Privacy policy

Last updated: 8 November 2026 · This is a translation; the German version (Datenschutzerklärung) is binding.

1. Controller

Komoxa Digital
Owner: Kourosh Shafizadeh
Zimmerseestraße 30
63477 Maintal
Deutschland
Email: support@malzox.com
Contact form: malzox.com/contact.html

We have not appointed a data protection officer because we are not required to (Art. 37 GDPR, section 38 BDSG). Please send questions about data protection to the addresses above.

2. In short

We use no advertising services and sell no data. We use Google Analytics only if you consent in the cookie notice (section 15); without your consent it is not loaded. Otherwise the fonts, images and scripts of this website come from our own server. Without your consent the public pages set no cookies. We process data only to run the website securely, to answer your messages, to sell and activate Malzox Pro and – if you want it – to send you our newsletter with offers and security tips.

Exceptions, each described below: after you sign in to your customer account or the administration area we set a technically necessary session cookie (sections 12 and 14). The pages for signing in and for cancelling load the bot protection Cloudflare Turnstile (section 13). To pay, we send you to Stripe's payment page (section 10). If you choose the language on the homepage, your browser remembers your choice (local storage), so the page appears in the same language next time; this information does not leave your device. If you close the notice about a discount campaign on the homepage, your browser remembers this until you close the tab (session storage); this information does not leave your device either. This is strictly necessary for the function you asked for (section 25(2) no. 2 TDDDG). A complete list is in section 15.

3. Hosting

The website, its server program and the database run on a rented server at OVH GmbH, St. Johanner Str. 41-43, 66111 Saarbrücken, Deutschland; location of the data centre: Deutschland (Frankfurt am Main). The provider processes the data on our behalf (Art. 28 GDPR). The name records (DNS) of malzox.com are managed by Cloudflare; your visits to the website do not pass through Cloudflare but go directly to our server.

4. Server logs and attack detection

For every request our web server stores: IP address, date and time, request method and requested address, HTTP status, amount of data transferred, response time and the browser identification (user agent). A program evaluates these logs automatically to detect attacks (for example searching for security holes) and temporarily blocks attacking IP addresses for this website. When an address is blocked or a serious attack happens, we receive a notification with the IP address by email (section 6) and, if set up, through the messenger Telegram (Telegram FZ-LLC, Dubai, United Arab Emirates).

The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The log files are rotated daily and deleted after 14 days. Requests recognised as attacks are stored for up to 90 days. A block lasts at most one year; the list of earlier blocks (IP address, time, reason) is deleted after one year. This is not an automated decision within the meaning of Art. 22 GDPR: a block only affects access to this website.

Download counting and country of origin: From the same logs we count how often the Malzox installer is downloaded. So that a download transferred in several parts counts only once, we form a one-way checksum from your IP address, the day and the file, and delete it after two days at the latest. Only the number of downloads per day, file and kind (website or automatic update of the software) is kept, with no link to a person. For the overview of attacks and blocks the server also determines which country an IP address comes from. For this it uses a country database on our own server (DB-IP “IP to Country Lite”, which it downloads once a month from db-ip.com); no IP address is sent to third parties, and the country is not stored. The legal basis is our legitimate interest in knowing how our program spreads and in classifying attacks (Art. 6(1)(f) GDPR).

5. Contact form and problem reports from the app

If you write to us through the contact form, we store your name, your email address, your message, the language of the form and the time it arrived and, if you give them, your company and your phone number. We do not store an IP address with the message. To limit misuse, the server counts in memory only, and for at most one hour, how many messages come from an IP address; like every request, sending also appears in the server logs (section 4).

Problem reports from the app: if you report a problem in Malzox under “Settings > Help & support”, the app sends your description, your email address and the app's language to malzox.com and, if you leave the box ticked, the technical details shown in the window (Malzox version, Windows version, the app's language and whether the protection service is connected). We store the report like a message from the contact form; everything in this section applies to it.

Purpose and legal basis: we use the details only to answer your request. If it concerns a contract with us or steps before one (for example an order or a licence), the legal basis is Art. 6(1)(b) GDPR, otherwise our legitimate interest in answering requests (Art. 6(1)(f) GDPR). The details are voluntary, but without name, email address and message we cannot answer. Company and phone number are expressly voluntary; we use your phone number only if you ask us to call you back.

Recipients: the message is kept in the database on our server (section 3) and can be read only in the administration area, which is protected by a password and a two-factor code. We send our answer by email (section 6).

Storage period: the system deletes every message automatically six months after it arrived. Our answer and your further emails are also kept in our mailbox (section 6).

6. Email

We receive emails to support@malzox.com in our mailbox at mailbox.org (Heinlein Hosting GmbH, Schwedter Straße 8/9A, 10119 Berlin, Germany). We also send our emails through mailbox.org – answers to your messages, confirmation links for the waiting list and the newsletter, confirmation and sign-in codes for the customer account, licence keys, invoices, cancellation and withdrawal confirmations and, if you subscribed to it, our newsletter. In doing so, mailbox.org processes your email address, the content of the message and technical connection data as our processor (Art. 28 GDPR), in Germany.

The legal basis is the purpose of each email: performing a contract or steps before a contract (Art. 6(1)(b) GDPR), your consent for the waiting list (point a) or our legitimate interest in communicating with you (point f). We delete emails in our mailbox as soon as we no longer need them; business emails we must keep for tax reasons are kept for six years (section 147 AO).

7. Waiting list (email notification)

If you enter your email address, we store it together with the time of sign-up and a one-way checksum of your IP address (as proof of the sign-up). You receive an email with a confirmation link (double opt-in). Only after confirmation do we write to you – only to tell you when Malzox for Android, iPhone or Mac or Malzox VPN is available. Unconfirmed sign-ups are deleted after 30 days.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time – through the unsubscribe link in every email or by writing to us. Your address is then deleted. We send the emails through mailbox.org (section 6).

8. Newsletter

In the newsletter we send you offers for Malzox, for example discount codes, and security tips, at most about once a week. If you sign up on the homepage, we store your email address, the chosen language, the time of sign-up, the wording of your consent and a one-way checksum of your IP address (as proof of the sign-up). You receive an email with a confirmation link (double opt-in); only after confirmation, whose time we also store, do we send you the newsletter. Unconfirmed sign-ups are deleted after 30 days. For each mailing we store when it went to your address (deleted after one year). We do not measure whether you open an email or click a link.

The legal basis is your consent (Art. 6(1)(a) GDPR, section 7(2) no. 2 UWG). You can withdraw it at any time – with one click through the unsubscribe link in every email or by writing to us. Your address and everything stored with it are then deleted. Giving it is voluntary; without an email address we cannot send you the newsletter. We send the emails through mailbox.org (section 6).

9. The Malzox software

This policy applies to the website. The Malzox software works locally on your computer and does not send scanned files or usage data to us. It downloads virus signatures from the servers of the ClamAV project (database.clamav.net); your IP address is transmitted to these servers. About every six hours it asks malzox.com for program updates and, when web protection is on, with its licence for the current block list; these requests appear with your IP address in the server logs (section 4).

Malzox Pro (licence activation): when you enter a licence key, the software sends to malzox.com: the key, an anonymous device ID (a one-way checksum of the Windows installation ID) and the computer name, so you can tell your devices apart. At least once a week the software confirms and renews the licence automatically; the licence and your IP address are transmitted. A licence key works on as many computers as your plan includes, once on each; for a new computer support gives you a new key when you show your invoice. With the licence we store the buyer's email address, term and number of devices and, for each activated device, its ID, computer name and the time of the last renewal; we store the key itself only as a checksum. The legal basis is performing the contract (Art. 6(1)(b) GDPR). If you remove the licence from a device, we delete its entry. After a licence ends we keep its data as long as the order it belongs to must be kept (section 10), and then delete it.

Protection against unauthorised use: when it starts and then about every six hours, the software reports to malzox.com with the anonymous device ID and the computer name; your IP address is transmitted. For the device ID we store the start of the 14-day trial, the computer name and the time of the last report, so that a new installation does not start a new trial, and delete this information three years after the last report. The software also remembers the start of the trial in the computer's Windows registry. If invalid licence keys are entered on a computer, a forged licence or one issued for another computer is used, or Malzox's program files are changed, we store the IP address, the exact time, the country determined from it (section 4), the device ID, the computer name, the key entered and, if there is one, the licence with the buyer's email address. After three invalid keys, key entry is paused for 72 hours; if nobody contacts our support in that time, Malzox is locked on the computer. With a forged or foreign licence and with changed program files, Malzox is locked at once; at the same time the IP address is blocked for 30 days for computers without an activated licence. For every licence we also store on which days it was used by which device, from which network (a one-way checksum of the address range) and from which country, to detect keys that were passed on. The legal basis is our legitimate interest in protecting Malzox against unauthorised use and enforcing our rights (Art. 6(1)(f) GDPR). The usage information on licences and the information on computers that are not locked is deleted after 90 days; the information on a locked computer is kept for three years (regular limitation period, section 195 BGB). If we lift a lock because no misuse is confirmed, the 90-day period applies again.

10. Purchase and payment (Stripe)

When you buy Malzox Pro, the order form sends us the plan, your country, whether you buy privately or as a business, if applicable the company name and VAT identification number, your email address and the chosen term (6 or 12 months), your consent that Malzox starts right away and your confirmation that the term is paid in advance and not refunded pro rata on cancellation (we store the time and wording as proof, among other things for the end of the right of withdrawal). We check a VAT identification number with the VAT Information Exchange System (VIES) of the European Commission.

To pay, we send you to Stripe's payment page (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). There you enter your name, billing address and payment details. From Stripe we receive the confirmation of payment, your name, your email and billing address, the country of your card or account (as evidence for VAT) and IDs of customer, subscription and payment; we do not receive full card or account numbers. Stripe processes payment data partly as our processor and partly under its own responsibility, for example to prevent fraud and because of legal obligations; data may also be transferred to the USA (Stripe, LLC is certified under the EU-US Data Privacy Framework). More: stripe.com/privacy.

For every order we store the order, invoice or credit note number, plan, amount, tax and the tax rule applied, country and kind of customer, if applicable the company and VAT identification number with the result of the check, name, email and billing address, the evidence for your country and the invoice as a PDF. The legal bases are performing the contract (Art. 6(1)(b) GDPR) and our legal obligations under tax and commercial law (point c). Invoices and accounting records are kept for eight years, other documents relevant for tax for up to ten years (section 147 AO); then we delete them.

11. Cancellation and withdrawal

If you cancel through the page “Cancel contracts here” or in your customer account, we store with the subscription the time it arrived, the end of the contract, the way you cancelled, any refund and, if you give it, your reason for cancelling with your note (voluntary; we use it only to improve Malzox, Art. 6(1)(f) GDPR), and send you a confirmation by email. If you declare a withdrawal through the website's withdrawal function, we store your name, your email address, the invoice or licence number, the time, the result and, as proof, the IP address the declaration came from. The legal bases are performing the contract and our legal obligations (Art. 6(1)(b) and (c) GDPR, sections 312k and 356a BGB). We keep this information as long as the order it belongs to (section 10).

12. Customer account

If you create a customer account, we store your name, your email address, if you give them your company and your phone number (both voluntary), your password only as a one-way checksum (scrypt), the time of creation and of confirmation, the number of failed sign-ins (for a temporary lock after five failed attempts) and the time of the last sign-in. After you sign in we set a technically necessary session cookie; with the session we store the IP address and delete it when the session ends (after 12 hours at the latest). If you remove a computer from your licence, we store the time, because this is possible once a month. Your account shows the licences bought with the confirmed email address. To confirm your email address we send you a six-digit code; we store it only as a checksum, together with your email address and the time, valid for at most 15 minutes and five attempts, and delete this information as soon as the account is created, otherwise automatically after a little over an hour. To protect your account we also send you a six-digit sign-in code by email at every sign-in; we store it only as a checksum, valid for at most 10 minutes and five attempts, and delete it after sign-in, otherwise after one hour. If you choose “Remember this browser for 30 days”, we set a technically necessary cookie with a random ID for this (we store only its checksum); this browser then needs no code for 30 days. If you reset your password, we forget all remembered browsers.

The legal basis is performing the contract and steps before a contract (Art. 6(1)(b) GDPR). An account whose email address is not confirmed within 30 days is deleted automatically. You can ask us to delete your account at any time by writing to us; invoice and contract data are kept as long as legal retention obligations require (section 10).

13. Bot protection: Cloudflare Turnstile

On the pages for signing in, registering, resetting the password and cancelling (account.html, cancel.html) we use Cloudflare Turnstile to fend off automated attacks such as trying passwords in bulk. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When these pages load, your IP address and information about your browser and device are transmitted to Cloudflare; Turnstile sets no cookies for advertising. The other pages of the website do not load Turnstile.

The legal basis is our legitimate interest in the security of the customer accounts and the website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). More: cloudflare.com/privacypolicy

14. Administration area

The area under /admin is meant only for the operator. Signing in there sets a technically necessary session cookie; only those who sign in there receive it.

15. Cookies and browser storage

On the first visit the website shows a notice about cookies; you can change your choice at any time through the “Cookie settings” link at the bottom of every page. Cookies and browser storage that are strictly necessary for the website to work (section 25(2) no. 2 TDDDG) need no consent and therefore cannot be switched off. We set statistics cookies (Google Analytics) only with your consent; we set no advertising cookies. In detail:

The necessary information does not leave your device, except the sign-in cookies your browser sends to our server and the data for Turnstile described in section 13.

Google Analytics (only with your consent). If you choose “Accept” in the cookie notice or switch on “Statistics” in the cookie settings, your browser loads Google Analytics 4 of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Before that, nothing of it is loaded and nothing is sent to Google. Purpose: we see in aggregated numbers which pages are visited and which buttons are used, to improve the website. Google processes the pages viewed and clicks, times, information about your browser, device and screen, the referring page and your IP address, from which Google derives an approximate location (country, region); according to Google, Google Analytics 4 does not store the IP address. Google Signals and personalised advertising are switched off. The legal basis is your consent (section 25(1) TDDDG, Art. 6(1)(a) GDPR). Google is our processor (Art. 28 GDPR, Google Ads Data Processing Terms). Data may also be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission of 10 July 2023 exists (Art. 45 GDPR). The cookies _ga and _ga_DN7CLJGRWZ last 2 months; the data in Google Analytics is deleted after 2 months. Your consent is voluntary; you can withdraw it at any time through “Cookie settings” at the bottom of every page, which ends Google Analytics at once and deletes its cookies. More: Google's privacy policy.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7(3)). You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 6(1)(f)) (Art. 21 GDPR). To do so, write to us at the addresses in section 1.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one for where you live. The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wilhelmstraße 7, 65185 Wiesbaden, Germany, phone +49 611 1408-0, datenschutz.hessen.de.