RumboDesk RumboDesk
ES Try free

Privacy Notice

Last updated: June 16, 2026

1. Data Controller

RumboTech Labs S.A.S. de C.V. ("RumboDesk", "we", "us"), with tax domicile in the state of Puebla, Mexico, is the controller of your personal data under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and other applicable rules.

2. Personal data we collect

Depending on which service you use, we collect:

  • Identification and contact data: name, email address, phone number, organization.
  • Billing data: business name, tax ID (RFC), fiscal address, payment data processed via Stripe (we do not store card numbers directly).
  • Operational data: contents of emails, PDFs, Word, Excel or other documents you forward, upload or paste into the platform to be structured as travel bookings. This may include third-party data (end-clients, suppliers) that you provide.
  • Technical and usage data: IP address, device type, browser, timestamps of access, activity logs within the platform.

Sensitive data: we do not request or process sensitive personal data. If you choose to include sensitive data (e.g., health, religion, ethnic origin) inside the documents you upload, you do so under your own responsibility and with prior consent from the end-clients.

3. Purposes of processing

Primary purposes (necessary to deliver the service):

  • Create and administer your account and your organization's.
  • Process the information you forward to structure it as bookings via AI and make it available for your review.
  • Process payments, subscriptions and billing.
  • Provide technical support and customer service.
  • Comply with legal, tax and regulatory obligations.

Secondary purposes (not required, subject to your explicit consent):

  • Sending commercial communications, product updates and educational materials.
  • Service improvement through aggregated, anonymized statistical analysis.

You may opt out of secondary purposes at any time by emailing [email protected].

4. Data transfers

To provide the service, we transfer data to the following processors, with whom we have active data-processing agreements:

  • Supabase Inc. (USA): database storage and authentication.
  • Anthropic PBC (USA): AI processing of the content you forward, exclusively for structuring purposes. Anthropic does not use your data to train its models.
  • Cloudflare Inc. (USA): network infrastructure, hosting and email-bridge delivery.
  • Stripe Inc. (USA): payment processing.
  • Google LLC (USA): optional authentication via Google Sign-In.

These international transfers are made under the safeguards required by LFPDPPP. We do not sell or share your personal data with third parties for commercial purposes.

5. Your rights (ARCO)

You have the right to know what personal data we hold about you and how we use it (Access), to request correction of inaccurate data (Rectification), to ask us to delete data when you believe it is no longer required (Cancellation), or to object to the use of your data for specific purposes (Opposition).

To exercise any of these rights, send your request to [email protected] including: (i) full name and contact information, (ii) documents proving your identity, (iii) clear description of the right you wish to exercise, and (iv) any other element that helps us respond. We will respond within twenty business days.

6. Withdrawal of consent

You may withdraw your consent to the processing of your personal data at any time. Note that withdrawal may prevent us from continuing to provide the service. To withdraw, write to [email protected].

7. Data retention

We retain your data while your account is active and during the periods required by applicable tax, accounting and commercial law (typically five years after account closure). After that, data is securely deleted or anonymized.

8. Security measures

We implement reasonable physical, technical and administrative measures to protect your data against unauthorized access, loss, alteration or disclosure: encryption in transit (TLS) and at rest, role-based access control, per-organization isolation (multi-tenant), and activity monitoring.

9. Cookies

This site uses only essential cookies for session functionality and optional aggregated analytics without personal identifiers. We do not use third-party advertising tracking cookies.

10. Changes to this Notice

We may update this Privacy Notice. When we make material changes, we will notify you by email and/or via a prominent in-app notice before they take effect.

11. Contact

For any questions about this Notice or the processing of your personal data, contact us at [email protected].