How Rumbo handles your data

Rumbo is a preliminary information service for moving to Uruguay and navigating immigration procedures. It asks questions, presents possible routes, and helps organize next steps.

Rumbo is not a government authority, does not decide residence applications, and does not replace a lawyer or other qualified professional. Final requirements and decisions belong to the relevant authorities.

The controller of personal data in Rumbo is the owner of the service: they decide the purposes and means of processing. The providers listed in the subprocessor section handle data only on our instructions and only for the stated task.

Controller: WELLNESS FOOD INC. Country of registration: United States of America (Florida). Postal address for written requests: 1150 NW 72nd Ave, Tower 1, Ste 455 #14129, Miami, Florida 33126, USA.

Private cases and accounts are stored on a dedicated server operated by Rumbo; the hosting country is United States of America (California).

Legal bases: case answers are processed to deliver the service you asked for and to run your route; the optional transfers — AI interpretation of free text, a preliminary check of a PDF text layer, editorial reuse of a question, and sending a step to a human expert — happen only on the basis of a separate consent.

Send data requests to hello@rumbo-uruguay.com. So that data never reaches the wrong person, we may ask you to confirm case access — for example, an action from the case panel. An anonymous case without an account cannot be tied to your identity: delete it with “Delete private case” in its panel.

We answer a data-subject request within 30 calendar days of receiving it; for access, rectification, and deletion requests the shorter statutory deadline of Uruguay’s Ley 18.331 applies: five business days.

If our answer does not resolve the matter, you may complain to the Unidad Reguladora y de Control de Datos Personales (URCDP), Uruguay’s supervisory authority under Ley 18.331. If you are in the EU or EEA, you may also contact the supervisory authority of your residence, place of work, or the alleged infringement (GDPR, art. 77).

You can exercise the following rights over your data:

• Access: learn what data about you exists and receive a copy.
• Rectification: correct inaccurate answers inside the case or by request.
• Deletion: erase the private case from its panel and account data from the account panel.
• Portability: download account data in a machine-readable format.
• Objection and restriction: object to a specific processing activity or ask us to restrict it.
• Withdrawal of consent: switch off any separate consent; withdrawal applies going forward and does not undo a transfer that already happened.

Rumbo uses no analytics, advertising, or third-party trackers, and makes no automated decision with legal effect on you: a route is information, and the authority decides the case.

A case may contain your answers, language, situation facts, preliminary route candidates, messages, tasks, step status, and Slot Watch preferences. Technical revisions, timestamps, consent records, and de-identified check results are also kept where needed for reliable operation.

When you sign in by email link, Google, or Apple, Rumbo stores the normalized email and display name in encrypted form, pseudonymous provider-identity hashes, and revocable server sessions. To send a one-time link, the email address and message content are transferred to the delivery provider Resend. Google or Apple may provide a name and verified email; Apple may provide a private relay address and a revocable refresh credential, which Rumbo encrypts solely so the authorization can later be revoked. A requested email-notification destination is encrypted too.

A new social identity is never linked to an existing account merely because its email matches: you must first sign in and explicitly link it. Private answers never become public pages automatically.

• Do not enter full names, document numbers, passwords, or payment details in free text.
• Official sites opened from Rumbo apply their own policies.
• Rumbo does not currently use private case answers for advertising.

An immigration route usually involves the whole family, so a case may contain data about other people: their role in the case (partner, child, another adult), the kind of relationship (spouse, concubinato, child, parent, sibling, other), citizenship, and the authority status — whether the person acts for themselves, was invited into the case, or had their data entered by a representative, and whether that representation is verified.

Rumbo does not ask for a family member’s name, date of birth, document number, or address: the fields above are enough for a route. Do not enter them in free text either.

A child’s data is entered by the adult running the case as a parent or legal representative; by entering it, that adult confirms they are entitled to do so. Rumbo records whether the representation is verified or only asserted. Independent use of Rumbo by minors is not provided for: the minimum age is stated in the Terms.

The basis is delivering the service you requested in the case you run and, for optional transfers, your separate consent. Family-member data lives inside your case, follows the same retention periods, and is deleted with it: “Delete private case” removes it immediately, and individual answers can be corrected inside the case.

If you believe data about a child or another person was entered without a legitimate basis, write to Support and we will delete it.

An anonymous case uses a first-party Rumbo cookie containing a random access token for up to 30 days. It is not an advertising tracker; it reopens the same case and protects it from another visitor.

After sign-in, a separate secure HttpOnly cookie opens a revocable account session for up to 30 days. You can end sessions and download or delete account data. Linking a case replaces its previous anonymous token.

If you sign in but do not create a beta account with explicit consent, the auth profile is deleted after no valid sessions remain and at least 30 days have passed since the last sign-in. Account deletion removes local auth data immediately; an encrypted Apple credential moves to a separate retry queue only until Apple authorization is successfully revoked.

The anonymous server-side case is automatically deleted after 30 days of inactivity. That automatic deletion does not apply while a case is linked to a beta account. Deleting the account detaches its cases but does not immediately delete them: a still-valid cookie may continue to open the current case, after which the 30-day period runs from its last activity. Use “Delete private case” for immediate deletion.

“Delete private case” removes answers and history and invalidates the current token. It also revokes an associated Slot Watch connection; technical cleanup of a remote connector may finish asynchronously.

If you lose case access, do not send the token or documents over an insecure channel. Use the contact published on the Support page.

Rumbo calls external AI processing only after a specific opt-in. Three intake questions can send limited free text for interpretation. A PDF pre-check requires separate permission to send its extracted text layer. Who receives that data and where it is processed is set out in “Subprocessors and transfers outside Uruguay”.

The uploaded file is not kept in persistent file storage. Rumbo validates it, extracts available PDF text, and sends only what is needed for a one-time check. The case may retain a structured technical outcome, but not the original file.

The AI check does not establish authenticity, legal validity, or acceptance by an authority. Free-text consent and document consent are separate; the corresponding external transfer does not occur without them.

Rumbo does not sell personal data and does not share it with advertising networks. Recipients are limited to the providers listed below: they process data on our instructions and only for the stated task.

Free text leaves Rumbo only under your separate consent to AI interpretation, and only for three intake questions: the citizenship you will apply with, how long you plan to live in Uruguay, and whether you are already in the country. Answers to other questions, case history, and conversation are not transferred.

The extracted PDF text layer leaves Rumbo only under the separate consent to a preliminary document check. The original file is neither stored nor transferred: only the extracted text is sent, and only for a one-time check. The result does not establish authenticity or legal validity and does not replace the authority’s decision.

The recipient of both transfers is a third-party reseller of AI model access, apiclaudecode.cloud (technical request host: api.east-api-3.org), speaking a protocol compatible with the Anthropic API. It resells access rather than building the model: it may route a request to the infrastructure of different model providers, including Anthropic, Google, or OpenAI. Rumbo asks for a specific Claude model but cannot guarantee the routing, so the final processor of the text and the country of processing depend on the reseller.

That recipient’s exact details — legal entity, country of processing, and data-processing agreement terms — are provided on request through Support.

That recipient is located outside Uruguay, so the transfer is cross-border (Ley 18.331, art. 23; GDPR, Chapter V). Its basis is your separate consent to the specific operation: without consent, neither free text nor document text leaves Rumbo.

What is transferred and to whom:

• apiclaudecode.cloud (host api.east-api-3.org) — reseller of AI model access: interprets free text for three intake questions and checks extracted PDF text; only under separate consent; processing happens outside Uruguay.
• Resend — delivery of outgoing transactional email (one-time sign-in link and service notices): receives the destination address and the message content; infrastructure outside Uruguay.
• The hosting provider of the server that runs Rumbo and stores the case database: supplies infrastructure and does not receive the data for its own purposes.

If you grant neither the AI-interpretation consent nor the document-check consent, neither free text nor document text leaves Rumbo. A route is still built without those consents, from the options you select.

A humanitarian reason for moving, an asylum request, and choosing an asylum or protection route are special-category data (datos sensibles, Ley 18.331, art. 18; special categories, GDPR, art. 9). Stating them is optional: without them Rumbo shows general routes.

These markers are stored inside the case, follow the same retention periods, and are deleted with it. In free text, do not describe details of persecution, health, or third parties — the fact itself is enough for a route — and keep that narrative out of the comment sent to a human expert.

Rumbo does not assess or confirm grounds for asylum or humanitarian protection: the competent authority decides that, and such a case deserves a qualified professional.

When a case carries one of these markers, the product applies reinforced restrictions:

• free text from that case is not transferred to the external recipient even with AI-interpretation consent switched on — the request is stopped before it is sent;
• the preliminary AI document check is unavailable for that case: the request is refused before any text is transferred, and the same check runs again immediately before the transfer;
• a question from that case cannot enter the editorial pipeline — the submission is refused and it never becomes a knowledge-base page;
• after the application is filed, and at the identity-document stage, a reduced step sequence is shown instead of the usual chain of appointments.

A question inside a private case does not become an SEO page by default. Rumbo asks for separate consent to use it as an anonymous editorial draft.

With that consent, personal details are removed, the draft enters human editorial review, and it is never auto-published. The consent does not cover the rest of the case history.

When a step requires professional review, Rumbo separately asks you to describe what should be reviewed. The expert receives that text, your language, structured facts, route candidates, step criteria, and task status at request time. Your conversation history, email, and original uploaded files are not shared automatically.

Do not include full names, complete document identifiers, or a sensitive humanitarian narrative. The request, disclosure version, decision, and expert comment stay with the case and follow the same deletion rules. Review does not guarantee an agency outcome and does not by itself create a lawyer–client relationship.

Slot Watch stores the selected procedure, offices, date and time range, notification channel, and technical monitoring state. A local extension can observe availability after the user opens the official process.

Slot Watch is alert-only: it does not book, enter government credentials, send official-site cookies to Rumbo, bypass CAPTCHA, or make a payment.

Case access is protected by the cookie token or a linked account. Public sign-in never grants administrator or expert permissions. No internet service can promise absolute security, so Rumbo minimizes data and keeps optional consents separate.

Retention periods, providers, and wording may change before general release. Material changes will appear here. Use the case panel for deletion and the current Support page for other requests.