Acceptable Use Policy

Norba connects your software, and travellers on booking.norba.io and in the Norba Travel apps, to airlines' live reservation systems. Misuse does not stay with the person who caused it: an airline that sees abuse coming through Norba can restrict the whole platform. This policy explains what that means in practice.

The binding rules are clause 4 (for the API and the dashboard) and clause 14 (for the booking site and the apps) of the Terms of Service. This policy explains how we apply them, with examples; where it and the Terms of Service differ, the Terms of Service prevail.

Every booking or hold made through Norba must be one a real traveller intends to fly, made with that traveller's real details. Not acceptable:

• speculative bookings or holds made to secure seats or a price you have no buyer for;
• fictitious, placeholder or test names on a production booking;
• creating and releasing holds again and again to keep seats out of sale, or to keep a price alive past the airline's deadline;
• booking in production to test an integration — the sandbox exists for that;
• using stolen or unauthorised payment cards, or cards you are not entitled to use for that payment.

Each search reaches an airline's live system. Airlines measure how many searches lead to a booking and hold us to it, and the Terms of Service (clause 7) explain how that affects what you pay. Not acceptable:

• searching to build or refresh a fare database, a price index or a comparison feed out of answers obtained for booking;
• presenting a stored or cached answer to a traveller as a live price or live availability;
• load tests or volume tests against production without agreeing them with us first;
• working around quotas, free-request allowances or the measurement of your searches — for example by spreading one business's traffic over several accounts.

Automated access goes through the API, with your own key. Not acceptable:

• scraping, crawling or automating booking.norba.io, the apps or the dashboard — bots, headless browsers or scripts that search or book through the screens;
• calling the internal endpoints the booking site and the apps use for themselves, instead of the public API;
• mirroring, republishing or reselling airline content outside the agreements the offers reach you under.

Reading our public pages and documentation, including with search-engine crawlers that respect robots.txt, is of course fine.

• A key belongs to the business that holds the account. Do not share it with, lend it to or sell it to anyone your agreement with us does not cover; if a partner needs access, ask us and they get a key of their own.
• Do not resell or white-label access to the API without a written agreement with Norba.
• Keep keys out of client-side code, mobile apps and version control. A key in a browser or an app is a key anyone can copy.
• Do not create accounts in someone else's name, or more than one account for the same business to obtain more free requests.
• Rotate a key you think has leaked, at once; you can do it yourself in the dashboard.

• Do not try to reach data or accounts that are not yours, or to get round authentication, permissions or the separation between sandbox and production.
• Do not send malware, or requests designed to degrade the service — floods, oversized payloads, deliberately malformed traffic.
• Do not probe for vulnerabilities outside the rules on our Security and responsible disclosure page, and never against airline systems.
• Do not put card numbers, passport scans or passwords in support messages, metadata or webhook URLs; the Data Processing Agreement (clause 3) says where such data belongs.

Use Norba only for lawful purposes, and only with personal data you are entitled to provide. On the API, you are the controller of your travellers' data and are responsible for having a lawful basis and a privacy notice for it. On the booking site, book only for yourself or for people who have allowed you to give their details. Do not use the service to commit fraud, to evade sanctions or export controls, or to infringe anyone's rights.

Depending on how serious it is and whether it can be put right, we may: contact you and ask you to stop; restrict or revoke a key; refuse requests; suspend or close the account; or, on the booking site, refuse a booking. The Terms of Service (clauses 3 and 13) set out when we may do each and what notice you get. Where we can, we tell you what we saw and give you a chance to fix it first. If you think we got it wrong, tell us — the Complaints procedure explains how.

Airlines enforce their own rules too, and may cancel bookings they consider speculative or abusive regardless of what we do.

If you see a Norba key exposed in public, abuse coming from a Norba account, or content you believe is illegal, write to hello@norba.io. For illegal content, the Legal Notice (clause 4) lists what to include.