Subprocessors.
34 providersData is stored in Stockholm, Sweden (EU/EEA)Version 2.38 · 25 October 2026
Who we share information with, what they do for us, and where the data is processed. The list is the same as in the privacy policy.
Processed in the EU/EEAAlso processed outside the EU/EEA
Hosting and storage 2
- Amazon Web Services (AWS)EU (Stockholm, eu-north-1)
Servers, file storage (S3), CDN, inbound email and background jobs.
Data processorAll use- Information
- Everything you store in the service: profile, trips, photos, documents and logs.
- MongoDB AtlasEU
Primary database for account, trip and content data.
Data processorAll use- Information
- Profile, trips, chat, recommendations, document metadata and settings.
Artificial intelligence 11
- DeepSeekOutside the EU/EEA
Noma – travel assistant, plan suggestions, journal drafts and categorisation.
Data processorWhen you use the feature- Information
- Messages you write to Noma, trip context (destination, dates, plans) and image descriptions. Text from travel documents you upload, without national ID numbers, account numbers or the machine-readable zone of passports. The description of bank transactions from Tink, without account and card numbers and never person-to-person transfers. First name and age group (children: age) of the participants in the trip. Your home city and country. The latest messages in the trip’s Noma channel, also from the others in the trip, and the first name of whoever is responsible for a task. When the question is about them: the address of the accommodation, booking references from the trip documents and your location, rounded to about 100 metres.
- OpenAIOutside the EU/EEA
Supplementary text generation in some AI features.
Data processorWhen you use the feature- Information
- Text prompts and trip context.
- Google Cloud VisionOutside the EU/EEA
Automatic photo moderation, text recognition (OCR) in travel documents and caption suggestions.
Data processorWhen you use the feature- Information
- Image content and document scans you upload.
- Alibaba Cloud Model Studio (Qwen)Outside the EU/EEA
Image understanding: moderation and description of photos, images and documents you send to Noma, and fallback for video analysis.
Data processorWhen you use the feature- Information
- Image content and videos you ask Noma to analyse. Identifiers such as passport numbers are removed before analysis.
- Google Gemini APIOutside the EU/EEA
Watches travel videos you share with Noma (picture, audio and on-screen text) to find places and tips.
Data processorWhen you use the feature- Information
- The video link, its title and description, and anonymised comments. Not used to train Google’s models.
- YouTube Data APIOutside the EU/EEA
Fetches title, description and public comments for YouTube videos you share with Noma.
Data processorWhen you use the feature- Information
- The video ID. No information about you is sent.
- ScrapeCreatorsOutside the EU/EEA
Fetches the public caption, transcript, comments and video stream for TikTok, Instagram and Facebook links you share with Noma.
Data processorWhen the feature is enabled- Information
- Only the link to the public post. No information about you is sent.
- Google Cloud TranslationOutside the EU/EEA
Translating content inside the app.
Data processorWhen you use the feature- Information
- The text being translated.
- Microsoft Azure SpeechEU
Reading out phrasebook entries and Noma replies (text to speech).
Data processorWhen you use the feature- Information
- The text being read aloud.
- ElevenLabsOutside the EU/EEA
Voice conversations with Noma: turns speech into text, runs the conversation and answers with a synthetic voice. ElevenLabs uses a language model from its own sub-processor for the conversation.
Data processorWhen you use the feature- Information
- Microphone audio while the conversation is running, what is said, your first name and trip context (trip name, cities and dates). We turn off audio recording at ElevenLabs.
- Anthropic (Claude)Outside the EU/EEA (stored in the USA)
Travel advice in the country check: searches the web, official sources first, for entry, health and safety advice and other things you need to know about the destination. “The area”: a guide to the neighbourhood you stay in.
Data processorWhen you use the feature- Information
- The country you live in, the destination (country and city), today’s date, how many days the trip lasts and your language. For “The area” only the neighbourhood your accommodation is in, the city and the country, never the address, and your search term when you search for something there. Never your name, email or anything else that identifies you. Not used to train Anthropic’s models.
Maps, places and weather 9
- MapboxOutside the EU/EEA
Map rendering, place search and route calculation.
Data processorWhen you use the feature- Information
- Coordinates and search terms. We block Mapbox telemetry inside the app.
- Google Places / Maps PlatformOutside the EU/EEA
Place details, opening hours and geocoding for the trip planner.
Data processorWhen you use the feature- Information
- Search terms and coordinates. Not linked to your Google account.
- Nominatim / OpenStreetMapEU
Geocoding and lookup of addresses and place names.
Data processorWhen you use the feature- Information
- Search terms and coordinates.
- OpenFreeMap (Hyperknot Software Kft.)EU
Map tiles (OpenStreetMap data) for the From → To map in the travel book.
Data processorWhen you use the feature- Information
- Your IP address and the map area you view, when you open the map in the Book Studio. For printing only the map area. Access logs are anonymised and deleted after 7 days. May pass through Cloudflare.
- Amazon Web Services: Terrain Tiles (AWS Open Data)Outside the EU/EEA
Elevation data that gives the landscape colour and relief on the maps in the travel book.
Data processorWhen you use the feature- Information
- Your IP address and the map area you view, when you open the maps in the Book Studio. For printing only the map area.
- BRouter (brouter.de)EU
The railway on the From → To map in the travel book when you have chosen train (OpenStreetMap data).
Data processorWhen you use the feature- Information
- Only the coordinates of the two places. The request comes from our server, so BRouter does not see your IP address.
- MET Norway / Open-MeteoEU
Weather forecasts and climate data for your destinations.
Data processorWhen you use the feature- Information
- Destination coordinates. No user identifier is sent.
- AeroDataBox (RapidAPI), AirLabs og AvinorOutside the EU/EEA
Flight status in Noma Live and the Noma chat: delays, gate and baggage belt.
Data processorWhen you use the feature- Information
- Flight number and date. Nothing about who is asking.
- Foursquare, Yelp, Ticketmaster, Songkick og EventbriteOutside the EU/EEA
Places and events in older Noma suggestions, only when the service is enabled in the environment.
Data processorWhen the feature is enabled- Information
- Search terms and city. Nothing about who is asking.
Payments and banking 2
- StripeEU and USA
Subscriptions, printed travel book purchases and payouts to local guides (Stripe Connect and Financial Connections).
Data processorWhen you use the feature- Information
- Name, email, payment metadata and – for guides – bank and identity data that Stripe handles directly.
- TinkEU
Fetches bank transactions for the travel budget when you connect your bank yourself.
Data processorWhen you use the feature- Information
- Transactions (amount, date, description) and account references.
Analytics and diagnostics 2
- PostHog (EU Cloud)EU (Frankfurt)
Product analytics, session replay, error tracking and feature flags.
Data processorAll use- Information
- Usage patterns, page views, device and browser info, error messages and a pseudonymous user ID. To monitor Noma’s quality: the questions you ask Noma and Noma’s answers (from the AI model and from the trip data), which may contain trip details and first names in your travel group. Text from documents and attachments you upload is not sent.
- Umami CloudEU
Simple, cookie-free traffic statistics.
Data processorAll use- Information
- Page views, referrer and coarse device info. No cookies and no personal profile.
Email and communication 2
- Email provider (SMTP)EU
Sending confirmations, invitations and notifications.
Data processorAll use- Information
- Email address, name and the contents of the notification.
- Amazon SES (inbox for travel documents)EU
Receives email you forward to your trip’s own address so bookings are imported automatically.
Data processorWhen you use the feature- Information
- The full email with attachments, including booking and passenger details.
Booking and travel partners 6
- DuffelEU and the United Kingdom
Flight booking directly in the app.
Independent controllerWhen the feature is enabled- Information
- Passenger name, date of birth, gender, contact details and itinerary.
- HotelbedsEU
Accommodation search and booking.
Independent controllerWhen the feature is enabled- Information
- Guest name, contact details and booking details.
- Booking.comEU
Accommodation search and booking. The search field in “Find a place to stay” is Booking.com’s own, loaded in a frame inside the app; the booking itself happens at Booking.com.
Independent controllerWhen you use the feature- Information
- The destination, dates and number of travellers you search with, IP address and browser information. Anything you enter at Booking.com is covered by their own privacy policy.
- CJ Affiliate (Commission Junction)Outside the EU/EEA
The affiliate network that measures that the click came from NomadMapper, so we can receive commission for the referral.
Independent controllerWhen you use the feature- Information
- IP address, browser information, which page you were forwarded to, and a placement code identifying where in the app you clicked. No names, email addresses or trip content.
- Viator, Travelpayouts/Aviasales, VIP Cars, Airalo, Saily, NordVPN, AirHelpVaries by partner
Affiliate and referral partners. You complete the purchase with the partner, who is then an independent controller.
Independent controllerWhen you use the feature- Information
- Search parameters passed along in the link. Anything you enter on the partner’s site is covered by their own privacy policy.
- GelatoEU
Printing and shipping physical travel books and postcards.
Data processorWhen you use the feature- Information
- Delivery address, recipient name and the contents of the product you order.
