Cookie Policy
Effective date: 9 September 2026
Cookie Policy
This page lists everything norba.io stores in your browser — cookies, local storage and session storage alike, because the law is about storage and not about the word “cookie”. The site is operated by NORBA TRAVEL OÜ, registry code 17597060, and “first party” below means that company.
Only the strictly necessary part is automatic. Service telemetry asks first where the law requires it, and can be switched off anywhere. Nothing here is used for advertising, we run no ad networks or social pixels, and we do not sell or share your data with data brokers.
[ 01 ]
Strictly necessary
These make the site work: they sign you in, keep the sign-in honest, and remember the choices you made about how the page looks. They are exempt from consent under Article 5(3) of the ePrivacy Directive because the service you asked for cannot be delivered without them — so there is no switch for them, and turning them off means not using the site.
| Name | Type | Set by | What it is for | How long |
|---|---|---|---|---|
| gds_access_token | Local storage | Norba (first party) | The signed-in session itself. Without it every page of the dashboard would ask for the password again. | Until you sign out or 30 days after sign-in, whichever comes first |
| gds_token_expires_at | Local storage | Norba (first party) | When the session stops being valid, so an expired session is dropped before it is ever sent. | Same as the session |
| gds_impersonator_token, gds_impersonated_user | Local storage | Norba (first party) | Present only while a Norba support operator is working inside your account with your knowledge — it parks their own session so they can return to it. A banner is shown for the whole time. | Until the support session ends |
| norba_oauth_state | Session storage | Norba (first party) | A one-time random value that ties a “Sign in with Google” round trip to the tab that started it, so somebody else's sign-in cannot be planted in your browser. | Deleted the moment the sign-in completes; gone when the tab closes |
| norba_consent | Cookie + local storage | Norba (first party) | The record that you have seen this notice, with the date. Without it we would have to show it on every page. | 6 months, then the notice is shown again |
| lang | Cookie | Norba (first party) | The language you picked, so the server renders the first page in it. | 1 year |
| theme | Local storage | Norba (first party) | Light or dark, read before the first paint so the page does not flash the wrong one. | Until you clear it |
| norba_table_view:* | Local storage | Norba (first party) | Which columns, filters and sort order you left a dashboard table in. Layout only — no data from the table. | Until you clear it |
| __stripe_mid, __stripe_sid | Cookie | Stripe Payments Europe, Ltd. | Fraud prevention on the card form. Set by Stripe, and only once you open “Add payment method” on the billing page — Stripe.js is not loaded anywhere else, so these do not exist unless you go there. Card details go straight to Stripe and never touch a Norba server. | 1 year (mid) and 30 minutes (sid), set by Stripe |
- gds_access_token
- The signed-in session itself. Without it every page of the dashboard would ask for the password again.
- Local storage · Norba (first party) · Until you sign out or 30 days after sign-in, whichever comes first
- gds_token_expires_at
- When the session stops being valid, so an expired session is dropped before it is ever sent.
- Local storage · Norba (first party) · Same as the session
- gds_impersonator_token, gds_impersonated_user
- Present only while a Norba support operator is working inside your account with your knowledge — it parks their own session so they can return to it. A banner is shown for the whole time.
- Local storage · Norba (first party) · Until the support session ends
- norba_oauth_state
- A one-time random value that ties a “Sign in with Google” round trip to the tab that started it, so somebody else's sign-in cannot be planted in your browser.
- Session storage · Norba (first party) · Deleted the moment the sign-in completes; gone when the tab closes
- norba_consent
- The record that you have seen this notice, with the date. Without it we would have to show it on every page.
- Cookie + local storage · Norba (first party) · 6 months, then the notice is shown again
- lang
- The language you picked, so the server renders the first page in it.
- Cookie · Norba (first party) · 1 year
- theme
- Light or dark, read before the first paint so the page does not flash the wrong one.
- Local storage · Norba (first party) · Until you clear it
- norba_table_view:*
- Which columns, filters and sort order you left a dashboard table in. Layout only — no data from the table.
- Local storage · Norba (first party) · Until you clear it
- __stripe_mid, __stripe_sid
- Fraud prevention on the card form. Set by Stripe, and only once you open “Add payment method” on the billing page — Stripe.js is not loaded anywhere else, so these do not exist unless you go there. Card details go straight to Stripe and never touch a Norba server.
- Cookie · Stripe Payments Europe, Ltd. · 1 year (mid) and 30 minutes (sid), set by Stripe
[ 02 ]
Service telemetry and session replay
Better Stack's browser tag records page views, timings, JavaScript errors and a masked replay of each session, and we use them to find broken and slow pages and to investigate abuse. None of that is strictly necessary to deliver the site, so under Article 5(3) of the ePrivacy Directive it needs your consent: in the EEA, the UK and Switzerland — and wherever we cannot tell where you are — nothing loads until you press Accept, and you can withdraw at any time from the same panel. Where the law works the other way round, it is on by default and the panel turns it off. Either way it never runs on the dashboard or the sign-in flow.
| Name | Type | Set by | What it is for | How long |
|---|---|---|---|---|
| Better Stack browser tag (b.js) and the storage it creates | Script, cookies and local storage | Better Stack (BetterStack s.r.o.) | Which pages are used and how fast they are, JavaScript errors, and a replay of the interaction with every text node and every input masked before capture. Used to find broken and slow pages and to investigate abuse. In the EEA, the UK and Switzerland it loads only after you accept; elsewhere it runs by default and you can turn it off. Never loaded on the dashboard or the sign-in flow — the pages that handle API keys, tokens and TOTP secrets — whatever you choose. | Set by Better Stack; a session lapses after 30 minutes of inactivity |
- Better Stack browser tag (b.js) and the storage it creates
- Which pages are used and how fast they are, JavaScript errors, and a replay of the interaction with every text node and every input masked before capture. Used to find broken and slow pages and to investigate abuse. In the EEA, the UK and Switzerland it loads only after you accept; elsewhere it runs by default and you can turn it off. Never loaded on the dashboard or the sign-in flow — the pages that handle API keys, tokens and TOTP secrets — whatever you choose.
- Script, cookies and local storage · Better Stack (BetterStack s.r.o.) · Set by Better Stack; a session lapses after 30 minutes of inactivity
[ 03 ]
What we do not do
- No advertising or retargeting cookies, and no ad network of any kind.
- No social-media pixels — no Meta, no LinkedIn Insight, no TikTok, no X.
- No Google Analytics, and no Google Tag Manager.
- No fingerprinting, no cross-site tracking and no data sold or licensed to brokers.
- Fonts are served from our own domain, not fetched from Google Fonts at page load, so reading a page does not tell Google you did.
[ 04 ]
Your controls
The details panel below, also reachable from the “Cookie details” link at the bottom of every page, lists both groups. The notice is shown once per version, and again after six months or whenever what we store changes.
You can clear or block storage in your browser's settings, or block the Better Stack tag with a content blocker. Blocking the strictly necessary group will sign you out and stop the dashboard from working; blocking the telemetry tag does not affect anything you can do on the site.
[ 05 ]
Changes
If we add or change a purpose, we raise the version this page's notice records and show it again rather than treating an old acknowledgement as covering something new. Material changes are also announced by email to account holders.
[ 06 ]
Contact
Questions about anything on this page, including a request to see what Better Stack holds about your sessions: hello@norba.io.