) GDPR) and, where applicable, contract performance (Art. 6(1)(b)). For tax obligations the basis is legal obligation (Art. 6(1)(c)).
We keep support e-mails for at most 24 months after the ticket closes, and invoices according to Romanian statutory periods. We do not keep data “just in case”.
6.Your rights
You have the right to access, rectification, erasure, restriction, portability and objection. Write to privacy@malnox.com and we reply within 30 days, usually much sooner.
You can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP). We do recommend writing to us first: most issues are resolved in one exchange of e-mails.
- Deleting the account is done from dashboard > Account, immediately and without a support request.
- We do not use automated decisions with legal effect over you and we do not profile for marketing purposes.
7.Transfers and sub-processors
Website hosting is in the European Union. We do not transfer personal data outside the EEA. If that changes, we update this page before it takes effect.
The installed product has no sub-processors: health reporting goes exclusively to api.malnox.com, our own infrastructure, not to a third party. Any third-party service you explicitly enable (for example a SIEM endpoint or an AI model provider) is under your control and responsibility.
A question about this document? Write to privacy@malnox.com or use the contact form.