malahov.io

Privacy Policy

Last updated: October 1, 2026

1. Privacy at a glance

The following gives you a simple overview of what happens to your personal data when you use this website and our products (including the dictation app, the subtitle editor and the A4Norm scanner with its Telegram bot). "Personal data" means any data that can personally identify you.

In short:

  • Everything is hosted on servers in Germany (Hetzner), and all AI processing happens exclusively in the EU. Two exceptions: email delivery (Resend, a US provider sending from a European region) and the booking page we link to (Cal.com, USA).
  • Our web analytics (self-hosted Umami) is cookieless and stores no personal data — which is why there is no cookie banner here.
  • Audio you dictate is sent to EU data centers for processing and is not retained there; your dictation history lives locally on your device, and the optional sync is end-to-end encrypted (zero-knowledge — we cannot read your content).
  • The A4Norm scanner processes your document photos on your device, also as a Mini App inside Telegram; the Telegram bot does not process photos. Only a finished PDF passes through our server, and only if you have it sent to your chat with the bot; it is not stored. Feedback you choose to send through the bot is stored (see section 12).
  • Payments run through Stripe (hosted checkout); card data never reaches our servers.

2. Controller

The controller responsible for data processing on this website is:

Georg Malahov

GM Labs

Kurt-Schumacher-Str. 32

97422 Schweinfurt, Germany

Email: georg@malahov.io

Further details can be found in the Impressum.

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

3. Hosting

We host the contents of our website with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany ("Hetzner").

When you visit our website, Hetzner records various log files including your IP address. For details, see Hetzner's privacy policy: https://www.hetzner.com/legal/privacy-policy/.

The use of Hetzner is based on Art. 6(1)(f) GDPR — our legitimate interest in a reliable presentation of our website. All data remains in data centers in Germany.

We have concluded a data processing agreement (DPA, Art. 28 GDPR) with Hetzner. We also run our databases (PostgreSQL) via Hetzner. Email delivery moved off Hetzner in September 2026 and runs through a dedicated provider (see below).

4. General information and mandatory disclosures

Where you have consented to processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. Where your data is required to perform a contract or pre-contractual measures (e.g. your account, a Pro subscription, processing your dictations), we process it under Art. 6(1)(b) GDPR. Processing needed to comply with legal obligations (e.g. tax retention periods) is based on Art. 6(1)(c) GDPR, and processing based on our legitimate interests (e.g. operational security, abuse prevention, cookieless audience measurement) on Art. 6(1)(f) GDPR. The applicable legal basis is stated for each individual processing activity below.

Retention

Unless a more specific retention period is stated in this privacy policy, your personal data remains with us until the purpose for the processing no longer applies. If you assert a justified deletion request or withdraw consent, your data will be deleted unless we have other legally permissible reasons to retain it (e.g. retention periods under tax or commercial law).

Recipients of personal data

We only pass personal data to external parties where necessary for contract performance, where we are legally obliged to, where we have a legitimate interest in the transfer, or where another legal basis permits it. Where we use processors, this only happens on the basis of a valid data processing agreement. An overview of our processors is available on the Sub-processors page.

SSL/TLS encryption

This site uses SSL/TLS encryption for security. You can recognize an encrypted connection by "https://" and the lock symbol in your browser bar.

5. Your rights

Under the GDPR you have the following rights:

  • Access (Art. 15 GDPR) to your stored personal data, its origin, recipients, and the purpose of processing
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR) — receiving your data in a common, machine-readable format
  • Objection to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR)
  • Withdrawal of any consent you have given, at any time with effect for the future; the lawfulness of processing carried out before withdrawal remains unaffected

How to exercise your rights: send an informal email to georg@malahov.io (e.g. "Please provide access to my data" or "Please delete my account"). We respond within one month. When deleting your account, we remove your user record including subscription link, synced vault, and usage data; statutory retention obligations (e.g. invoice data at Stripe) remain unaffected. You can delete your locally stored dictation history yourself in the app at any time.

In the event of GDPR violations, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement.

6. Data collection on this website

Cookies

We use strictly necessary cookies only — there is no cookie-based tracking, which is why we do not show a cookie consent banner. Specifically:

  • Session cookie (Better Auth): keeps you signed in. Legal basis: Art. 6(1)(b) GDPR.
  • NEXT_LOCALE: stores your language choice. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working language switcher).
  • site-gate (pre-launch only): remembers access to the password-protected preview. Legal basis: Art. 6(1)(f) GDPR.

These cookies are required for operation (§ 25(2) no. 2 German TDDDG) and do not require consent.

Server log files

The site provider automatically collects and stores information in server log files that your browser transmits automatically: browser type and version, operating system, referrer URL, time of the server request, and IP address. This data is not merged with other data sources. Collection is based on Art. 6(1)(f) GDPR (technically error-free delivery, operational security, and abuse prevention).

Registration and user account

You can create an account to use our apps. Sign-in is passwordless via email one-time code (OTP): you enter your email address and receive a six-digit code. We store your email address, an optional display name, and account-related metadata (e.g. registration date, plan status). Legal basis: Art. 6(1)(b) GDPR.

Where sign-in via Google (OAuth) is enabled, you can alternatively sign in with your Google account. In that case Google provides us with your email address and name. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Art. 6(1)(b) GDPR. More information: https://policies.google.com/privacy.

Transactional and product emails

We send system and contract-related emails (sign-in codes, confirmations, trial or subscription notices) on the basis of Art. 6(1)(b) GDPR. Product and marketing emails (e.g. tips, product news) are sent only with your explicit consent (Art. 6(1)(a) GDPR), which you can give during registration. You can withdraw consent at any time — via the unsubscribe link in every email (one-click unsubscribe) or by emailing georg@malahov.io.

Delivery runs through Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Resend processes your email address, the subject and body of the message, and technical delivery logs. Our sending domain is set up in the EU region eu-west-1 (Ireland), so delivery runs through European data centers; access from the US cannot be ruled out all the same. Open and click tracking are disabled — our emails contain no tracking pixels and no rewritten links. The transfer rests on Resend's Data Processing Addendum including Standard Contractual Clauses (Art. 46 GDPR): https://resend.com/legal/dpa.

Newsletter signup

If you sign up for our newsletter on the website, we store your email address (and optionally your name) on the basis of your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the unsubscribe link.

Inquiry form

On some product pages (for example on association websites or on A4Norm Check-in) you can write to us through a form. We process your name, your email address, optionally your organisation, and your message, together with the page and language the inquiry came from. None of this is stored in a database: our server forwards it as an email via Resend (see above) to georg@malahov.io, where it stays as long as we need it to handle your inquiry and a possible collaboration. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request). Please do not send patients' health data through this form.

Booking an appointment (Cal.com)

On the About page we link to a booking page where you can arrange a call with us. Following that link takes you off our website; the page is operated by Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA.

If you book an appointment there, Cal.com processes on our behalf the data you enter — name, email address, time zone and what you write about your request — along with the appointment itself. Processing takes place in the United States; the transfer rests on Standard Contractual Clauses (Art. 46 GDPR). Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract).

You don't have to use it: an informal email to georg@malahov.io does the same job, and then your data never leaves the EU.

Cal.com's privacy notice: https://cal.com/privacy.

Feedback after sending a practice form

After you have sent a form to a practice (A4Norm Check-in), you can optionally write briefly what was difficult. We receive only this text, the page's language and the practice's name — as an email via Resend (see above) to georg@malahov.io. None of it is stored in a database or linked to your form; your IP address is not stored for this (it is only held briefly in memory to limit abuse). Please do not include personal or medical details. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving our offering).

7. Web analytics: Umami (self-hosted, cookieless)

We use the open-source web analytics tool Umami — self-hosted on our own Hetzner infrastructure in Germany. Umami sets no cookies, builds no cross-device profiles, and stores no personal data; IP addresses are not stored. Only aggregate metrics are collected, such as page views, referrers, and coarse device classes.

For the A4Norm scanner (product page, app and Mini App in Telegram) we also count anonymous usage events: how long the scanner took to get ready, how many photos and pages were processed, how long it took, which filter the scan was made with ("Clean white paper", "Colour" or "Original"), whether an error occurred (only its kind, e.g. "file could not be read"), whether a scan was changed with "Edit" (only whether it got a note, never the note's text, whether it was made black and white, whether an ID was found, how many areas were covered, how many signatures were placed (never the signature itself), on how many pages the eraser was used, how many pages were cropped or rotated, how many pages got a filter of their own and on how many the document's corners were set by hand (never where), whether pages were moved, how many pages were removed, and whether the original scan was brought back), whether the photos were put in another order before the PDF was made, which file size was chosen with "Change size" (only the step and the size before and after as a range, e.g. "100–300 KB"), and whether the result was sent or downloaded, the app installed, whether a finished PDF was the input (how many pages it had and how many were treated as photos, why it could not be opened — e.g. "protected by a password" — and the size of the input and the finished file in coarse ranges such as "10–30 MB"), a link to A4Norm passed on (only how: QR code shown, share sheet or copied), the feedback link or the "Support the project" link opened, or the scanner's camera opened (only from which screen, whether camera access was granted, how many shots were taken, which kind of document — sheet, receipt, card, spread — the scanner saw in the frame at each shot, whether it was taken automatically or by hand, and whether you switched to the system camera or the photo picker instead, and how the camera started (still on from the last opening or anew, after how many seconds, roughly rounded, only at the second try or not at all); never the shots, never where the document was in the frame) — each time with the page it happened on and whether the scanner runs as an installed app. The content of photos and PDFs, file names and texts are never transmitted — the photos do not leave your device at all. Without an internet connection these events are only held in the memory of the open page and are lost if the page is closed first; nothing is stored on your device for this.

On the page shown after sending a practice form, we also count which button of the short question was tapped — whether it was easier than paper (yes/no), whether you run a practice or business yourself (yes/no), whether you opened the A4Norm Check-in page or the demo request, and whether you sent or skipped feedback. This count runs under a fixed address, not under the practice's link; the text of any feedback and anything from the form are never transmitted.

Since no data flows to third parties and no information is stored on or read from your device, neither consent nor a cookie banner is required. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing and improving our offering).

8. Payment processing: Stripe

For Pro subscriptions we use the payment provider Stripe. For customers in the EU, the provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

Payment happens on Stripe's hosted checkout page and via the Stripe customer portal. Your payment details (e.g. card number) are processed directly by Stripe and never reach our servers. We only store your subscription status, a Stripe customer/subscription reference, and the billing period. Stripe receives your email address and the link to your account from us.

The legal basis is Art. 6(1)(b) GDPR (contract performance). For parts of the processing (e.g. fraud prevention, legal obligations), Stripe acts as an independent controller. Where data is transferred to the USA (Stripe, Inc.), Stripe relies on EU standard contractual clauses (Art. 46 GDPR) and is certified under the EU-US Data Privacy Framework. Details: https://stripe.com/privacy.

Voluntary support for A4Norm. Under a finished scan, after it has been sent or downloaded, a "Support the project" link can appear (not in the Mini App in Telegram). It leads to a Stripe payment page (Payment Link); you choose the amount, the payment is voluntary and handled entirely by Stripe. The scanner sends nothing to Stripe or to us — no photos, no PDF, no details about the scan; we only learn that the link was opened (section 7). On the payment page Stripe asks for your email address for the receipt and your payment details, and for a billing address only if your card requires one; name and phone number are not asked for. If you choose another payment method (e.g. Klarna, Apple Pay or saving your details with Link), that provider's terms and privacy notice also apply. In Stripe we see the amount, the time, that email address, the billing address if given, and card details only in shortened form (e.g. card type and last four digits). We use this only to handle the payment and for our bookkeeping, and keep it as long as statutory retention periods require. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for retention.

9. AI processing

Google Cloud Vertex AI (dictation and subtitle editor)

For the core features of our dictation app (transcription, text cleanup, translation) and the subtitle editor's text features (translate, refine), we use Google Cloud Vertex AI. The contracting party is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland.

  • Processing happens exclusively in the EU region europe-west4 (Netherlands).
  • Audio and text data is transmitted per request, processed only to answer that request, and is not used to train models or stored beyond processing (zero-retention configuration).
  • Requests go through our server proxy; your browser never talks to Google directly.

Legal basis: Art. 6(1)(b) GDPR (the AI processing is the core contracted feature). A data processing agreement with Google is in place (Google Cloud Data Processing Addendum) including EU standard contractual clauses. Details: https://cloud.google.com/terms/data-processing-addendum.

Deepgram (audio transcription in the subtitle editor)

For transcribing audio tracks in the subtitle editor we use Deepgram, provided by Deepgram, Inc., 548 Market St, Suite 25104, San Francisco, CA 94104, USA.

Audio data is transmitted to Deepgram's EU endpoint (api.eu.deepgram.com); processing takes place exclusively within EU-based data centers. Storage is temporary and only for processing the request. Every transcription request includes the opt-out parameter for Deepgram's Model Improvement Program (mip_opt_out=true), so your audio data is never used to train or improve Deepgram's models.

Legal basis: Art. 6(1)(b) GDPR. Although Deepgram is a US company, your audio data is processed on EU servers; EU standard contractual clauses (Art. 46 GDPR) apply in addition. More information: https://deepgram.com/privacy.

10. Data processing in the dictation app

  • Audio: your recording is transmitted to Vertex AI (EU) for processing and is not retained there after processing. We do not store your audio files on our servers.
  • Dictation history: results are stored locally on your device (browser database, IndexedDB). You can delete entries yourself at any time.
  • Device sync (Pro, optional): if you enable sync, your settings and history are stored on our server end-to-end encrypted. Encryption happens on your device with a key derived from your sync password; our server stores only ciphertext that is unreadable to us (zero-knowledge — we can neither read nor recover your content; if you lose the password, the synced data cannot be recovered). Legal basis: Art. 6(1)(b) GDPR.
  • Usage metadata: for billing and capacity management we log technical metadata per processing run (e.g. audio duration, token counts, cost, latency) — never the content. Legal basis: Art. 6(1)(b) and (f) GDPR.

11. Data processing in the subtitle editor

Your video and project files are processed and stored locally in your browser; they are not uploaded to our servers. Only the following is transmitted to external services: the audio track for transcription (Deepgram, EU endpoint — only when you start a transcription) and subtitle text for AI features (Vertex AI, EU — only when you use those features).

12. a4norm (Telegram bot)

The bot @a4norm_bot opens the A4Norm scanner inside Telegram. It does not process document photos: the PDF is made in the Mini App right on your device, as on the product page. The bot and the Mini App run on our own infrastructure at Hetzner in Germany and use no cloud or AI services.

  • The scanner on your device. On the product page, on the app page and in the Mini App photos and camera frames are processed in your browser. So that a result survives a reload, the browser keeps the last scan — the original photos or PDF files, the finished PDF and all edits to it — in its local storage (IndexedDB) until you tap “New scan” or delete the site data. If you save a signature with “Signature”, the browser keeps it as the lines drawn, not as a picture, in localStorage until you tap “Delete saved signature” or delete the site data. Also in localStorage are the scanner settings you choose and small helper records (such as that a hint was already shown, and the name the last scan got); the scanner's program files are in the browser's cache (service worker), so that it works offline. All of this stays on your device and is not sent to us; the finished PDF goes to our server only if you tap “Send to chat” yourself (see below). This storage is strictly necessary for the function you use (§ 25(2) no. 2 TDDDG). Legal basis: Art. 6(1)(b) GDPR.
  • Telegram as the channel. Your messages to the bot and its replies travel through Telegram (Telegram Messenger Inc., British Virgin Islands; EU representative: European Data Protection Office, Brussels). Telegram is not our processor here; it processes this data under its own responsibility and its own privacy policy. Whatever is in your chat with the bot — messages, photos, a PDF sent there — stays with Telegram until you delete it there.
  • Photos you send to the bot. If you send the bot a photo anyway, Telegram delivers that message to our server like any other. The bot reads it only to reply with a pointer to the scanner and then discards it. The photo is not downloaded, not processed and not stored, and neither is the message. Legal basis: Art. 6(1)(b) GDPR.
  • Mini App in Telegram. The bot's menu button “Scanner” opens this website's scanner as a Mini App inside Telegram. There your photos stay on your device: the PDF is made right in the browser, as on the product page, and no photo is sent to us. To run, the Mini App loads a script file from telegram.org (Telegram receives your IP address in doing so) and receives launch data signed by Telegram with your Telegram user ID and language setting. Loading the page itself is covered by sections 6 (server log files) and 7 (web analytics). Legal basis: Art. 6(1)(b) GDPR.
  • Passing on the finished PDF. Where Telegram allows the system share sheet (for instance on the iPhone and in the Telegram apps for the Mac), the Mini App offers “Share” first; the PDF then goes straight from your device to the app you pick, not through our server. Only when you tap “Send to chat” — the first time after a confirmation — do the finished PDF and that launch data go to our server, which sends the PDF to your chat with the bot through Telegram's Bot API. The PDF is held in memory for that one delivery only and is not stored on disk, in any log or in any database; the user ID serves only to address the PDF to you and to cap the number of sends, counted briefly in memory. Legal basis: Art. 6(1)(b) GDPR.
  • What Telegram passes along. With every message to the bot Telegram passes on your chat ID, your display name, your username and the language setting of your Telegram client. We do not store display names or usernames; they appear only in the notification about feedback (see below). The language is used to reply to you in it.
  • What the bot stores. Since 24 September 2026 the bot records no usage. So that it answers an album (several photos at once) only once, it keeps the album's identifier for one minute; after “Leave feedback”, /feedback or the scanner's “Send feedback” link it notes for 10 minutes that it is waiting for your message. It stores nothing else apart from feedback you send yourself (see below). How often the scanner itself is used we count anonymously, as described in section 7. Legal basis: Art. 6(1)(f) GDPR.
  • Feedback. After “Leave feedback”, /feedback or the scanner's “Send feedback” link we store the next text message you send as feedback — together with your chat ID, language and time — and notify the operator. The notification shows the operator your Telegram display name and username; these are not stored in the feedback records. The operator may answer you through the bot; the answer is sent to your chat with the bot and is not stored by us. Other messages are not stored; photos or files are not accepted as feedback either. Giving feedback is voluntary. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving a free service).
  • Records from before. Until 24 September 2026 the bot recorded usage events (chat ID, type of event, language, and the tag of the link you came through, if any) as well as voluntary ratings and feedback with chat ID and language. We keep feedback and these records for as long as we need them to improve the service. On request we delete every record tied to your chat ID — write to georg@malahov.io or use /feedback in the bot.

13. Referral program

If you share your personal referral link, we count clicks on that link anonymously (without IP addresses or identifying visitors). If a referred person registers and uses the service, the referral is credited to your account. You are not told which person registered, and the referred person is not told whose link was used — only the association via the referral code is stored. Legal basis: Art. 6(1)(b) GDPR (the program's terms of participation) and Art. 6(1)(f) GDPR (anonymous click counting).

14. Sub-processors

A current overview of all processors we use, including their location, purpose, and transfer mechanism, is available on the Sub-processors page.