DeleteMe vs Malwarebytes

DeleteMe must collect your full personal identity — name, address, date of birth, aliases, family members — to remove it from data brokers, and while it confirms it never sells that data, the primary policy is a deliberately informal TLDR that defers partner data sharing to a separate Cookie Policy, ignores Do Not Track signals, and includes a broad business transfer clause that could expose your data if the company is ever sold.

Malwarebytes has noticeably better specific privacy practices than comparable US security companies — IP addresses are explicitly not stored, the VPN has a detailed and specific no-logs commitment, text messages are scanned without being retained, cloud storage scan files are deleted immediately after scanning, and usage/threat statistics collection can be opted out of in product settings — but it is a US company (Santa Clara, CA) with no named security certifications in its policy, vague retention periods, and a website advertising tracking stack.