Malwarebytes vs Bitdefender

Malwarebytes has noticeably better specific privacy practices than comparable US security companies — IP addresses are explicitly not stored, the VPN has a detailed and specific no-logs commitment, text messages are scanned without being retained, cloud storage scan files are deleted immediately after scanning, and usage/threat statistics collection can be opted out of in product settings — but it is a US company (Santa Clara, CA) with no named security certifications in its policy, vague retention periods, and a website advertising tracking stack.

Bitdefender is a Romanian cybersecurity company — EU member state jurisdiction, GDPR enforced by the Romanian DPA — with ISO 27001 and SOC2 Type 2 certifications, an explicit no-data-selling commitment, an anonymisation-first principle for technical data, and no advertising partner data sharing; the main caveats are that individual data processors are not named in the policy, technical security data can be retained for up to ten years, the website privacy policy explicitly provides no advance notice before changes, and marketing emails run on a legitimate interest basis for five years post-cancellation.