Terms of Service

Norba is a service operated by NORBA TRAVEL OÜ, a private limited company (osaühing) registered in the Estonian Business Register under registry code 17597060, with its registered address at Tornimäe tn 5, 10145 Tallinn, Estonia, and VAT number EE103029739 ("Norba", "we", "us"). Where these terms say "we", they mean that company: it is the party you are contracting with, whichever part below applies to you.

These terms cover everything Norba operates. They are in two parts, because two very different relationships are involved and conflating them would leave both unclear:

• Part A — clauses 2 to 13 — the agreement between Norba and a business using the API and the dashboard at app.norba.io and api.norba.io, including the data-processing terms for the traveller data it sends us (clause 6).
• Part B — clauses 14 to 19 — the terms for a traveller searching for or booking a flight on booking.norba.io or in the Norba Travel apps for Android and iOS.

Clauses 20 onward apply to both. By using any of these, you accept the parts that apply to you; if you do not accept them, do not use the service.

A business that takes its keys to production also signs the Norba Production Agreement, and that document governs the production relationship: where it and these terms disagree, it wins, and everything it does not cover stays here.

How we handle personal data is in the Privacy Policy; what we store in your browser is in the Cookie Policy. Both are part of these terms by reference. Every document mentioned here is listed in the Legal centre.

Norba is an NDC aggregation API. It calls airlines' own distribution interfaces, normalises what comes back into one canonical schema, and lets your software search, price, book and service flights through a single REST contract rather than one integration per carrier.

We are an intermediary, not a carrier. We do not operate aircraft, we do not set fares, and we do not own the inventory: every offer, price, rule and seat comes from an airline and is subject to that airline's own terms. Where an airline's answer is wrong, late or unavailable, that is what our API will report.

We are not the seller either. Where a business sells through us, that business is the one its traveller buys from, and the contract of carriage is between that traveller and the airline. What we operate is the technology between the two — clauses 5 to 7 set out what follows from that, including who controls the traveller's data and whose money goes where.

The service is in beta. Endpoints, response shapes and error codes can change; breaking changes are announced in advance where we can, and never silently.

An account is for one business, and the person creating it warrants they may bind it.

• API keys are credentials. Keep them secret, out of client-side code and out of version control; anything done with your key is treated as done by you.
• Keys belong to the business behind the account, not to the person who created them. Anyone the account lets manage keys can create, rotate, restrict and revoke them, and the business answers for what is done with each of them.
• There is one kind of key in two environments. A sandbox key reaches the airlines' test systems; a production key reaches live systems. To get one, file a go-live request from the dashboard: your company details, your incorporation and tax documents, and your signature on the production agreement as it currently stands. We review what you filed, and your sandbox keeps working throughout and afterwards.
• When we materially rewrite the production agreement, the signatures given for the older wording stop being the agreement in force and we ask you to sign the current text. The earlier acceptance is kept, not deleted: it is the record of what was agreed on the day it was agreed.
• Do not share a key with a party that is not covered by your agreement with us. If you need to give a third party access, ask us and get a key of their own.
• Rotate a key you suspect has leaked — you can do that yourself in the dashboard, and revocation is immediate.
• Revoking, rotating, restricting or expiring a key is your decision and takes effect at once for every system still using it. Requests refused for that reason are not a failure of the service; check what depends on a key before you revoke it.
• We may revoke a key without notice where it is being used in breach of these terms, is implicated in an incident, or is generating traffic that threatens the platform or a carrier's tolerance of it. We tell you as soon as we have.
• Enable two-factor authentication. We may require it for accounts holding production keys.

You must not:

• Send abusive, fraudulent or unlawful requests to airlines through us — including speculative bookings, fictitious names, or holds you have no intention of paying for. Airlines police this, and the consequence lands on the platform as a whole.
• Scrape, mirror or resell airline content in breach of the carrier agreements the offers reach you under, or build a fare-comparison database out of responses obtained for booking.
• Exceed a rate limit deliberately, run load tests against production without agreeing them with us first, or attempt to circumvent quotas or the look-to-book ratios airlines hold us to.
• Resell or white-label API access without a written agreement with Norba.
• Interfere with the availability or integrity of the service, or attempt to reach data belonging to another account.
• Use the sandbox to serve real customers, or production to run tests.

Security research is welcome and is not a breach of this clause when it is confined to your own account and reported to hello@norba.io before disclosure, under the rules on our Security and responsible disclosure page. Please do not test against carrier production systems.

The Acceptable Use Policy explains these rules with examples. Where it and this clause differ, this clause prevails.

When you use our API to serve your own users, you are the one facing them, and you take on what that means:

• You are the seller of record. The traveller buys from you, on your terms, at a total you set, and the flight itself is flown by the airline under its own conditions of carriage. We are not a party to that sale and we are not your traveller's travel agency.
• You collect the traveller's money yourself, on your own checkout and through your own payment provider, and you keep it. It does not reach us — clause 7 says which money does.
• Show the traveller what each part of the price is: the airline's fare and the taxes and charges as the airline stated them, your own service fee as yours, and our fee, where you choose to pass it on, labelled as ours. Never as a tax, a surcharge or part of the fare.
• You are the controller of your users' personal data and need your own lawful basis and privacy notice; we act as your processor for it, on the terms of clause 6.
• You must show your users the airline's fare rules, baggage terms and conditions of carriage that our responses carry — not a summary of your own that contradicts them.
• You must not present a held, unpaid reservation as a confirmed ticket. See clause 15; the distinction matters as much in your product as in ours.
• You are responsible for your own consumer, tax and travel-agency obligations in the markets you sell in, including any IATA accreditation or licence your model requires.

This clause is the contract between you and us that Article 28(3) of the GDPR requires. It covers the personal data of travellers and of their contacts that you send us to search, book, ticket and service flights and to be notified about them. For that data you are the controller and we are your processor. It is published as part of these terms, so it binds both of us whether or not you have also signed the Norba Production Agreement. The Data Processing Agreement sets out the same terms in full, with the security measures as an annex, and is part of this clause.

• Subject matter and duration: the booking services in Part A, for as long as your account is open, and afterwards until the data is deleted or returned as described below.
• Nature and purpose: searching, pricing, booking, ticketing and servicing flights with the airlines you choose, sending the notifications you set up, and keeping the records of those operations.
• Types of data: passenger identity (names, date of birth, gender, nationality), travel documents, contact details, itineraries, frequent-flyer numbers and special service requests; and the payment card you send with a booking, which is passed to the airline for that transaction and never stored.
• Data subjects: your travellers and the contacts you give for them.
• Instructions: we process this data only on your documented instructions — these terms and the API calls you make — including with regard to transfers to a third country, unless EU or Member State law requires otherwise, in which case we tell you before processing unless that law forbids it. If we believe an instruction infringes data-protection law, we tell you.
• Confidentiality: everyone at Norba with access to this data is bound by confidentiality.
• Security: we apply the technical and organisational measures described in clause 8 of the Privacy Policy.
• Sub-processors: you authorise us to use Render Services, Inc. (hosting and database, Frankfurt region), Cloudflare, Inc. (network security and delivery), Plus Five Five, Inc., which operates Resend (transactional email), Better Stack, Inc. (logs and monitoring), Linear Orbit, Inc. (support tickets, for what you send to support) and the airline distribution platforms a booking requires, such as Accelya's Farelogix platform. The airlines themselves receive passenger data as independent controllers. We tell you by email at least 30 days before we add or replace a sub-processor; you may object, and if we cannot meet the objection you may end the affected service. We impose on each sub-processor the same data-protection obligations as this clause. The list in force, with where each provider is and the safeguard for any transfer, is on the Sub-processors page.
• Assistance: we help you answer requests from the people the data is about, and meet your obligations under Articles 32 to 36 of the GDPR, as far as the nature of the processing and the information available to us allow.
• Breaches: we tell you of a personal-data breach affecting this data without undue delay, and within 48 hours of becoming aware of it, with the information we have at the time.
• Retention, deletion and return: passenger identity on your orders is anonymised after the retention period you set for your agency — by default 1,095 days after the order's last date — and the airline's answers and notifications about that order with it; the other records of what you requested and booked are kept while your account is open. When the service ends we keep the data for 180 days so it can be returned to you, then delete it, except what the law requires us to keep, such as invoices. Clause 11 of the Data Processing Agreement sets this out in full.
• Audits: we make available the information needed to show that we meet this clause, and allow audits, including inspections, by you or an auditor you appoint, on 30 days' notice and no more than once a year unless there has been a breach.
• International transfers: where a sub-processor is established outside the EEA, the transfer relies on the safeguards set out in clause 5 of the Privacy Policy and on the Sub-processors page.

What we invoice you is our own service fees, and nothing else. They are the fees set out on the Pricing page or in your written agreement; we do not restate a rate in these terms, because rates change and a figure written into a contract outlives the price it described. What is fixed here is the mechanism: usage is metered from the request log described in the Privacy Policy, together with the bookings, extras and servicing operations you made, calculated monthly and invoiced in arrears. A booking is charged from the moment it is created, a hold that is not yet paid included; the servicing fee is charged once for each post-sale operation that succeeds, and paying a hold carries no further fee; and a booking cancelled within 24 hours of its creation costs nothing, every fee on it credited. Our own invoices are paid by card through Stripe; we never receive that card number.

The money that pays for the flight never passes through us. The traveller pays you the whole price you quoted, on your own checkout. You then pay the carrier: the payment method you submit with a booking — normally a card of your own — is transmitted to that carrier for that one transaction, and the carrier authorises it, captures it and issues the ticket. We do not receive, hold, settle or forward either amount. We are not the merchant of record for anything a traveller pays, we hold no traveller funds and no funds of yours, and nothing in these terms makes us a payment service.

Payment credentials reach us only inside a booking request, and only to be passed to the carrier. We do not store the card number, and we ask for the fewest fields that will complete the transaction: the security code is optional and should be sent only where the carrier you are booking requires one, and the result of an authentication you carried out yourself may travel with it where the carrier accepts one. We will not take card details by email, chat, a support ticket or the telephone.

One charge depends on how you search rather than on what you sell, so it is described here even though rates are not. Every airline caps, in its own contract with us, how many searches it will serve for each booking made — its look-to-book ratio. While your ratio with a given airline is above what that airline allows, each request you send to THAT airline carries an excess look-to-book charge on top of the call, at the rate on the Pricing page. It applies only to the airline you are over with and never to the others; it is not applied until you have made enough searches with that airline for the ratio to mean anything, so a new integration is not charged while it is being built; and it stops by itself as soon as the ratio returns inside the limit — a booking on that airline recalculates it immediately. We do not refuse or throttle your searches for being over a ratio. You can see your ratio, the limit and what has been charged, per airline, in your dashboard.

The free requests on a self-serve account are granted once, for the life of the account — 500 of them, every request counted — and they do not renew each month. They need a verified email address. A transfer of an agency's ownership does not grant new ones: the new owner takes over those the account has left, and the previous owner keeps none. Once they are used, every billable request needs a payment method on file; on a self-serve plan, creating a booking needs one from the start, even while free requests remain; and an Enterprise agreement may set its own payment terms. Without the payment method a request needs, the API refuses it until you add a card.

By adding a card you authorise us to charge it automatically, through Stripe, at each monthly close for the fees of that month, and to retry a charge the card declines, once a day and up to ten times. A month whose fees come to less than €0.50 is not charged. While a charge stays unpaid, or once we have told you an account is overdue, we may refuse billable requests and new bookings until it is paid. Where your written agreement with us sets other payment terms, those apply instead.

Raise a disputed charge within 30 days of the invoice date at hello@norba.io; we will not refuse service over anything that is genuinely in dispute while we look at it.

Fees are exclusive of VAT and any other applicable tax, which is added where due.

We may change prices with at least 30 days' notice by email. A price change never applies to a period already invoiced.

We aim high, but during beta there is no contractual uptime commitment and no service-credit scheme; any status information we publish is informational and does not create one. Planned maintenance is announced in advance where possible.

A significant part of what can go wrong is not ours: an airline's endpoint can be down, slow, or return a fare it then refuses to honour. We report what the carrier tells us. We are not liable for losses arising from a carrier's failure, from a fare an airline withdraws, or from downtime of the airline systems we depend on.

The API, its documentation and the canonical schema are ours. You get a non-exclusive, revocable right to call the API and to use the schema in your own integration for as long as your account is in good standing — nothing more, and nothing exclusive.

Your application code, your data and your users remain yours. We claim no rights in them, and nothing here licenses us to use your data beyond providing the service.

Airline content — fares, schedules, marketing text, logos — belongs to the airlines. Your right to use it comes from them, through the distribution agreements the offers arrive under, not from us.

Each side will keep the other's non-public technical and commercial information confidential and use it only to perform these terms. This does not cover information that is already public, independently developed, or that the law compels one of us to disclose.

To the extent the law allows, the service is provided without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty that it will be uninterrupted, error-free, or that any particular airline will remain reachable through it.

Neither side is liable for indirect or consequential loss, lost profit, lost revenue or lost data. To the maximum extent permitted by law, our total liability for all claims arising in any twelve-month period is limited to the fees you paid us in the three months before the event giving rise to the first of those claims.

Nothing here excludes liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded — including a consumer's non-waivable rights under Part B.

You may close your account at any time; fees already accrued remain due. We may suspend or terminate access for a material breach of these terms, for non-payment after notice, or where continuing would put the platform or a carrier relationship at risk. Where the breach can be fixed, we tell you what it is and give you a reasonable chance to fix it first — unless the risk is immediate.

On termination your keys stop working, outstanding fees fall due, and your data is handled as the Privacy Policy describes. Reservations already made with an airline are unaffected by the end of your Norba account: they are between the traveller and the carrier.

booking.norba.io and the Norba Travel apps for Android and iOS let you search flights from the airlines connected to the Norba platform and book one of them, paying now or holding it to pay later. They are operated by NORBA TRAVEL OÜ, registry code 17597060, Tornimäe tn 5, 10145 Tallinn, Estonia, and that company is the one you deal with here. Norba is an intermediary: the flight is performed by the airline, under that airline's conditions of carriage and fare rules, and the airline — not Norba — is your carrier.

What you book here is a flight, with the extras you add to it from the same airline — or, on a self-transfer trip, two or more such flights from different airlines, each on its own ticket (clause 15). Norba sells flights only, and a combination of flights is a single type of travel service, so Norba does not sell package travel or linked travel arrangements within the meaning of Directive (EU) 2015/2302, and the protections of that Directive, including its insolvency protection, do not apply to a booking made here. The Traveller information page explains your rights as an air passenger and how search results are ranked.

You may use the site and the apps to make a genuine reservation for yourself or for someone whose details you are entitled to provide. Speculative or fictitious reservations are not permitted; airlines treat them as abuse and they can lead to the booking being cancelled. The Acceptable Use Policy gives examples.

Read this clause before you rely on a booking. When you book, you choose one of two options, and the page shows which one you are confirming:

• Pay now. Your card details are sent, through our servers and without being stored, to the airline, which charges your card and issues the ticket. The amount on the "Pay" button is the total for the flight and the extras you chose; we add no service fee of our own. Your ticket numbers appear in your booking once the airline has issued them. If the airline refuses the payment, no ticket is issued.
• Hold and pay later. We send the airline your itinerary and passenger details, and the airline holds the seats and the price until its own payment deadline, which the confirmation shows. Nothing is charged. A hold is not a ticket and does not entitle you to travel: you can pay it from Manage booking (Trips, in the apps) before the deadline, and if it is not paid by then the airline releases the seats at no cost to you.

Until a ticket is issued, the airline may reprice or withdraw the fare. If the price changes before you pay, we show you the new price and you have to accept it before anything is charged.

We will not describe a hold as a confirmed purchase, and neither should anyone reselling this flow. If any page here has left you unsure whether you have bought a ticket, tell us at hello@norba.io — that is a defect and we want to know.

Self-transfer trips. Some results combine flights from different airlines that do not sell them together; they are marked as self-transfer before you book, and you book them only after accepting that:

• Each flight is a separate ticket and a separate contract of carriage with its own airline. Each airline charges its own ticket, so a paid trip shows one card charge per airline.
• You make the connection on your own. It is at the same airport and the trip leaves at least 3 hours for it; you collect and check in your bags again where needed, go through security and any passport or border control, and hold the documents the connection country requires.
• If a delay or cancellation of an earlier flight makes you miss a later one, the airline of the later flight does not have to carry you or rebook you, and Norba does not rebook you either. What happens to that ticket is set by its own fare rules. Your rights against the airline of the delayed or cancelled flight, for that flight, are unaffected.
• We book all the tickets of a self-transfer trip or none of them: every flight is held first, and if any airline cannot confirm its flight, or refuses its payment, we release or cancel the others before the trip is confirmed.

Names must match the traveller's passport or ID exactly. Airlines charge for corrections and some refuse them outright, in which case the fare is lost; that is the carrier's rule, not ours.

You are responsible for holding the passport, visa, transit permission, and any health or entry documentation your itinerary requires, for every passenger, including infants. Requirements change without notice, depend on nationality and can differ for a connection you never leave the airport on. Check with the airline and the authorities of every country on your route. We do not verify them and cannot be liable for a refusal to board or to enter.

Give a contact email and phone you will actually read. Airlines send schedule changes, cancellations and check-in information to them directly.

The European Commission publishes the EU Air Safety List — the airlines banned from operating in the EU or allowed to do so only under restrictions — at https://transport.ec.europa.eu/transport-themes/eu-air-safety-list_en.

What can be changed or refunded, and at what cost, is fixed by the fare rules of the ticket the airline issues — not by us. Where the site or the apps show those rules, they come from the airline's own response.

An unpaid hold needs no cancellation: leave it unpaid and it lapses. Once the airline has issued a ticket, you can ask for a change or a cancellation from Manage booking (Trips, in the apps) where the airline offers it there; what it costs and what comes back are set by the fare rules and shown to you before you confirm. Anything the airline does not offer there goes through the airline itself.

On a self-transfer trip, each ticket is changed, cancelled and refunded on its own, under its own airline's fare rules; changing or cancelling one does not change or cancel the others.

Where an airline cancels or significantly delays a flight departing from the EU, or arriving in the EU on an EU carrier, Regulation (EC) 261/2004 may give you a right to rerouting, reimbursement and compensation. That claim lies against the operating carrier. We will give you the booking records you need to make it — ask at hello@norba.io. The Traveller information page summarises these rights.

There is no 14-day right of withdrawal for flights, or for the seats, bags and other extras bought with them: passenger transport services are excluded from it by Article 3(3)(k) of Directive 2011/83/EU, and the national laws that transpose the Directive exclude them in the same way — in Estonia the Law of Obligations Act (võlaõigusseadus), and for a consumer living in Spain, Spanish consumer law. So a flight booking cannot be cancelled simply because you changed your mind — only on the terms of the fare rules shown before you book.

This does not affect the rights you have when something goes wrong: a cancelled flight, a service not provided as described, or a fault on our side.

Write to hello@norba.io and we will answer. If your complaint is about the flight itself — a delay, a cancellation, baggage — it must be made to the operating airline, which is the party with the obligation; we will help you reach them and provide your booking records.

We reply to a consumer's complaint in writing within 15 days. If we do not resolve it, you can take it, free of charge, to the Estonian Consumer Disputes Committee (Tarbijavaidluste komisjon, komisjon.ee), the out-of-court body for consumer disputes with traders established in Estonia, or ask the European Consumer Centre in your country for help. If the operating airline does not resolve a complaint about the flight, you can take it to the national enforcement body for air passenger rights of the country the flight departed from — in Spain, AESA (Agencia Estatal de Seguridad Aérea); in Estonia, the TTJA. The Complaints procedure sets out the whole procedure. You keep every right your national consumer law gives you, whatever else these terms say.

The Privacy Policy explains what we collect, why, who else sees it, how long it is kept, and how to exercise your rights. On the booking site and in the Norba Travel apps we are the controller of your booking data. Where you reach a Norba-powered booking flow inside somebody else's product, that business is the controller and we are its processor, on the terms of clause 6.

Airlines receive passenger data because a ticket cannot be issued without it, and become controllers of that data themselves. That is inherent to buying a flight from anyone.

We may update these terms. A material change is emailed to every account holder and posted here at least 14 days before it takes effect for an account that already exists; a new account accepts the version in force on the day it is opened. Each version is named by its effective date; Part A and Part B each carry their own, both shown at the top of this page, and every account records the version it accepted. For a traveller, the version in force is the one shown when the reservation was made. Continuing to use the service after a change takes effect is acceptance of it; if you would rather not accept, stop using the service and, for an API account, close it — clause 13 says what happens then.

The version effective on 18 October 2026 replaces the version of 17 October 2026. It makes these terms governed by Estonian law, with disputes heard by the courts of Tallinn (clause 22); it adds our registered address and VAT number (clauses 1 and 23); and it names the company behind each sub-processor (clause 6). For an account opened before 18 October 2026, it takes effect 14 days after the email that announces it, and until then the version of 17 October 2026 applies to that account.

The version of Part B effective on 24 October 2026 replaces, for travellers, the version of 18 October 2026. It adds self-transfer trips: flights from different airlines on separate tickets, with the connection made by the traveller (clauses 14, 15 and 17). Part A and clauses 20 onward are unchanged, so for an API account the version of 18 October 2026 stays in force. A reservation made before 24 October 2026 keeps the version shown when it was made.

These terms, and any non-contractual obligation arising out of or in connection with them, are governed by the law of the Republic of Estonia, without regard to its conflict-of-law rules.

If you use the service as a business — Part A, and any booking made for the purposes of a trade, business or profession — Harju County Court (Harju Maakohus) in Tallinn, Estonia, has exclusive jurisdiction over any dispute arising out of or in connection with these terms.

If you are a consumer — a traveller booking for purposes outside any trade, business or profession — the choice of Estonian law does not deprive you of the protection of the provisions that cannot be derogated from by agreement under the law of the country where you have your habitual residence (Article 6(2) of Regulation (EC) No 593/2008, Rome I); for a consumer living in Spain, that includes the protection of Spanish consumer law. You may bring proceedings against us either in the courts of Estonia or in the courts of the place where you are domiciled, and we may bring proceedings against you only in the courts of the country where you are domiciled (Article 18 of Regulation (EU) No 1215/2012, Brussels I bis). The out-of-court routes in clause 19 remain open to you.

If any clause turns out to be unenforceable, the rest stands.

The company behind Norba:

• Legal name: NORBA TRAVEL OÜ
• Registry code: 17597060 (Estonian Business Register)
• Legal form: osaühing — private limited company, incorporated in Estonia
• Registered address: Tornimäe tn 5, 10145 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia
• VAT number: EE103029739
• Websites: norba.io, app.norba.io, booking.norba.io, api.norba.io
• Apps: Norba Travel for Android and iOS

One address for everything — commercial questions, privacy and data rights, security reports: hello@norba.io. It is also our single point of contact under the Digital Services Act; the Legal Notice gives the rest of the provider information.