Privacy policy

Last updated: 28 July 2026

Rumblings Operations Pty Ltd (ACN 692 929 114), a wholly owned subsidiary of Rumblings Holdings Pty Ltd (ACN 692 919 609) (together “Rumblings”, “we”, “us”, “our”), operates rumblings.io and provides trend intelligence services. This policy explains how we collect, use, and protect information when you visit our website and when you use our services.

Who we are

Rumblings is an AI-powered decision-engine for marketers, operated from Sydney, Australia. If you have any questions about this policy, or wish to exercise any of the rights described below, contact us at privacy@rumblings.io. For general enquiries, contact info@rumblings.io.

Information we collect

Information you give us. When you join the waitlist, request a conversation about Intelligence Lab, register for an account, or otherwise contact us, you may provide your name, work email, company, role, and any details you choose to include in a message. Where you become a customer, this also includes brand and preference information you provide during onboarding. Payment information is processed by third-party payment providers; we do not hold payment card data.

Information collected automatically. Our web server logs standard request metadata – IP address, user agent, page requested, timestamp – for security, abuse prevention, and basic traffic analysis.

Cookies. This website does not set tracking cookies, and we do not run third-party analytics, advertising trackers, or fingerprinting tools on it. Our authenticated platform uses session cookies that are strictly necessary to keep you signed in.

Information from external platforms and data sources. We access publicly available content from external platforms and data sources, including Tumblr, Bluesky, Pinterest, YouTube, Hacker News, Substack, Wikipedia, Google autocomplete data, the GDELT global news index, and trade and news publications, through their official APIs and public data sources, in order to provide our trend analysis services. This includes:

• public posts, comments, and engagement metrics
• aggregated trend data and content performance information

We do not collect private messages, non-public content, or personal information from users of those platforms beyond what is publicly visible. We do not use platform data to derive or infer sensitive personal characteristics such as health status, political affiliation, sexual orientation, religious beliefs, or ethnic origin.

How we use information

We use collected information to:

• provide, maintain, and improve our services
• respond to your request (for example, to invite you to a waitlist cohort or schedule a conversation)
• analyse trends and generate aggregated insights for our customers
• communicate with you about your account and our services
• comply with legal obligations
• protect against fraud and abuse

We do not:

• sell your personal information to third parties
• share your information with advertisers
• use your data for surveillance purposes
• use platform data for targeted advertising or retargeting
• build individual user profiles from social media data for purposes other than aggregated trend analysis
• use data to determine creditworthiness or for lending purposes

Information sharing

We do not sell personal information. We may share information:

• with service providers who assist our operations, including hosting, automation tooling, email, payment processing, and AI model providers used for content analysis and generation, under appropriate data protection agreements. Our AI model providers operate under paid commercial terms that exclude the use of your data to train their models. A current list of these providers is available on request
• to comply with legal requirements or respond to lawful requests
• to protect our rights, privacy, safety, or property
• in connection with a merger, acquisition, or sale of assets, with notice to you

Where data is stored, and international transfers

Rumblings is operated from Sydney, Australia. Our platform infrastructure, including our application database and automation tooling, is hosted on a dedicated server located in Kuala Lumpur, Malaysia. Email correspondence, documents, and files are processed by Google Workspace. Content excerpts are processed by the AI model providers described above, which may process data in other countries, including the United States.

This means information you provide to us, and public content we collect, may be transferred to and stored in Malaysia, and may be processed in other countries by the service providers described above. Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure that recipient handles it consistently with the Australian Privacy Principles, including through contractual data protection terms.

If you access our services from outside Australia, your information may be transferred to and processed in Australia, Malaysia, and other countries in accordance with applicable data protection laws.

Data retention and deletion

We retain personal information for as long as necessary to provide our services and fulfil the purposes described in this policy, unless a longer retention period is required by law. We keep contact submissions for as long as the conversation is active and for a reasonable period afterwards.

Your right to deletion. You may request deletion of your personal data at any time by contacting us at privacy@rumblings.io. We will process deletion requests within 30 days, subject to any legal retention requirements. Backup copies may persist for a short further period in line with our backup rotation cycle.

For data obtained from external platforms, we comply with each platform's data retention and deletion requirements, including removing content from our systems where a platform indicates that content has been deleted or made private. Where an individual asks us to remove specific content they have published publicly, we will action that request where the content can be identified from the information provided.

Your rights

Depending on where you live, you may have rights under the Australian Privacy Principles, the GDPR, or other privacy laws to:

• access the personal information we hold about you
• correct inaccurate information
• request deletion of your information
• object to or restrict certain processing
• data portability
• withdraw consent at any time
• lodge a complaint with a data protection authority

To exercise any of these rights, email privacy@rumblings.io. We will respond to requests within 30 days.

Security

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, or destruction. All data is transmitted via HTTPS/TLS encryption, and data at rest is encrypted by our hosting and storage providers. Access to internal systems requires single sign-on, and access to client material is restricted to team members who need it.

Children

Our services are not directed to individuals under the age of 16, and Rumblings is not intended for use by anyone under 16. We do not knowingly collect personal information from individuals under 16. If we become aware that we have collected personal information from an individual under 16, we will take reasonable steps to delete that information as soon as practicable.

Third-party links

Our website and services may contain links to third-party websites. We are not responsible for the privacy practices of those sites.

Changes to this policy

We may update this policy from time to time. We will notify you of material changes by posting the updated policy on our website, updating the “Last updated” date at the top, and where appropriate notifying you by email. If we make changes to how we use your data beyond what was disclosed when you first consented, we will seek your consent before doing so.

Contact

Privacy enquiries and requests: privacy@rumblings.io

General enquiries: info@rumblings.io

Rumblings Operations Pty Ltd, 1.02, 80–82 Queen St, Woollahra NSW 2025, Australia

Platform-specific disclosures

Pinterest

We access Pinterest data through the Pinterest API in accordance with Pinterest's Developer Terms and API Terms of Service. We use publicly available pin and trend data for aggregated trend analysis only. Pinterest API responses are processed in memory and are not retained; we store only derived corroboration records indicating whether a topic detected elsewhere is also visible on Pinterest. We do not use Pinterest data for advertising, retargeting, or building individual user profiles.

YouTube (Google)

Our use of YouTube API Services is subject to the YouTube API Services Terms of Service and Google's Privacy Policy. We access publicly available video metadata and engagement data for trend analysis. We do not use YouTube data to identify individuals, for advertising purposes, or to create derived metrics that replace those offered by YouTube's API. Users may revoke our access to their data via Google's security settings at security.google.com/settings/security/permissions.

Tumblr

We access Tumblr data through the Tumblr API in accordance with Tumblr's API License Agreement. We collect publicly available posts and trending tag data for aggregated trend analysis. We do not attempt to identify individual users or combine Tumblr data with other sources to build user profiles.

Bluesky

We access Bluesky content through the AT Protocol, which provides open access to public posts. We collect publicly available posts and engagement data for aggregated trend analysis. We respect user privacy settings and do not collect content from private or restricted accounts.

GDELT (Global Database of Events, Language, and Tone)

We access GDELT, an open-source global news and event dataset, in accordance with its published usage terms. We use GDELT data for aggregated global news-event trend analysis only, and do not combine it with other sources to identify or profile individuals.

Substack

We access publicly available Substack posts and publication metadata for aggregated trend analysis. We do not access private or subscriber-only content, and do not use Substack data to build individual user profiles.

Trade press

We monitor publicly published trade and industry press coverage relevant to our clients' sectors, for aggregated trend analysis. We do not access paywalled or subscriber-only trade press content.

Google autocomplete

We collect publicly available Google autocomplete suggestion data for aggregated trend and search-interest analysis. This data is aggregated and contains no information about individual searchers or their queries.

Hacker News and Wikipedia

We access publicly available posts, comments, and page activity data from Hacker News and Wikipedia through their public APIs for aggregated trend analysis. We do not attempt to identify individual contributors.