Privacy Policy

NORBA TRAVEL OÜ — a private limited company registered in the Estonian Business Register under registry code 17597060, with its registered address at Tornimäe tn 5, 10145 Tallinn, Estonia, trading as Norba ("we", "us") — is the data controller for the personal data described here. This policy covers everything we operate:

• norba.io and app.norba.io — the public site and the dashboard, where travel businesses get API keys, watch their usage and manage billing.
• booking.norba.io — the traveller-facing booking site, where flights are searched, booked and paid for.
• The Norba Travel apps for Android and iOS — the same booking service on a phone. The apps talk to booking.norba.io's servers, so everything said here about the booking site applies to them too.
• api.norba.io — the NDC aggregation API itself, called by our customers' software.

For anything in this policy — a question, a request to exercise a right, or a vulnerability report — write to hello@norba.io. It reaches a person, not a queue.

When one of our API customers uses Norba inside their own product, THEY decide what to collect from their users and why: for that data we act as their processor, under clause 6 of our Terms of Service and the Data Processing Agreement, and their own privacy notice governs. This policy describes what we do as controller — for our own account holders and for travellers who book on booking.norba.io or in our apps.

If you book for other people, please show them this policy: we process their details as it describes.

Account data. Your email address, your name if you give one, your profile picture URL if you sign in with Google, your chosen language, and the state of your two-factor authentication. Passwords are never stored — only a bcrypt hash, from which the password cannot be recovered.

If you sign in with Google. We ask Google for exactly three scopes — openid, email and profile — and receive your Google account identifier, your email address and whether Google has verified it, your name and your picture. Nothing else, and we never gain access to your Gmail, Drive, Calendar or contacts.

Traveller and booking data (booking.norba.io and the apps). To issue a ticket an airline requires the passenger's name, date of birth, nationality, travel-document type and number, and a contact email and phone. We collect exactly that, plus the itinerary and the order record the airline returns, and any seat, bag or other extra you choose. If you save traveller profiles to your account, the same details are kept until you delete them. In our order and saved-traveller records, names, dates of birth, documents and contact details are encrypted field by field with AES-256-GCM under keys held outside the database. Two other records can hold them without that field-level encryption: the airline's answer to a booking, which we keep so that a repeated request returns the same booking instead of booking twice, and the schedule-change notices an airline sends us about a booking. The rest of an itinerary — routes, times, prices, status — is stored in the clear so the database can index and total it. Each booking also records the version of the booking terms accepted at checkout and when, with or without an account, and the language its emails are sent in.

Payment data — what an agency pays us. We never see or store the card an agency pays our invoices with. Those details are entered directly into Stripe's own hosted field on our page and go from your browser to Stripe; our servers receive a token and the last four digits, which is all a receipt needs.

Payment data — paying an airline for a flight. On booking.norba.io and in our apps, if you choose to pay now, your card details pass through our servers only for the time it takes to send them to the airline, which is the one that charges the card; they are never written to a database, a log or a backup. API agencies pay the airline with their own card in the same way, and their travellers' cards never reach us: the traveller pays the agency, on the agency's own checkout. We ask for the fewest fields that will complete a payment, and we never take card details by email, chat, a support ticket or the telephone.

Searches. Each search on booking.norba.io or in our apps is recorded with the route, dates and passengers (their number and ages, and any frequent-flyer programme you enter), the IP address and the browser or app it came from, the channel (web, iOS or Android), your account if you are signed in, and a pseudonymous visitor code our server derives from your IP address and browser user agent, so that searches from the same browser or app can be counted together whether or not you are signed in. We use these records to measure which searches lead to bookings and to improve the service. Searches made through the API by our customers are recorded the same way, with the customer's account and key.

Campaign details. When you open booking.norba.io from a link, the tab reads the page you landed on, the site that sent you (its address without any query) and, if the link had them, its campaign parameters (UTM (Urchin Tracking Module) source, medium, campaign, term and content) and advertising click identifier. Nothing of this is stored in your browser: it is sent with the searches and bookings you make in that tab and kept with those search and booking records. We use it only to count which links and campaigns lead to bookings; it goes to no advertiser or other third party.

API usage and request logs. For every call to api.norba.io: the endpoint, the time, the response code, how long it took, the request id, the calling IP address and user agent, and — for the account's own calls — the request and response bodies, so a developer can debug what their integration actually sent. Whole route families are excluded from that body capture: booking, traveller, sign-in and account endpoints never have their bodies stored, which is why neither a card nor a passenger's document can reach these logs. What is captured is redacted as well, key by key, at any depth.

Security events. Sign-ins and failed sign-ins, second-factor changes, API-key creation and revocation, password resets and rate-limit trips, each with the IP address and user agent. You can read your own feed in the dashboard under Settings, and on the booking site under Account → Security; that is why it exists.

Sessions. For each active session: a device name derived from the user agent, the IP it started from, when it started and when it was last used — so you can spot one you do not recognise and end it. When you sign in to the dashboard, your browser also sends a device signature computed from its characteristics (user agent, language, screen size, platform and number of processor cores), kept with the session so that a sign-in from a device we have not seen before can be recognised.

Emails we send. Account verification, password resets, security alerts such as a sign-in from a new device, booking confirmations, notices of an airline's schedule changes, and the billing and team emails a dashboard account needs. Agency accounts also receive service notices about the service they use and, unless they refuse them, commercial emails about our own similar services (clause 3). We keep an encrypted copy of each email — recipient and content — as the record of what was sent.

Support. If you open a support ticket from the dashboard, we keep your name, your email address, what you write and any file you attach. Our team answers tickets in Linear, so the ticket is copied there too. If you write to us from Help on booking.norba.io or in the apps, we keep your name, email address, the booking reference if you give one, the topic and your message, and send them by email to Norba support, which answers you by email; you receive an acknowledgement with a reference.

Go-live review. If your business asks for production access, the company details, incorporation and tax documents, the name and contact details of the person who signs, and their signature on the production agreement.

Discount coupons. Which coupon an account claimed, and the order it was used on.

Job applications. If you apply through norba.io/company/careers: your name, email address and phone, the profile links and note you give us, your CV (stored encrypted), and the IP address and browser you applied from.

Early-access signups. If you put your address in the waitlist form, it is emailed to our own inbox through our email system, which keeps an encrypted copy of that message like any other it sends.

On your phone. The apps keep your sign-in, your language and theme, your last few searches, the last email address you used and the references of bookings you made without an account, so you can open them again. That stays on the device.

Service telemetry on norba.io. With your consent only, Better Stack records page views, timings, errors and a masked replay of sessions on norba.io so we can find broken and slow pages and investigate abuse. It is not loaded on the dashboard, the sign-in flow or the documentation, and if it runs in a browser where you are signed in, the session is tagged with your internal account id — never your email or name. booking.norba.io and the apps run no telemetry of this kind. See clause 9 and the Cookie Policy.

Error reports. When the booking site, the dashboard or one of the apps hits an error, it sends us a short report: the page or screen, the site or app version, the device model and operating system, the browser or app identifier, and the error text with where in the code it happened. It is not meant to contain personal data, is not linked to your account and goes to no one else. We use it only to find and fix faults.

We do not ask for special-category data — nothing about health, religion, politics or ethnicity. Some airline extras, such as a special meal or assistance at the airport, can reveal that kind of information; if you choose one, it is sent to the airline only so that it can provide it, and we do not use it for anything else.

Under Article 6 of the GDPR, each purpose rests on one of these:

• Performance of a contract, Art. 6(1)(b) — running your account, authenticating you, serving API calls, searching for and booking flights, passing the passengers' details and, when you pay now, the card to the airline, sending booking and schedule-change emails, applying coupons, answering the support tickets and Help messages you send, and invoicing what you used. Without this data there is no service to provide.
• Steps before a contract, Art. 6(1)(b), and legitimate interests, Art. 6(1)(f) — the go-live review, because the airlines require us to know the agencies that book with them; and job applications, to assess the application you sent us.
• Legitimate interests, Art. 6(1)(f) — security event logging, brute-force lockouts, recognising new devices and alerting you to them, rate limiting, fraud prevention and keeping the platform available; keeping the request logs, search records and airline answers as the record of what was billed and booked; measuring which searches and campaigns lead to bookings so we can improve the service; and error reports, so the sites and apps keep working. Our interest is a service that is not abused, that can account for what it did, and that gets better; the data involved is what those purposes need, and you can object (clause 7).
• Consent, Art. 6(1)(a) — the browser telemetry and masked session replay on norba.io, which we ask every visitor for. Refusing costs you nothing, and you can withdraw it from the cookie panel at any time.
• Performance of a contract, Art. 6(1)(b), and legitimate interests, Art. 6(1)(f) — service notices to agency accounts about the service they use: new airlines, API changes, maintenance, pricing or terms changes, support hours. They cannot be switched off while the account is open.
• Our existing customer relationship, with legitimate interests, Art. 6(1)(f) — commercial emails to agency users about Norba's own similar services, such as news and events, as the Estonian Information Society Services Act §103¹(3) and Art. 13(2) of the ePrivacy Directive allow. You can refuse them when you sign up, in Settings → Commercial emails, and from the link in every one of them, at no cost.
• Consent, Art. 6(1)(a) — any other marketing email. Never assumed, never bundled with anything else, and withdrawable at any moment without losing access to anything.
• Legal obligation, Art. 6(1)(c) — the invoices and accounting records we are required to keep, and answering requests from authorities that the law obliges us to answer.

We do not sell personal data, we do not share it with data brokers, and we run no advertising. Data reaches the following parties and no others:

• Airlines and their NDC distribution platforms — to search for and book the flight you asked for. Today these are American Airlines, Air France and KLM, and Aegean and Olympic Air; American Airlines, Aegean and Olympic Air are reached through Accelya's Farelogix platform. A carrier receives the passenger details it needs to issue the ticket and, when you pay now, the card it charges, and becomes a controller of that booking in its own right, under its own privacy notice and its conditions of carriage. This is unavoidable: a ticket cannot exist without the airline holding the passenger's name and document.
• Render Services, Inc. (San Francisco, United States) — hosting for the API, the websites and the database. Our instances run in Render's Frankfurt region, so the data rests in the EU.
• Cloudflare, Inc. (San Francisco, United States) — network security and delivery in front of the API and the booking site, which the apps also use. It processes that traffic in transit, including IP addresses, the details of a booking and the card details sent to pay for it.
• Resend, operated by Plus Five Five, Inc. (San Francisco, United States) — delivery of the emails described in clause 2. It sees the recipient address and the message, and stores its email records in the United States.
• Linear Orbit, Inc. (San Francisco, United States) — the tool our team answers support tickets in. It holds the requester's name and email address, what they wrote and the files they attached. When your account or your agency is erased, the copy of your tickets in Linear is anonymised too: your name, email address, messages and the links to your files are removed, and an erased agency's tickets are deleted there.
• Stripe Payments Europe, Limited (Dublin, Ireland) — card payments and stored payment methods for what agencies pay us. Stripe is the controller of the card data it collects, under its own policy.
• Better Stack, Inc. (United States) — server logs, uptime monitoring, and, with your consent, the service telemetry and masked session replay on norba.io described in the Cookie Policy.
• Google — only if you choose "Sign in with Google", for that sign-in: the sign-in service is run by Google LLC (Mountain View, United States), and for people in the EEA Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible for their Google account. Your Google profile picture is then loaded from Google's servers when we show it. Google also distributes our Android app through Google Play.
• Apple — distributes our iOS app through the App Store, for people in the EEA through Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). The apps contain no analytics, advertising or crash-reporting code from Apple, Google or anyone else, and send them nothing; their error reports (clause 2) come only to us.
• Professional advisers, and authorities where we are legally compelled — in which case we tell you unless the law forbids it.

Render, Cloudflare, Resend, Linear and Better Stack process personal data only on our instructions, as our processors; the Sub-processors page lists them with where each one is and the safeguard for any transfer. The airlines, Stripe, Google and Apple are independent controllers for the parts described.

Our servers and database are in the EU (Frankfurt). Some providers are established outside the EEA or have parent companies that are:

• Render is a US company; the personal data itself stays in its Frankfurt region. Any access to it from the United States rests on the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which Render is certified, with the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in Render's data processing addendum as the fallback.
• Cloudflare, Inc. and Plus Five Five, Inc. (Resend) are established in the United States, so using them transfers personal data there. Both are certified under the EU–US Data Privacy Framework, so the transfer rests on the Commission's adequacy decision for it, with the Standard Contractual Clauses in their data processing terms as the fallback.
• Stripe contracts through its Irish entity, Stripe Payments Europe, Limited. Its onward transfers to Stripe, LLC in the United States rest on the EU–US Data Privacy Framework, under which Stripe, LLC is certified, and otherwise on the Standard Contractual Clauses.
• Linear Orbit, Inc. and Better Stack, Inc. are established in the United States and are not certified under the EU–US Data Privacy Framework, so transfers to them rest on the Standard Contractual Clauses in their data processing agreements.
• Google, for sign-in only: Google LLC is certified under the EU–US Data Privacy Framework, and Google relies on the Standard Contractual Clauses where no adequacy decision applies.
• Airlines are worldwide by nature. Where you book a flight with a carrier or to a country outside the EEA — an American Airlines flight, for example — the passenger data necessarily reaches carriers, their distribution platforms and authorities there; that transfer is necessary for the performance of the contract you asked us to make, under Art. 49(1)(b).

You can ask us at hello@norba.io for a copy of the safeguards a transfer relies on, with commercial terms removed.

We keep our records for as long as the law allows, because they are the proof of what was requested, booked, notified and attempted, and what lets us keep the platform secure and answer a claim. We remove personal data where the law requires it: when an account is erased, when a business's service ends, when the retention period of a booking's passengers ends, and when a person makes a justified request for erasure or objection. Amounts are never removed. This is the schedule:

The server logs held by our log provider (clause 4) carry a client's address only as its network — its first three blocks — and no query strings.

Keeping a record for as long as an account exists does not take away your rights: you can object to it (Art. 21) or ask for its erasure (Art. 17) at hello@norba.io, and we assess each request on its merits. Where you book through a business that uses our API, that business sets the retention period for its passengers, and the Data Processing Agreement says what happens when its service ends. See the next clause.

You can ask us to: give you a copy of your data (Art. 15); correct it (Art. 16); delete it (Art. 17); restrict what we do with it (Art. 18); hand it over in a portable format (Art. 20); or stop processing based on legitimate interests (Art. 21) — including the use of your searches to measure the service. Where processing rests on consent, you can withdraw it at any time, with no effect on what was lawful before you did.

Write to hello@norba.io. We reply within one month, and we do not charge for it. We may ask you to confirm you control the account's email address — not as an obstacle, but because handing an account's data to whoever asks is itself a breach.

Much of this needs no request at all: the dashboard, the booking site and the apps let you edit your profile, list and revoke your active sessions, see your own security events, delete your saved traveller profiles and delete your account yourself.

A copy of your data (Arts. 15 and 20) is a download: everything we hold about your account — profile, sign-in methods, sessions, security events, saved travellers with their passport details, bookings made while signed in, coupons, invoices, support tickets and the emails we sent you — as one machine-readable JSON file, with what we store encrypted opened for you. In the dashboard it is under Settings; on the booking site under Account → Security, which also serves an account you use in the apps. We ask for your password first and allow three downloads a day, and we email you each time one is made.

You can also delete a booking-site or app account without signing in: at booking.norba.io/help/delete-account, enter its email address and confirm from the link we send there. It is the same deletion as from inside the account — closed at once, recoverable for 30 days if you did not ask for it, then erased.

If you think we have got this wrong, you can complain to a supervisory authority. Because we are established in Estonia, our lead authority is the Estonian Data Protection Inspectorate — Andmekaitse Inspektsioon, www.aki.ee. You may equally complain to the authority where you live: in Spain that is the Agencia Española de Protección de Datos (www.aepd.es). We would rather you told us first — hello@norba.io — but that is your choice, not a precondition.

Concretely, and only what is actually in place:

• Passwords hashed with bcrypt. Passenger names, dates of birth, travel documents and contact details encrypted field by field with AES-256-GCM in our order and saved-traveller records, under keys the database does not hold (clause 2 names the two records that are not).
• Optional two-factor authentication (TOTP) with single-use recovery codes.
• Sessions scoped to one surface: a booking-site session is refused on the developer API and vice versa, so a token taken from one product cannot be spent in the other.
• Row-level security in the database, so one agency's rows are unreachable from another's connection even if a query forgets to filter.
• TLS everywhere; a strict Content-Security-Policy on both sites, so injected script does not run; API keys stored hashed, revealable only after re-entering your password, and never during a support session.
• The card an agency pays us with goes to Stripe and never touches our servers. A card sent to pay an airline — by an agency through the API, or by you on booking.norba.io or in the apps — passes through our servers only for the life of that request, is forwarded to the carrier, and is never stored.

No system is perfect. If a personal data breach occurs, we notify the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to anyone (Art. 33), and where it is likely to result in a high risk to you, we tell you directly and without undue delay (Art. 34). How we handle vulnerability reports is on our Security and responsible disclosure page.

Every cookie, local-storage and session-storage item norba.io and app.norba.io set is listed — by name, purpose, provider and lifetime — in the Cookie Policy; booking.norba.io has its own list at booking.norba.io/legal/cookies. Only one group, on norba.io, is optional; it is off until you switch it on, and refusing it costs you nothing. The apps use no cookies or trackers; what they keep on your phone is described in clause 2.

We make no automated decision that produces a legal effect for you or similarly significantly affects you, within the meaning of Art. 22. Two things are automated and worth naming anyway: a temporary lockout after repeated failed sign-ins, and rate limits on sign-in and unauthenticated endpoints. Both are reversible, neither profiles you, and a human will lift either on request.

Our accounts are not for children: you must be 16 or older, or of the age of digital consent in your country, to create one. A child can of course be a passenger on a booking an adult makes, in which case the adult provides their details and is responsible for doing so. If you believe a child has created an account, tell us at hello@norba.io and we will remove it.

We update this policy when what we do changes — not the other way round. Material changes are emailed to account holders and posted here at least 14 days before they take effect, and a change that adds a purpose relying on consent means we ask again rather than reading your old answer as covering it.

The controller of everything described here is NORBA TRAVEL OÜ, registry code 17597060 in the Estonian Business Register, VAT number EE103029739, registered address Tornimäe tn 5, 10145 Tallinn, Estonia.

One address for all of it — privacy enquiries, rights requests, security reports and everything else: hello@norba.io. We are a small team and we read it. The Legal Notice gives the rest of the company's details.