Privacy, terms and security
What we do with your data, and what this site is.
Rumba is a pre-launch project, not an operating bank. This page sets out plainly what we collect, what we do not, what you are agreeing to by using this site, and how to report a security problem.
Last updated 30 August 2026
Section 01What Rumba is today
Read this before anything else
Rumba has not launched. It is not a bank, not an e-money institution and not authorised or regulated by any financial authority. It holds no customer money, offers no accounts and provides no financial services of any kind.
No legal entity has yet been incorporated to operate it. No licensed sponsor, card issuer or safeguarding institution has been appointed. Everything described on this site is a design intention that depends on agreements and regulatory approvals we have not obtained.
We say this at the top rather than in small print because the site describes banking features in detail, and it would be easy to come away believing they exist. They do not exist yet.
Because no operating entity exists, this page cannot name a data controller, a company number or a registered office. When the entity is incorporated, this page will be replaced with a full privacy notice naming it, and anyone whose email address we hold will be told.
Section 02What we collect
Very little, because the site does almost nothing. There is no account, no login, no tracking pixel, no advertising network and no analytics platform on this site.
| What | When | Why | Kept |
|---|---|---|---|
| Email address | Only if you submit the waitlist form | To tell you when Rumba opens | Until you ask us to delete it, or until the project ends |
| Server logs | Every page request | Kept automatically by our hosting provider for security and diagnostics | As set by the host, typically a short rolling period |
| Assistant demo input | If you type or speak in the demo | Nothing. It is not transmitted to us | Not stored. It disappears when you close the tab |
We do not sell data, share it with advertisers, build profiles or use it to train any model. We do not use cookies for tracking. The site sets no cookies of its own.
Section 03The waitlist
If you give us your email address and tick the consent box, we will use it for one purpose: to contact you about Rumba opening. We will not add you to a marketing list, pass your address to anyone else, or email you about anything unrelated.
- You can ask us to delete your address at any time by emailing info@rdbnk.com, and we will do it and confirm.
- Every email we send will contain a one-click unsubscribe.
- If the project does not proceed, we will delete the list and tell you we have done so.
- If the operating entity changes, we will tell you who holds your address before anything else happens.
Depending on how the form is configured, your address may pass through a third-party form provider before reaching us. Where that is the case the provider is named here and acts only on our instructions.
Section 04The assistant demonstration
The assistant at rdbnk.com/assistant.html is a scripted demonstration. It is not artificial intelligence, it is not connected to any account, and it cannot move money, place an order or make a booking. Every response is written in advance and is identical for every visitor.
Anything you type or say into it stays in your browser. It is not sent to us, not logged and not retained. Company, venue, airline and merchant names used in the demonstration are illustrative and imply no partnership, endorsement or commercial relationship.
Prices, availability, weather and delivery times shown in the demonstration are invented.
Section 05Voice input
Where your voice goes
The microphone in the demonstration uses the speech recognition built into your browser, not any service of ours. Depending on your browser and device, your audio may be sent to your browser vendor (for example Google or Apple) to be transcribed into text.
That transfer is between you and your browser vendor and is governed by their privacy policy. Rumba does not receive, hear, store or process your audio, and does not receive the transcript either. The text appears only in the input box on your own screen.
Your browser will ask permission before the microphone is used, and you can refuse or revoke it at any time in your browser settings. The demonstration works perfectly well by typing. If you would rather no audio left your device, type instead.
Section 06Third parties
| Service | What it does | What it may see |
|---|---|---|
| Hosting provider | Serves the website | Your IP address and request details, in standard server logs |
| Google Fonts | Supplies the typefaces | Your IP address and browser, when fonts are fetched |
| Browser speech service | Transcribes voice input, only if you use the microphone | Your audio, as described in section 05 |
| Form provider | Receives waitlist submissions, where configured | The email address you submit |
We are working to remove the Google Fonts dependency by serving the typefaces from our own domain, which would stop that data leaving to a third party at all.
Section 07Your rights over your data
The only personal data we hold is an email address you chose to give us. You can ask us at any time to tell you what we hold, correct it, delete it, or stop using it. Email info@rdbnk.com and we will respond within thirty days, and in practice much sooner.
Depending on where you live you may also have a right to complain to a data protection authority. Once an operating entity exists and a lead supervisory authority is established, this page will name it.
Children
The Rumba account is planned to open at sixteen, with a Junior tier for younger members in a later release. This website is an information site aimed at adults. We do not knowingly collect data from children through it. If you believe a child has given us their email address, tell us and we will delete it immediately.
Section 08Terms of use
By using this site you accept the following.
- This is information, not an offer. Nothing on this site is an offer of a financial product or service, an invitation to invest, or a promise that any described feature will exist.
- Nothing here is advice. The content is not financial, investment, legal, tax or insurance advice, and must not be relied on when making any decision. Take independent professional advice.
- Forward-looking statements. Descriptions of products, partnerships, licensing routes and timelines are intentions, not commitments. They may change entirely or not happen at all.
- Accuracy. We try to keep this site accurate and correct errors when we find them, but we do not warrant that it is complete or current, and we may change it without notice.
- Third-party names and links. Names of companies, venues and services are used descriptively. Their appearance does not mean they endorse Rumba or have any agreement with us. We are not responsible for external sites we link to.
- Our content. The Rumba name, logo, text and design are ours. Please do not reproduce them commercially without asking. You are welcome to quote or link to the site.
- Liability. To the extent the law allows, we are not liable for loss arising from use of, or reliance on, this site. Nothing here limits liability for fraud, death or personal injury caused by negligence, or anything else that cannot lawfully be excluded.
- Acceptable use. Please do not attempt to disrupt the site, probe it destructively, or use it to break the law. Responsible security testing is welcome under section 09.
Because no operating entity is incorporated yet, no governing law or jurisdiction clause is stated. That will be added, along with a proper contracting party, when the entity exists.
Section 09Security and responsible disclosure
This site is a static website. It has no database, no login, no payment processing and no customer data beyond waitlist email addresses. That is deliberate at this stage: the less it does, the less there is to attack.
Reporting a problem
If you find a vulnerability, please email info@rdbnk.com
with the subject line SECURITY. Tell us what you found and how to reproduce it. We
will acknowledge within three working days and keep you updated until it is resolved.
- We will not pursue legal action against anyone acting in good faith under this policy.
- Please do not access, modify or delete data belonging to anyone else.
- Please do not run denial-of-service tests, spam our forms or use social engineering against our people.
- Please give us a reasonable chance to fix an issue before disclosing it publicly.
- We have no bug bounty budget yet, but we will credit you publicly if you would like that.
What we have in place
- HTTPS enforced across the whole site.
- A content security policy restricting where scripts, styles and connections may come from.
- No third-party analytics, advertising or tracking scripts.
- Framing of the site by other domains is blocked.
Additional hardening is in progress, including DNSSEC, CAA records, DMARC alignment and moving fonts onto our own domain. Before any financial service launches, independent penetration testing will be carried out.
Section 10Accessibility
We aim to meet WCAG 2.2 level AA. The site uses semantic headings, visible keyboard focus, text alternatives for images and icons, and respects your operating system setting for reduced motion. The assistant demonstration can be completed entirely by keyboard, and the microphone is optional.
We know accessibility is never finished. If something on this site is difficult or impossible for you to use, please email info@rdbnk.com and tell us what and where. We will fix it and reply to you directly.
Section 11Contact
General and privacy enquiries: info@rdbnk.com
Founder's office: adam@rdbnk.com
Security reports: info@rdbnk.com with subject
SECURITY
A postal address will be published here once the operating entity is incorporated and has a registered office.