How Rumbo handles your data

Rumbo is a preliminary information service for moving to Uruguay and navigating immigration procedures. It asks questions, presents possible routes, and helps organize next steps.

Rumbo is not a government authority, does not decide residence applications, and does not replace a lawyer or other qualified professional. Final requirements and decisions belong to the relevant authorities.

A case may contain your answers, language, situation facts, preliminary route candidates, messages, tasks, step status, and Slot Watch preferences. Technical revisions, timestamps, consent records, and de-identified check results are also kept where needed for reliable operation.

When you sign in by email link, Google, or Apple, Rumbo stores the normalized email and display name in encrypted form, pseudonymous provider-identity hashes, and revocable server sessions. To send a one-time link, the email address and message content are transferred to the delivery provider Resend. Google or Apple may provide a name and verified email; Apple may provide a private relay address and a revocable refresh credential, which Rumbo encrypts solely so the authorization can later be revoked. A requested email-notification destination is encrypted too.

A new social identity is never linked to an existing account merely because its email matches: you must first sign in and explicitly link it. Private answers never become public pages automatically.

• Do not enter full names, document numbers, passwords, or payment details in free text.
• Official sites opened from Rumbo apply their own policies.
• Rumbo does not currently use private case answers for advertising.

An anonymous case uses a first-party Rumbo cookie containing a random access token for up to 30 days. It is not an advertising tracker; it reopens the same case and protects it from another visitor.

After sign-in, a separate secure HttpOnly cookie opens a revocable account session for up to 30 days. You can end sessions and download or delete account data. Linking a case replaces its previous anonymous token.

If you sign in but do not create a beta account with explicit consent, the auth profile is deleted after no valid sessions remain and at least 30 days have passed since the last sign-in. Account deletion removes local auth data immediately; an encrypted Apple credential moves to a separate retry queue only until Apple authorization is successfully revoked.

The anonymous server-side case is automatically deleted after 30 days of inactivity. That automatic deletion does not apply while a case is linked to a beta account. Deleting the account detaches its cases but does not immediately delete them: a still-valid cookie may continue to open the current case, after which the 30-day period runs from its last activity. Use “Delete private case” for immediate deletion.

“Delete private case” removes answers and history and invalidates the current token. It also revokes an associated Slot Watch connection; technical cleanup of a remote connector may finish asynchronously.

If you lose case access, do not send the token or documents over an insecure channel. Use the contact published on the Support page.

Rumbo uses an Anthropic-compatible AI provider only after a specific opt-in. Certain questions can send limited free text for interpretation. A PDF pre-check requires separate permission to send its extracted text layer.

The uploaded file is not kept in persistent file storage. Rumbo validates it, extracts available PDF text, and sends only what is needed for a one-time check. The case may retain a structured technical outcome, but not the original file.

The AI check does not establish authenticity, legal validity, or acceptance by an authority. Free-text consent and document consent are separate; the corresponding external transfer does not occur without them.

A question inside a private case does not become an SEO page by default. Rumbo asks for separate consent to use it as an anonymous editorial draft.

With that consent, personal details are removed, the draft enters human editorial review, and it is never auto-published. The consent does not cover the rest of the case history.

When a step requires professional review, Rumbo separately asks you to describe what should be reviewed. The expert receives that text, your language, structured facts, route candidates, step criteria, and task status at request time. Your conversation history, email, and original uploaded files are not shared automatically.

Do not include full names, complete document identifiers, or a sensitive humanitarian narrative. The request, disclosure version, decision, and expert comment stay with the case and follow the same deletion rules. Review does not guarantee an agency outcome and does not by itself create a lawyer–client relationship.

Slot Watch stores the selected procedure, offices, date and time range, notification channel, and technical monitoring state. A local extension can observe availability after the user opens the official process.

Slot Watch is alert-only: it does not book, enter government credentials, send official-site cookies to Rumbo, bypass CAPTCHA, or make a payment.

Case access is protected by the cookie token or a linked account. Public sign-in never grants administrator or expert permissions. No internet service can promise absolute security, so Rumbo minimizes data and keeps optional consents separate.

Retention periods, providers, and wording may change before general release. Material changes will appear here. Use the case panel for deletion and the current Support page for other requests.