malahov.io

Privacy Policy

Last updated: September 10, 2026

1. Privacy at a glance

The following gives you a simple overview of what happens to your personal data when you use this website and our products (including the dictation app and the subtitle editor). "Personal data" means any data that can personally identify you.

In short:

  • Everything is hosted on servers in Germany (Hetzner), and all AI processing happens exclusively in the EU. Two exceptions: email delivery (Resend, a US provider sending from a European region) and the booking page we link to (Cal.com, USA).
  • Our web analytics (self-hosted Umami) is cookieless and stores no personal data — which is why there is no cookie banner here.
  • Audio you dictate is sent to EU data centers for processing and is not retained there; your dictation history lives locally on your device, and the optional sync is end-to-end encrypted (zero-knowledge — we cannot read your content).
  • Payments run through Stripe (hosted checkout); card data never reaches our servers.

2. Controller

The controller responsible for data processing on this website is:

Georg Malahov

GM Labs

Kurt-Schumacher-Str. 32

97422 Schweinfurt, Germany

Email: georg@malahov.io

Further details can be found in the Impressum.

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

3. Hosting

We host the contents of our website with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany ("Hetzner").

When you visit our website, Hetzner records various log files including your IP address. For details, see Hetzner's privacy policy: https://www.hetzner.com/legal/privacy-policy/.

The use of Hetzner is based on Art. 6(1)(f) GDPR — our legitimate interest in a reliable presentation of our website. All data remains in data centers in Germany.

We have concluded a data processing agreement (DPA, Art. 28 GDPR) with Hetzner. We also run our databases (PostgreSQL) via Hetzner. Email delivery moved off Hetzner in September 2026 and runs through a dedicated provider (see below).

4. General information and mandatory disclosures

Where you have consented to processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. Where your data is required to perform a contract or pre-contractual measures (e.g. your account, a Pro subscription, processing your dictations), we process it under Art. 6(1)(b) GDPR. Processing needed to comply with legal obligations (e.g. tax retention periods) is based on Art. 6(1)(c) GDPR, and processing based on our legitimate interests (e.g. operational security, abuse prevention, cookieless audience measurement) on Art. 6(1)(f) GDPR. The applicable legal basis is stated for each individual processing activity below.

Retention

Unless a more specific retention period is stated in this privacy policy, your personal data remains with us until the purpose for the processing no longer applies. If you assert a justified deletion request or withdraw consent, your data will be deleted unless we have other legally permissible reasons to retain it (e.g. retention periods under tax or commercial law).

Recipients of personal data

We only pass personal data to external parties where necessary for contract performance, where we are legally obliged to, where we have a legitimate interest in the transfer, or where another legal basis permits it. Where we use processors, this only happens on the basis of a valid data processing agreement. An overview of our processors is available on the Sub-processors page.

SSL/TLS encryption

This site uses SSL/TLS encryption for security. You can recognize an encrypted connection by "https://" and the lock symbol in your browser bar.

5. Your rights

Under the GDPR you have the following rights:

  • Access (Art. 15 GDPR) to your stored personal data, its origin, recipients, and the purpose of processing
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR) — receiving your data in a common, machine-readable format
  • Objection to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR)
  • Withdrawal of any consent you have given, at any time with effect for the future; the lawfulness of processing carried out before withdrawal remains unaffected

How to exercise your rights: send an informal email to georg@malahov.io (e.g. "Please provide access to my data" or "Please delete my account"). We respond within one month. When deleting your account, we remove your user record including subscription link, synced vault, and usage data; statutory retention obligations (e.g. invoice data at Stripe) remain unaffected. You can delete your locally stored dictation history yourself in the app at any time.

In the event of GDPR violations, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement.

6. Data collection on this website

Cookies

We use strictly necessary cookies only — there is no cookie-based tracking, which is why we do not show a cookie consent banner. Specifically:

  • Session cookie (Better Auth): keeps you signed in. Legal basis: Art. 6(1)(b) GDPR.
  • NEXT_LOCALE: stores your language choice. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working language switcher).
  • site-gate (pre-launch only): remembers access to the password-protected preview. Legal basis: Art. 6(1)(f) GDPR.

These cookies are required for operation (§ 25(2) no. 2 German TDDDG) and do not require consent.

Server log files

The site provider automatically collects and stores information in server log files that your browser transmits automatically: browser type and version, operating system, referrer URL, time of the server request, and IP address. This data is not merged with other data sources. Collection is based on Art. 6(1)(f) GDPR (technically error-free delivery, operational security, and abuse prevention).

Registration and user account

You can create an account to use our apps. Sign-in is passwordless via email one-time code (OTP): you enter your email address and receive a six-digit code. We store your email address, an optional display name, and account-related metadata (e.g. registration date, plan status). Legal basis: Art. 6(1)(b) GDPR.

Where sign-in via Google (OAuth) is enabled, you can alternatively sign in with your Google account. In that case Google provides us with your email address and name. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Art. 6(1)(b) GDPR. More information: https://policies.google.com/privacy.

Transactional and product emails

We send system and contract-related emails (sign-in codes, confirmations, trial or subscription notices) on the basis of Art. 6(1)(b) GDPR. Product and marketing emails (e.g. tips, product news) are sent only with your explicit consent (Art. 6(1)(a) GDPR), which you can give during registration. You can withdraw consent at any time — via the unsubscribe link in every email (one-click unsubscribe) or by emailing georg@malahov.io.

Delivery runs through Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Resend processes your email address, the subject and body of the message, and technical delivery logs. Our sending domain is set up in the EU region eu-west-1 (Ireland), so delivery runs through European data centers; access from the US cannot be ruled out all the same. Open and click tracking are disabled — our emails contain no tracking pixels and no rewritten links. The transfer rests on Resend's Data Processing Addendum including Standard Contractual Clauses (Art. 46 GDPR): https://resend.com/legal/dpa.

Newsletter signup

If you sign up for our newsletter on the website, we store your email address (and optionally your name) on the basis of your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the unsubscribe link.

Booking an appointment (Cal.com)

On the About page we link to a booking page where you can arrange a call with us. Following that link takes you off our website; the page is operated by Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA.

If you book an appointment there, Cal.com processes on our behalf the data you enter — name, email address, time zone and what you write about your request — along with the appointment itself. Processing takes place in the United States; the transfer rests on Standard Contractual Clauses (Art. 46 GDPR). Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract).

You don't have to use it: an informal email to georg@malahov.io does the same job, and then your data never leaves the EU.

Cal.com's privacy notice: https://cal.com/privacy.

7. Web analytics: Umami (self-hosted, cookieless)

We use the open-source web analytics tool Umami — self-hosted on our own Hetzner infrastructure in Germany. Umami sets no cookies, builds no cross-device profiles, and stores no personal data; IP addresses are not stored. Only aggregate metrics are collected, such as page views, referrers, and coarse device classes.

Since no data flows to third parties and no information is stored on or read from your device, neither consent nor a cookie banner is required. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing and improving our offering).

8. Payment processing: Stripe

For Pro subscriptions we use the payment provider Stripe. For customers in the EU, the provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

Payment happens on Stripe's hosted checkout page and via the Stripe customer portal. Your payment details (e.g. card number) are processed directly by Stripe and never reach our servers. We only store your subscription status, a Stripe customer/subscription reference, and the billing period. Stripe receives your email address and the link to your account from us.

The legal basis is Art. 6(1)(b) GDPR (contract performance). For parts of the processing (e.g. fraud prevention, legal obligations), Stripe acts as an independent controller. Where data is transferred to the USA (Stripe, Inc.), Stripe relies on EU standard contractual clauses (Art. 46 GDPR) and is certified under the EU-US Data Privacy Framework. Details: https://stripe.com/privacy.

9. AI processing

Google Cloud Vertex AI (dictation and subtitle editor)

For the core features of our dictation app (transcription, text cleanup, translation) and the subtitle editor's text features (translate, refine), we use Google Cloud Vertex AI. The contracting party is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland.

  • Processing happens exclusively in the EU region europe-west4 (Netherlands).
  • Audio and text data is transmitted per request, processed only to answer that request, and is not used to train models or stored beyond processing (zero-retention configuration).
  • Requests go through our server proxy; your browser never talks to Google directly.

Legal basis: Art. 6(1)(b) GDPR (the AI processing is the core contracted feature). A data processing agreement with Google is in place (Google Cloud Data Processing Addendum) including EU standard contractual clauses. Details: https://cloud.google.com/terms/data-processing-addendum.

Deepgram (audio transcription in the subtitle editor)

For transcribing audio tracks in the subtitle editor we use Deepgram, provided by Deepgram, Inc., 548 Market St, Suite 25104, San Francisco, CA 94104, USA.

Audio data is transmitted to Deepgram's EU endpoint (api.eu.deepgram.com); processing takes place exclusively within EU-based data centers. Storage is temporary and only for processing the request. Every transcription request includes the opt-out parameter for Deepgram's Model Improvement Program (mip_opt_out=true), so your audio data is never used to train or improve Deepgram's models.

Legal basis: Art. 6(1)(b) GDPR. Although Deepgram is a US company, your audio data is processed on EU servers; EU standard contractual clauses (Art. 46 GDPR) apply in addition. More information: https://deepgram.com/privacy.

10. Data processing in the dictation app

  • Audio: your recording is transmitted to Vertex AI (EU) for processing and is not retained there after processing. We do not store your audio files on our servers.
  • Dictation history: results are stored locally on your device (browser database, IndexedDB). You can delete entries yourself at any time.
  • Device sync (Pro, optional): if you enable sync, your settings and history are stored on our server end-to-end encrypted. Encryption happens on your device with a key derived from your sync password; our server stores only ciphertext that is unreadable to us (zero-knowledge — we can neither read nor recover your content; if you lose the password, the synced data cannot be recovered). Legal basis: Art. 6(1)(b) GDPR.
  • Usage metadata: for billing and capacity management we log technical metadata per processing run (e.g. audio duration, token counts, cost, latency) — never the content. Legal basis: Art. 6(1)(b) and (f) GDPR.

11. Data processing in the subtitle editor

Your video and project files are processed and stored locally in your browser; they are not uploaded to our servers. Only the following is transmitted to external services: the audio track for transcription (Deepgram, EU endpoint — only when you start a transcription) and subtitle text for AI features (Vertex AI, EU — only when you use those features).

12. Referral program

If you share your personal referral link, we count clicks on that link anonymously (without IP addresses or identifying visitors). If a referred person registers and uses the service, the referral is credited to your account. You are not told which person registered, and the referred person is not told whose link was used — only the association via the referral code is stored. Legal basis: Art. 6(1)(b) GDPR (the program's terms of participation) and Art. 6(1)(f) GDPR (anonymous click counting).

13. Sub-processors

A current overview of all processors we use, including their location, purpose, and transfer mechanism, is available on the Sub-processors page.