Malwarebytes

IP addresses are explicitly not stored — only geographic data is derived from them; text message scanning is limited to non-contact messages with malicious ones retained and all others discarded; the VPN collects no browsing, DNS, bandwidth, or network data; and usage/threat statistics can be opted out of per-platform from product settings; but exploit data collection can include full exploit executable copies, and client data includes information about other security products installed on the system.

Malwarebytes explicitly does not sell personal data and names this as a fundamental belief; no advertising partner data sharing of product data is described; service providers are restricted to the purposes for which data is shared; Google Analytics processes website interaction data; and business transaction notifications (email or prominent notice) are committed before ownership changes.

Usage and threat statistics collection has a clear in-product opt-out with step-by-step instructions for Windows, Mac, Android, and iOS; self-service account management is available at my.malwarebytes.com including account deletion; material policy changes are notified before they take effect; but data retention is described in vague terms and no specific periods are given for any category.

The explicit IP non-retention, specific VPN no-logs, and careful text message handling are better security-product privacy commitments than Norton or McAfee; the no-selling commitment is unqualified; but Malwarebytes is a US company (Santa Clara, CA) subject to FISA and NSL, names no security certifications of its own in the policy, and the exploitation of AWS compliance is indirect rather than a direct Malwarebytes certification.