MOIMio

Set up your workspace

Choose your web address and complete a one-time payment to create your workspace.

.moimio.app

Use lowercase letters, numbers, and hyphens.

The name of your church or organisation, shown inside your workspace.

We'll send your workspace link and receipt here.

Payments are securely processed by Paddle. €150 plus VAT gives you one event credit, which covers a single event of up to 300 participants. No subscription. No recurring charges.

30 days to change your mind. See our refund policy.

Legal Notice

Pistio
Sole trader registered in the United Kingdom
Proprietor: Johannes Kim
66 Paul Street
London EC2A 4NA
United Kingdom
Contact: [email protected]

Refund Policy

Last updated: 4 June 2026

This policy explains when a payment for Moimio can be refunded, and how to request a refund. Moimio is operated by Pistio, a sole trader registered in the United Kingdom, of 66 Paul Street, London EC2A 4NA. Payments are handled by Paddle as Merchant of Record, which means Paddle is your contracting party for the purchase and processes any refund.

1. How Moimio is paid for

Moimio Hosted costs €150 for each event, plus any applicable tax, for an event of up to 300 participants. Each €150 payment is an event credit: it lets you run one event. Your first payment creates your account and gives you one event credit; any further payment adds another, and you may hold a small number in advance. Creating an event uses one credit.

2. Your first payment is covered by a 30-day guarantee

Your first payment, the one that creates your account, carries a 30-day money-back guarantee. Within 30 days of that payment you may request a full refund, even if you have already created and run your event. Because this payment is what brought your account into being, refunding it closes your account and erases its data straight away: there is no export period and no reactivation window in this case. You therefore keep either the refund or the data, not both.

3. Later event credits are refundable while unused

Any event credit you buy after the first is refundable in full within 30 days of purchase, for as long as it remains unused. Once you create an event using a credit, that credit is spent and is no longer refundable. You always confirm before a credit is used, so a credit is never spent by accident. Unused credits do not otherwise expire.

4. After 30 days

Once 30 days have passed since a payment, that payment is final and is not refundable, except where applicable law provides otherwise.

5. How to request a refund

Refunds are handled by Paddle, our Merchant of Record. To request one, use the link in your Paddle receipt, or go to paddle.net. You do not request a refund by deleting your account inside Moimio: deleting your account is a separate action with its own data-retention process, described in section 7.

6. Your statutory rights and Paddle’s terms

This policy applies alongside your statutory rights as a consumer, where those apply to you, and alongside Paddle’s Buyer Terms and Conditions and Refund Policy. Where any of these gives you a stronger right, the stronger right applies. Nothing in this policy affects your rights in respect of a product that is faulty, not as described, or not fit for purpose.

7. Refunds and closing your account

A refund of your first payment erases your account immediately, as described in section 2. Closing your account without a refund works differently: nothing is deleted at once. Your account is paused; for 30 days you can download a complete copy of your data through a private link, with no sign-in needed; for 44 days you can reopen the account in one click, with no payment; and only after that is your data erased, backups included. This lifecycle is also summarised on the pricing page and set out in the Data Processing Agreement.

8. Refund abuse

A refund may be declined where there is evidence of fraud, refund abuse, or other manipulative behaviour. This does not affect your rights in respect of a product that is faulty, not as described, or not fit for purpose.

Questions about this policy? Write to [email protected].

Data Processing Agreement

Last updated: 29 June 2026

This Data Processing Agreement (the "DPA") governs how Pistio processes personal data on behalf of organisations using Moimio. It restates and supplements the data processing terms in the Moimio Terms agreed at checkout. If there is any conflict between this DPA and the Moimio Terms in relation to the processing of personal data, this DPA prevails. For most customers the version agreed at checkout is sufficient. A countersigned copy is available to organisations whose own compliance requires a separate signed agreement.

This DPA forms part of the agreement between:

(1) the Customer, the organisation that holds a Moimio account (the "Controller"); and

(2) Pistio, a sole trader established in the United Kingdom, of 66 Paul Street, London EC2A 4NA, registered with the UK Information Commissioner's Office under registration reference ZC158582 (the "Processor"),

and governs the Processor's processing of personal data on the Controller's behalf in connection with the Moimio service.

1. Definitions

1.1 The terms "personal data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in the UK GDPR and the EU GDPR. Where the processing is subject to a law that uses different terms for these concepts, those terms have the corresponding meaning. In particular, "personal data" includes "personal information" as defined under United States state privacy laws, and "controller" and "processor" include "business" and "service provider" or "contractor" as defined under the CCPA.

1.2 "Applicable Data Protection Law" means each data protection law that applies to the processing of personal data under this DPA, which may include: (a) the UK GDPR and the Data Protection Act 2018; (b) the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR"); (c) United States state privacy laws that apply to the Controller or the processing, including the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (the "CCPA"); (d) the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles; and (e) any other data protection law applicable to the processing.

2. Subject matter, nature, and purpose

2.1 The Processor processes personal data on the Controller's behalf solely to provide the Moimio service, namely the registration of event participants and their assignment to rooms, groups, and teams according to the Controller's configuration, and for no other purpose. Processing continues for the duration of the Controller's Moimio account.

3. Categories of data and data subjects

3.1 The categories of personal data and of data subjects are set out in Annex 1.

4. Controller instructions and use limitation

4.1 The Processor processes the personal data only on the Controller's documented instructions, including as set out in this DPA, the Moimio Terms, and the Controller's configuration and use of the software, unless required to process by a law to which the Processor is subject. In that case the Processor informs the Controller of the legal requirement before processing, unless that law prohibits such information.

4.2 The Processor informs the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law.

4.3 The Processor does not use the personal data for its own purposes. The Processor does not retain, use, or disclose the personal data for any purpose other than providing the Moimio service, or outside the direct business relationship between the parties, and does not "sell" or "share" the personal data, in each case within the meaning of the CCPA where it applies. The Processor does not combine the personal data with personal information that it receives from, or on behalf of, any other person, except as permitted by the CCPA.

4.4 The Processor certifies that it understands the restrictions and obligations set out in clauses 4 and 5 and will comply with them.

4.5 The Controller determines whether any special category data is collected through the service, and is responsible for ensuring a valid condition for processing it (for example, a condition under Article 9(2) of the UK GDPR and EU GDPR and, in the United Kingdom, any additional condition required under the Data Protection Act 2018). For the purposes of this clause, special category data also includes "sensitive personal information" under the CCPA and "sensitive information" under the Australian Privacy Act 1988 (Cth). In the Moimio service this typically arises as data concerning health, for example dietary, allergy, accessibility, or medical needs, and may reveal religious or philosophical beliefs. The Processor does not require or solicit such data.

4.6 The Processor processes special category data only on the Controller's documented instructions and only to provide the service, in accordance with clause 4, and applies to it the technical and organisational measures set out in Annex 2.

4.7 Where special category data is "sensitive personal information" under the CCPA, the Processor's retention, use, and disclosure of it are limited as set out in clauses 4 and 5. Where it is "sensitive information" under the Australian Privacy Act, the Processor handles it in a manner consistent with the Australian Privacy Principles to the extent they apply. In each case the Controller remains responsible for the consent or other condition required to collect it.

5. Processor obligations

5.1 The Processor shall:

(a) process the personal data only as set out in clause 4 (Controller instructions and use limitation), and not for its own purposes;

(b) ensure that persons authorised to process the personal data are subject to an appropriate duty of confidentiality, whether contractual or statutory, that continues after their engagement ends, and limit access to the personal data to those persons who need it to provide the service;

(c) implement and maintain the technical and organisational security measures set out in Annex 2, appropriate to the risk presented by the processing, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing;

(d) respect the conditions in clause 6 for engaging subprocessors;

(e) taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, so far as possible, in responding to requests from individuals exercising their rights under Applicable Data Protection Law, including rights of access, rectification or correction, erasure or deletion, restriction, and portability, and, under United States state privacy law, the right to opt out of the sale or sharing of personal information and to limit the use of sensitive personal information; the Processor shall not respond directly to such a request, other than to acknowledge it and direct the individual to the Controller, but shall promptly inform the Controller and assist it in responding;

(f) assist the Controller in ensuring compliance with its obligations relating to security of processing, notification of personal data breaches to supervisory authorities and to affected individuals (including under the UK GDPR and EU GDPR, the Australian Notifiable Data Breaches scheme, and applicable United States state breach-notification laws), data protection impact assessments, and prior consultation with supervisory authorities, taking into account the nature of the processing and the information available to the Processor, and within the time limits the Controller is required to meet;

(g) at the Controller's choice, delete or return the personal data at the end of the provision of the services, and delete existing copies, as described in clause 8;

(h) make available to the Controller the information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits as set out in clause 9;

(i) maintain a record of the categories of processing carried out on behalf of the Controller, as required by Article 30(2) of the UK GDPR and EU GDPR;

(j) provide a level of protection for the personal data at least equivalent to that required of the Controller under Applicable Data Protection Law; in particular, the Processor shall provide the same level of privacy protection for personal information as the CCPA requires of a business, shall handle personal data in a manner consistent with the Australian Privacy Principles to the extent they apply, and shall not act in a way that causes the Controller to breach Applicable Data Protection Law;

(k) notify the Controller without undue delay if the Processor determines that it can no longer meet its obligations under this DPA or under Applicable Data Protection Law; and

(l) on reasonable notice from the Controller, permit and reasonably cooperate with steps the Controller takes to stop and remediate any unauthorised or non-compliant processing of the personal data.

6. Subprocessors

6.1 The Controller grants the Processor general authorisation to engage the subprocessors listed in Annex 3. The Processor keeps Annex 3, or an equivalent list that it makes available to the Controller, up to date.

6.2 The Processor engages only subprocessors that provide sufficient guarantees to implement appropriate technical and organisational measures meeting the requirements of Applicable Data Protection Law.

6.3 The Processor imposes on each subprocessor, by a written contract, data-protection obligations equivalent to those in this DPA, in particular the obligation to implement appropriate technical and organisational measures. Where the personal data is subject to the CCPA, that contract includes the service-provider terms the CCPA requires. Where a subprocessor processes personal data outside the United Kingdom or the EEA, the Processor ensures that an appropriate transfer safeguard is in place as described in clause 10. Where the personal data is subject to the Australian Privacy Act, the Processor takes reasonable steps to ensure the subprocessor handles it consistently with the Australian Privacy Principles.

6.4 The Processor remains fully liable to the Controller for the performance of each subprocessor's data-protection obligations.

6.5 The Processor informs the Controller of any intended addition or replacement of a subprocessor at least 30 days before that subprocessor begins processing the Controller's personal data, by email to the Controller's account contact or by updating the list referred to in clause 6.1, or both.

6.6 The Controller may object to the change on reasonable data-protection grounds within 30 days of being informed. The parties will discuss the objection in good faith. If the Processor cannot reasonably accommodate the objection, for example by offering an alternative, the Controller may terminate the affected part of the service.

7. Personal data breach

7.1 The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's personal data.

7.2 The notification includes, to the extent known to the Processor: the nature of the breach, including where possible the categories and approximate number of data subjects and of records affected; the likely consequences of the breach; and the measures the Processor has taken or proposes to take to address it. Where the Processor cannot provide all of this information at once, it provides it in phases as it becomes available.

7.3 The Processor takes reasonable steps to mitigate the breach, and cooperates with and assists the Controller so that the Controller can meet its own obligations to notify supervisory authorities and affected individuals under Applicable Data Protection Law.

7.4 The Processor does not notify any supervisory authority or data subject about a breach affecting the Controller's personal data in a way that identifies the Controller, without the Controller's prior agreement, unless required to do so by law.

8. Deletion and return

8.1 During the term, the Controller may export or delete its personal data at any time using the features of the service.

8.2 On closure of the account, the Processor makes the Controller's participant data available to the Controller for export for 30 days, through a secure, time-limited link sent to the Controller's account contact. This is the return of the personal data for the purposes of clause 5.1(g).

8.3 If the account is not reactivated, the workspace and all personal data in it are permanently erased within 44 days of closure. This erasure includes the live database, the export bundle, and the entire backup repository for that workspace.

8.4 Where the Controller deletes an individual event rather than closing the account, the live copy is removed promptly, and any copy remaining in routine backups is overwritten as those backups roll off the backup retention window, which is approximately the most recent five weeks (currently seven daily and four weekly snapshots).

8.5 Where a refund is taken in the circumstances described in the Moimio Refund Policy, the account and its personal data are erased immediately rather than after the period in clause 8.3.

8.6 After erasure, the Processor retains only: (a) an opaque record that the workspace existed and has been erased, consisting of its internal identifier and subdomain with personal data removed, kept for integrity and audit; and (b) payment and tax records, which are held by Paddle as Merchant of Record under its own legal obligations and are outside the scope of this clause. The Processor does not otherwise retain the Controller's personal data after erasure except to the extent required by law.

9. Audit

9.1 The Processor makes available to the Controller the information necessary to demonstrate compliance with this DPA.

9.2 The Processor allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller to verify the Processor's compliance with this DPA. Such audits are subject to the following: the Controller gives at least 30 days' written notice, except where an audit is required by a supervisory authority or follows a personal data breach; audits take place during normal business hours and must not unreasonably disrupt the Processor's operations; audits take place no more than once in any 12-month period, except where required by a supervisory authority or following a personal data breach; the Controller and its auditor are bound by confidentiality; and the audit is conducted so as not to access, or compromise the security of, the personal data or systems of any other customer of the Processor.

9.3 The Processor may satisfy an audit request, in whole or in part, by providing its own compliance documentation together with any relevant certifications or independent third-party audit reports held by the Processor or its subprocessors, where these reasonably address the matters the Controller wishes to verify. For personal information subject to the CCPA, any assessment may be carried out at least once in any 12-month period, consistent with the CCPA.

9.4 The Controller bears the reasonable costs of any on-site audit it requests under clause 9.2.

10. International transfers

10.1 Participant data is hosted and processed within the European Union (Germany). The Processor is established in the United Kingdom and accesses the personal data from there to operate and support the service. Personal data therefore moves between the United Kingdom and the European Economic Area. For so long as the European Commission's adequacy decision for the United Kingdom and the United Kingdom's recognition of the EEA remain in force, those flows require no additional safeguard. If either ceases to apply, the parties will put in place an appropriate safeguard permitted by Applicable Data Protection Law, such as the Standard Contractual Clauses or the United Kingdom International Data Transfer Addendum.

10.2 Certain subprocessors listed in Annex 3 process limited personal data outside the United Kingdom and the EEA: Paddle processes billing data in connection with payment (United Kingdom, with processing also in the United States), and Cloudflare provides DNS for the service and hosting for the public website (United States). Participant data is not routed through Cloudflare: the application is not proxied, so participant data in transit passes directly between the user's browser and the European Union host. Where a subprocessor processes personal data outside the United Kingdom or the EEA, that processing is covered by an appropriate transfer safeguard permitted by Applicable Data Protection Law, such as the Standard Contractual Clauses, the United Kingdom International Data Transfer Addendum, or an adequacy or data-privacy-framework mechanism.

10.3 Where the Controller is established outside the United Kingdom and the EEA, for example in the United States or Australia, the Controller's participant data is still hosted in the European Union and accessed from the United Kingdom as set out above, and the Processor processes it under this DPA. For a Controller subject to the Australian Privacy Act, this DPA is the Processor's binding commitment to handle the personal data in a manner consistent with the Australian Privacy Principles to the extent they apply, on which the Controller may rely for the purposes of Australian Privacy Principle 8.

10.4 The Processor does not transfer the personal data to any country that does not ensure an adequate level of protection except under a safeguard permitted by Applicable Data Protection Law.

11. EU and UK representatives

11.1 The Processor is established in the United Kingdom. It is therefore not required to appoint a representative under Article 27 of the UK GDPR.

11.2 Where the Processor is required to designate a representative in the European Union under Article 27 of the EU GDPR, it has appointed the following representative, who may be contacted on any matter relating to the processing of personal data of data subjects in the European Union:

Prighter Group, with its local partners. Data subjects and supervisory authorities may contact the representative via the Trust Center at https://app.prighter.com/portal/12350102426.

11.3 For any other data-protection matter in connection with this agreement, the Controller may contact the Processor at [email protected].

12. Liability

12.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Moimio Terms.

12.2 Nothing in this DPA limits or excludes either party's liability to the extent that it cannot be limited or excluded under Applicable Data Protection Law or other applicable law.

13. Controller indemnity

13.1 The Controller indemnifies the Processor against: (i) claims made by a third party, including a data subject; (ii) reasonable costs and expenses (including reasonable legal fees) of dealing with such claims or with any investigation or enforcement action by a supervisory authority; and (iii) to the extent permitted by law, fines and penalties imposed on the Processor by a supervisory authority, in each case to the extent they arise out of or in connection with:

(a) the absence of, or a defect in, a lawful basis or, where required, a valid condition or consent on which the Controller relies for the personal data or its processing through the service;

(b) personal data uploaded to, or otherwise made available through, the service by or on behalf of the Controller in breach of Applicable Data Protection Law or in infringement of a third party's rights;

(c) an instruction given by the Controller that, when carried out by the Processor, causes the Processor to breach Applicable Data Protection Law, except where the Processor had formed the opinion that the instruction infringed and failed to inform the Controller under clause 4.2; and

(d) the Controller's breach of its own obligations relating to safeguarding or child protection, or to its employment or volunteer relationships, to the extent connected with the personal data or the Controller's use of the service.

13.2 The indemnity in clause 13.1 does not apply to the extent that the relevant loss arises from the Processor's own breach of this DPA or its own negligence.

13.3 As a condition of the indemnity, the Processor shall: (a) notify the Controller promptly on becoming aware of a relevant claim; (b) not admit liability for, settle, or compromise the claim without the Controller's prior written consent, such consent not to be unreasonably withheld or delayed; (c) give the Controller reasonable information and cooperation in relation to the claim, at the Controller's reasonable expense; and (d) take reasonable steps to mitigate its loss. The Controller may, by written notice, assume conduct of the defence and settlement of the claim, provided it does not settle in a manner that imposes any non-indemnified liability or admission on the Processor without the Processor's consent.

14. Governing law and severability

14.1 This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with it, subject to any different provision in the Moimio Terms.

14.2 If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions continue in full effect.

Annex 1: Categories of data and data subjects

Data subjects. The personal data processed under this DPA relates to:

(a) the controller's organising team, namely the account holder and the staff users it authorises to use the workspace;

(b) participants in events organised by the controller, for example attendees of retreats, conferences, or camps; and

(c) other individuals named by a participant during registration, for example a person a participant asks to be grouped with, who may not themselves be registered.

Categories of personal data.

For participants: name; a participant number and a group code linking related registrations; contact details such as email address; gender, where the controller uses it for room or group allocation; language preference; registration status; room, group, team, session, and similar allocation assignments; responses to any custom registration fields the controller defines; colour-coded tags and free-text notes recorded about a participant by the organising team; stated preferences to be grouped with named other people; check-in records; and any other information the controller chooses to enter about a participant.

For the organising team: name; email address; role and permissions; and interface preferences such as language, date format, and timezone.

Special-category and sensitive data. Through custom registration fields, dietary, allergy, accessibility, or medical information, staff tags, and free-text notes, the controller may enter data that is special-category data within the meaning of Article 9 of the UK GDPR and the EU GDPR, in particular data concerning health. Given the nature of the organisations that use Moimio, information entered may also reveal religious or philosophical beliefs. The same information may be "sensitive personal information" under United States state privacy laws such as the CCPA. Moimio does not require or request such data. Whether to collect it, and the lawful basis and any explicit consent or other condition required for it, are the responsibility of the controller.

Annex 2: Security measures

The processor applies the following technical and organisational measures:

  • Hosting within the European Union (Germany).
  • Per-tenant isolation: each controller's workspace runs in its own container with its own separate database, so one controller's data is logically separated from every other controller's data.
  • Encryption of personal data in transit using TLS (HTTPS).
  • Encrypted backups, stored in the European Union (Germany), subject to a defined retention window and to permanent erasure when an account is erased.
  • Restricted administrative access: access to the hosting infrastructure and to the operator console is limited to authorised personnel, protected by two-factor authentication, and reachable only over a private administrative network. Operator actions are recorded in an audit log.
  • Passwordless sign-in: account sign-in uses single-use, time-limited email links, and only a hashed form of each link is stored, never the link itself.
  • Data minimisation in logs: application logs do not contain participant names, postal addresses, dates of birth, or telephone numbers; a small number of operational log entries may contain an email address.

Annex 3: Subprocessors

Subprocessor Role Location
Hetzner Online GmbH Hosting, infrastructure, and encrypted backups Germany (EU)
Scaleway SAS Transactional email delivery France (EU)
Zoho Corporation Limited (United Kingdom) Customer support email inbox European Union
Cloudflare, Inc. DNS for the service; hosting and edge functions for the public website United States (global)

Independent controllers

The company named below processes personal data as an independent controller and therefore does not act as a subprocessor under this DPA.

Company Function
Paddle.com Market Ltd Merchant of Record for payment processing and invoicing; an independent controller for payment and tax data, which it retains under its own legal obligations. Such data is not erased under clause 8.

Processing by this company is governed by its own privacy terms and falls outside the scope of this DPA.

Notes:

  • The Moimio application is not proxied through Cloudflare. Participant data in transit passes directly between the user's browser and the European Union host and does not traverse Cloudflare.
  • The following support the operation of the service but do not process participant personal data: a private administrative network (Tailscale) and uptime monitoring (Healthchecks.io).

A countersigned PDF copy of this agreement is available to customers on request. Write to [email protected].

Subprocessors

Last updated: 28 June 2026

This is the current list of subprocessors Pistio uses to provide Moimio. It is the authoritative version referenced by Annex 3 of the Data Processing Agreement; the two are kept consistent. Paddle acts as an independent controller for payments, not as a subprocessor, and is shown separately below.

SubprocessorRoleLocation
HetznerHosting and infrastructureGermany (EU)
ScalewayTransactional email deliveryEU
ZohoCustomer support email inboxEU
CloudflareDNS, content delivery, website hostingGlobal

Independent controller

Paddle (Paddle.com Market Ltd) acts as Merchant of Record and processes payment and tax data as an independent controller, not as a subprocessor of Pistio.

Questions about this list can be sent to [email protected].

Privacy Policy

Last updated: 3 July 2026

Who we are

Moimio is a service operated by Pistio, a sole trader established in the United Kingdom.

  • Proprietor: Johannes Kim
  • Address: 66 Paul Street, London EC2A 4NA, United Kingdom
  • Contact: [email protected]
  • ICO registration number: ZC158582

In this policy, "we", "us" and "Pistio" mean the data controller named above. "Moimio" means the Moimio website and hosted service ("Moimio Hosted"). "You" means the person whose personal data we process.

Representative in the European Union

We have appointed Prighter Group, with its local partners, as our representative in the European Union under Article 27 of the EU GDPR. If you are in the EU and wish to exercise your rights, or you are a supervisory authority, you can contact our representative through our Trust Center at https://app.prighter.com/portal/12350102426

The two roles we play

Organisations use Moimio to register people for events and to assign them to rooms, groups and teams. Because of this, we handle personal data in two different roles, and your rights depend on which one applies.

As a controller. For the personal data of the person or organisation that registers and pays for a Moimio account, namely the account holder's name, contact details and billing information, we decide why and how the data is processed. We are the data controller, and this policy governs that processing.

As a processor. For the data an account holder enters into their workspace about event participants, such as names, contact details, dietary or accessibility notes where provided, and assignments to rooms, groups or teams, the account holder's organisation is the controller and we act only as a processor on that organisation's documented instructions. If you are a participant in someone's event, the organisation running that event is responsible for your data and for telling you how it is used. Our role as a processor is governed by a Data Processing Agreement, which is incorporated into our Terms, with a separate signable copy available on request.

Where participant data may include children, the account holder's organisation is responsible for ensuring there is an appropriate lawful basis, such as parental consent.

The rest of this policy describes the personal data we process as a controller.

The personal data we collect

When you visit our website. Our servers and our content delivery provider automatically record basic technical information, such as your IP address, browser and device type, the pages you view and the time of your visit. We use privacy-preserving, cookieless analytics, which means we see aggregated visit statistics but do not track you across other sites or build a profile of you.

When you create and use an account. We collect your organisation's name, the account email address and the web address you choose, together with a record of purchases. Payments are handled by our payment provider (see "Who we share data with"); we do not see or store your full card details, only confirmation of whether a payment succeeded.

When you contact us. If you email us, we receive your message and your contact details, and we keep that correspondence so we can respond and maintain a record.

We do not carry out automated decision-making that produces legal or similarly significant effects, and we do not use your data for advertising.

Why we process your data, and our legal bases

We process personal data only where we have a lawful basis under the UK GDPR and the EU GDPR:

  • To provide and operate the service for account holders, including registration, allocation features, billing and support. Legal basis: performance of a contract with you.
  • To keep the service secure, prevent fraud or abuse, and understand how the website is used through aggregated analytics. Legal basis: our legitimate interests in running a safe and reliable service, balanced against your rights.
  • To meet our legal and regulatory obligations, for example keeping tax and accounting records. Legal basis: compliance with a legal obligation.

Where we ask for your consent for a specific purpose, you can withdraw it at any time.

Who we share data with

We use a small number of carefully chosen providers to run Moimio. These act as our processors, handling data only on our instructions, with one exception: our payment provider acts as an independent controller for the payments it handles.

  • Hosting (Hetzner Online GmbH, Germany). Hosts the Moimio Hosted platform and workspace data within the European Union. Backups are also stored within the EU.
  • Email delivery (Scaleway S.A.S, France). Sends transactional emails, such as registration confirmations, from within the European Union.
  • Website delivery, DNS and analytics (Cloudflare, Inc., United States). Delivers and secures our website and provides cookieless analytics.
  • Support mailbox (Zoho Corporation Limited, European Union). Provides the mailbox behind our contact and support addresses, hosted in Zoho's EU data centre.
  • Payments (Paddle.com Market Limited, United Kingdom, and Paddle Payments Limited, Ireland). Paddle is our merchant of record and processes payments as an independent controller. When you buy from us, Paddle collects and handles your payment details under its own privacy policy.

An up-to-date list of our processors is published on our subprocessors page and forms part of our Data Processing Agreement.

International transfers

Most of our providers are based in the European Union or the United Kingdom. Where data is transferred outside the UK or the EEA, for example to Cloudflare in the United States, the transfer is protected by appropriate safeguards, such as the UK International Data Transfer Addendum, Standard Contractual Clauses, or a recognised adequacy framework. You can ask us for more detail using the contact address above.

How we keep your data secure

We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These include encryption in transit, encrypted backups, access controls, and keeping each customer's workspace data separate from that of other customers. The measures that apply when we act as a processor are described in our Data Processing Agreement.

How long we keep your data

Account data is kept while your account is active. When an account is closed, whether at your request or automatically after 24 months without a sign-in, we first pause the workspace. You can download a full export through a private link for 30 days, and reopen the account with one click, at no charge, for 44 days. After 44 days, the workspace and all its data, including backups, are permanently erased. Where an account is heading towards automatic closure, we send three reminders over the preceding three months before the process begins.

Individual events that an account holder deletes are removed from active storage promptly. Copies held in routine backups age out within about five weeks.

Billing and tax records are kept for as long as the law requires, which in the United Kingdom is generally six years.

Support correspondence is kept for as long as needed to deal with your enquiry and to maintain a reasonable record.

System logs and maintenance

For the operation, security and maintenance of Moimio, our systems and those of our providers may record log files that capture interactions with the service, including technical data such as IP addresses. These logs are used to keep the service running, diagnose problems and protect against misuse.

Legal action

We may process personal data where necessary to establish, exercise or defend legal claims, for example in connection with the improper use of the service. We may also be required to disclose personal data in response to a lawful request from a public authority or a court.

Your rights

Under the UK GDPR and the EU GDPR you have the right, within the limits set by law, to:

  • ask for access to the personal data we hold about you;
  • ask us to correct data that is inaccurate or incomplete;
  • ask us to erase your data;
  • ask us to restrict how we process your data;
  • object to processing carried out on the basis of our legitimate interests;
  • ask us to transfer your data to you or another provider in a structured, commonly used, machine-readable format;
  • withdraw your consent at any time, where we rely on consent.

To exercise any of these, contact us at [email protected]. If you are in the EU, you can also reach us through our representative, Prighter (details above). We will respond within one month.

If you are a participant in someone's event and want to exercise your rights, please contact the organisation running that event, as it is the controller of your data. We will support that organisation in responding.

Complaints

If you have a concern about how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to a data protection authority. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk). In the EU you can complain to the supervisory authority in your country.

Changes to this policy

We may update this policy from time to time. The current version is always available here, and the date at the top shows when it last changed. Where a change affects processing based on your consent, we will ask for fresh consent where the law requires it.

Definitions

  • Personal data (or data): any information relating to an identified or identifiable natural person, whether directly, indirectly, or in combination with other information.
  • Usage data: information collected automatically through Moimio or its providers, such as IP addresses, browser and device details, the pages viewed and the time of a visit, and similar technical information.
  • User: any person who uses Moimio.
  • Data subject: the natural person to whom personal data relates. Where this policy says "you", it generally means the data subject.
  • Data controller: the person who, alone or together with others, decides why and how personal data is processed. For the processing described in this policy, the controller is Pistio, referred to as "we" or "us".
  • Data processor: a person who processes personal data on behalf of, and on the documented instructions of, a controller.
  • Cookie: a small set of data stored in a user's browser. A cookie is a type of tracker.
  • Tracker: any technology, such as cookies, unique identifiers, web beacons, embedded scripts or fingerprinting, that allows a user to be tracked, for example by storing or accessing information on the user's device.
  • European Union (or EU): unless stated otherwise, references to the European Union include the current EU member states and the European Economic Area (EEA).
  • UK GDPR and EU GDPR: the United Kingdom and European Union versions of the General Data Protection Regulation, which govern how personal data is processed.

This policy relates only to Moimio, unless stated otherwise within it.

Cookie Policy

Last updated: 3 July 2026

This policy explains the cookies and similar technologies used on the Moimio website (moimio.app) and the hosted Moimio service on its subdomains, operated by Pistio. See our Privacy Policy for who we are and how to contact us.

What cookies are

Cookies are small files that a website stores in your browser. They can be set by the site you are visiting (first-party) or by another service the site uses (third-party). Similar technologies, such as local storage or pixels, work in comparable ways. For simplicity we refer to all of these as cookies.

Our approach

Moimio is built to be privacy-first. We use only cookies that are strictly necessary to deliver and secure the website and the hosted service, together with cookieless analytics. We do not use advertising, marketing or cross-site tracking cookies, and we do not build profiles of visitors.

Because we use only strictly necessary cookies, we are not required to ask for your consent under UK and EU cookie rules (PECR and the ePrivacy Directive). We provide this policy so you can see exactly what is set and why. You can still block or delete cookies through your browser settings at any time, although blocking strictly necessary cookies may stop parts of the site from working.

Cookies we use

Strictly necessary cookies (set by Cloudflare). Our website is delivered and protected by Cloudflare. To do this, Cloudflare may set a security cookie that helps tell genuine visitors apart from automated traffic and keep the site secure. It is not used to track you or to advertise.

  • cf_clearance: set when a Cloudflare security check has been passed, so you are not challenged again on every visit. Duration: up to about one year (set by Cloudflare).

Cookieless analytics (Cloudflare Web Analytics). We measure basic, aggregated website usage using Cloudflare Web Analytics, which does not set cookies and does not track you across other websites.

Payments (Paddle). When you go through checkout to buy a Moimio account, our payment provider Paddle sets cookies that are necessary to process the payment securely. These are set during the payment process under Paddle's own policy.

Signing in to Moimio Hosted. The customer portal and each hosted workspace set first-party cookies when you sign in, so that you stay signed in securely; these last up to a week. If you pick a language on the portal, a small cookie remembers that choice for up to a year. These cookies are necessary to provide what you asked for, are not used for tracking, and expire on their own. The workspace app may also keep minor preferences, such as a dismissed notice, in your browser's local storage; that information stays on your device.

We keep this list accurate to what the site actually sets. If we ever introduce anything that is not strictly necessary, such as third-party analytics or embedded content, we will update this policy and ask for your consent first where the law requires it.

Managing cookies in your browser

Every major browser lets you see, block and delete cookies. You can usually find these controls in the privacy or security settings of Chrome, Firefox, Safari, Edge, Brave or Opera. Their help pages explain the exact steps for your version.

Definitions

  • Personal data (or data): any information relating to an identified or identifiable natural person, whether directly, indirectly, or in combination with other information.
  • Usage data: information collected automatically through Moimio or its providers, such as IP addresses, browser and device details, the pages viewed and the time of a visit, and similar technical information.
  • User: any person who uses Moimio.
  • Data subject: the natural person to whom personal data relates.
  • Data controller: the person who, alone or together with others, decides why and how personal data is processed. For the processing described here, the controller is Pistio.
  • Data processor: a person who processes personal data on behalf of, and on the documented instructions of, a controller.
  • Cookie: a small set of data stored in a user's browser. A cookie is a type of tracker.
  • Tracker: any technology, such as cookies, unique identifiers, web beacons, embedded scripts or fingerprinting, that allows a user to be tracked, for example by storing or accessing information on the user's device.
  • European Union (or EU): unless stated otherwise, references to the European Union include the current EU member states and the European Economic Area (EEA).

This policy relates only to Moimio, unless stated otherwise within it.

Terms of Service

Last updated: 3 July 2026

These Terms of Service ("Terms") govern access to and use of the Moimio website and the hosted Moimio service ("Moimio Hosted"), operated by Pistio.

These Terms form a legally binding agreement between Pistio and the organisation on whose behalf you access or use Moimio Hosted ("you", "your", or "Customer"). By creating an Account, purchasing Credits, or accessing or otherwise using Moimio Hosted, you confirm that you are authorised to accept these Terms on behalf of the Customer and that the Customer agrees to be bound by them. If you are not authorised to do so, or if the Customer does not agree, you must not access or use Moimio Hosted.

Moimio Hosted is offered only to organisations, and to individuals acting on behalf of organisations in the course of their professional, charitable, educational, or other organisational activities. It is not offered to consumers acting in a personal capacity.

1. Who we are

Moimio Hosted is operated by Pistio, a sole trader established in the United Kingdom.

  • Proprietor: Johannes Kim
  • Registered address: 66 Paul Street, London EC2A 4NA, United Kingdom
  • ICO registration number: ZC158582
  • Contact: [email protected]

For data-protection matters, Pistio's representative in the European Union is Prighter Group, with its local partners, contactable at https://app.prighter.com/portal/12350102426. How Pistio handles personal data is described in the Privacy Policy at https://moimio.app/en/legal/privacy/.

2. Definitions

  • "Moimio" means the Moimio website and hosted service.
  • "Moimio Hosted" means the hosted version of Moimio that Pistio operates and makes available to you, including its workspace and any tenant subdomain.
  • "Community Edition" means the separate, open-source edition of Moimio that Pistio publishes for self-hosting, licensed under the MIT licence. The Community Edition is not covered by these Terms.
  • "Account" means the workspace and login created for your organisation on Moimio Hosted.
  • "Event" means a single event workspace within your Account, run using one Credit.
  • "Credit" means a prepaid entitlement to run one Event.
  • "Participant" means an individual whose data you enter into Moimio Hosted for the purpose of an Event.
  • "Participant Data" means personal data relating to Participants that you provide or generate through Moimio Hosted.
  • "Paddle" means Paddle.com Market Limited and Paddle Payments Limited, which act as the Merchant of Record for purchases, as described in section 8.

3. The service

Moimio Hosted helps your organisation allocate Participants to groups for an Event. Pistio provides Moimio Hosted on a hosted basis, including a workspace for your Account and, where applicable, a subdomain.

Pistio may improve, change, add to, or remove features of Moimio Hosted from time to time. Where a change is material and within Pistio's reasonable control, Pistio will give you reasonable notice. Pistio may also make experimental or "beta" features available; these are provided on an "as is" basis, may change or be withdrawn at any time, and should not be relied on.

Community Edition. These Terms cover Moimio Hosted only. The Community Edition is a separate product that Pistio publishes for organisations that prefer to host Moimio themselves. It is licensed under the MIT licence, and that licence alone governs its use. These Terms grant you no rights in the Community Edition and place no obligations on your use of it, and the hosting, availability, support, and other commitments in these Terms do not apply to it.

4. The allocation engine

Moimio Hosted includes an allocation feature that proposes how to assign Participants to groups for an Event, based on the rules, criteria, and data that you configure and provide.

You understand and agree that:

  • the allocation feature carries out the rules you set and uses the data you provide; it does not exercise judgement of its own;
  • you are responsible for reviewing, adjusting, and approving any proposed allocation before you rely on or act on it;
  • Pistio does not decide, check, or take responsibility for whether an allocation is appropriate in the real world. This includes who is placed with whom and any safeguarding, child-protection, accessibility, medical, dietary, or similar considerations. Those decisions are yours; and
  • Pistio remains responsible for defects in the allocation software itself, meaning a failure of the software to carry out your configured rules correctly, subject to the rest of these Terms.

5. No professional advice

Moimio Hosted is an administrative tool. It does not provide legal, safeguarding or child-protection, medical or health, dietary, accessibility, insurance, or other professional advice, and nothing it produces should be treated as such. You are responsible for obtaining your own professional advice where you need it, and for any decision you make using Moimio Hosted. This matters in particular where an Event involves children or vulnerable people, where responsibility for safeguarding and for meeting any legal requirements remains with you.

6. Eligibility and authority

Moimio Hosted is for organisations. By using it you confirm that you are using it for an organisation, that you are authorised to act for that organisation, and that the individuals you allow to use your Account are authorised to do so. You are responsible for their use of Moimio Hosted as if it were your own.

7. Accounts and security

You must provide accurate account information and keep it up to date. You are responsible for keeping your login credentials secure and for all activity under your Account. Tell us promptly at [email protected] if you believe your Account has been accessed without authorisation.

8. Fees, payment, and credits

Access to run Events is sold as prepaid Credits. The price is EUR 150 per Event, exclusive of tax; applicable value added tax or equivalent is added at checkout. There is no subscription and no recurring charge.

Purchases are processed by Paddle, which acts as the Merchant of Record and as the reseller of the Credits. This means Paddle, and not Pistio, is your counterparty for the payment transaction, and Paddle handles billing, payment methods, and applicable taxes. Paddle's own terms and privacy notice apply to the payment. Pistio provides Moimio Hosted itself.

You may hold up to three unused Credits on your Account at any time. Credits do not expire while your Account remains active, subject to section 18 (dormancy). Prices may change; any change applies only to future purchases and never to Credits you have already bought.

Moimio Hosted applies a guideline capacity of 300 Participants per Event. This is a soft limit intended to keep Events running smoothly; it is not a hard block, and Pistio will not use it to interrupt an Event that is already under way.

9. Refunds

Refunds are governed by the Refund Policy at https://moimio.app/en/legal/refund/, which forms part of these Terms. In summary, and subject to that policy: your first, account-creating purchase carries a 30-day money-back guarantee even if you have already run the Event, but taking that refund closes your Account and erases its data immediately, without an export or reactivation period; later Credits are refundable only while they remain unused, and a Credit that has been used to run an Event is final. Refund periods run from the date of payment. Refunds are processed by Paddle as Merchant of Record. If the Refund Policy and these Terms conflict, the Refund Policy governs for refunds.

10. Your data and data protection

You control the Participant Data you put into Moimio Hosted. As between you and Pistio, you are the controller of Participant Data and Pistio is a processor acting on your documented instructions. Pistio's processing of Participant Data on your behalf is governed by the Data Processing Agreement at https://moimio.app/en/legal/dpa/, which is incorporated into these Terms by reference. Pistio maintains appropriate technical and organisational measures to protect Participant Data, as described in that agreement. The subprocessors Pistio uses are listed at https://moimio.app/en/legal/subprocessors/.

You are responsible for having a lawful basis to process the Participant Data you provide, for giving Participants any information required by data-protection law, and for obtaining any consents that are required. Where an Event involves individuals who are minors under applicable law, you are responsible for ensuring that the relevant lawful basis and any parental or guardian consents are in place. Pistio handles personal data for which it is itself the controller, such as your account and billing data, as described in the Privacy Policy.

11. Data export and retention

While your Account is active, you can export your Participant Data using the features Pistio provides. After your Account is closed, Pistio makes your data available for export for a limited period and then deletes it, on the timescales set out in the Privacy Policy at https://moimio.app/en/legal/privacy/ and, for Participant Data, in the Data Processing Agreement at https://moimio.app/en/legal/dpa/. Because taking a refund on your first, account-creating purchase closes your Account and erases its data immediately, no export period applies in that case; see the Refund Policy.

12. Acceptable use

You agree not to, and not to allow anyone to:

  • use Moimio Hosted for any unlawful purpose, or to process data you have no lawful basis to process;
  • upload or handle content that is unlawful, or that infringes or misuses the rights of others;
  • use Moimio Hosted in any way that could harm a Participant, in particular a Participant who is a minor;
  • attempt to gain unauthorised access to Moimio Hosted, to other customers' data, or to the systems that run it, or to probe, scan, or test their security without authorisation;
  • interfere with or disrupt the integrity or performance of Moimio Hosted;
  • resell, sublicense, or make Moimio Hosted available to third parties as a service, or copy or create derivative works of it, except as expressly permitted; or
  • use Moimio Hosted to build a competing product.

If you want to host Moimio yourself, the Community Edition is available for that purpose under its own licence.

13. Your responsibilities

You are responsible for your lawful use of Moimio Hosted, for the accuracy of the Participant Data you enter, for obtaining any consents that your use requires, and for keeping your own records as your organisation needs them. You confirm that neither you nor anyone you allow to use your Account is subject to applicable sanctions, and you will not use Moimio Hosted in breach of any export-control or sanctions laws.

14. Availability and support

Pistio will provide Moimio Hosted with reasonable skill and care. Beyond that, Moimio Hosted is provided on an "as is" and "as available" basis. Pistio aims to keep it available and working well, but does not commit to any particular level of uptime, and may carry out maintenance, which it will try to schedule to limit disruption. Support is provided on a reasonable-efforts basis by email at [email protected].

15. Intellectual property

Pistio and its licensors own Moimio Hosted, including its software, design, and the Moimio name and logo. Subject to your compliance with these Terms, Pistio grants you a non-exclusive, non-transferable right to use Moimio Hosted for your organisation's internal purposes during the term of these Terms. No other rights are granted by implication.

You own your Participant Data and the other content you put into Moimio Hosted. You grant Pistio the limited right to host, process, and use that content only as needed to provide Moimio Hosted and as set out in the Data Processing Agreement.

The Community Edition is a separate product licensed under the MIT licence; nothing in these Terms limits or replaces that licence, and these Terms grant you no rights in the Community Edition's source code.

If a third party claims that Moimio Hosted infringes its intellectual property rights, Pistio may, at its option, modify or replace the affected functionality so that it no longer infringes, or withdraw it and refund any prepaid, unused Credits that relate to it. This sets out Pistio's response to such a claim and does not give you a separate indemnity.

If you send Pistio feedback or suggestions, you allow Pistio to use them without restriction and without any obligation to you.

16. Confidentiality

Each party may receive information from the other that is not public and should reasonably be treated as confidential. Each party will use the other's confidential information only to perform under these Terms and will protect it with reasonable care. This does not apply to information that is or becomes public through no fault of the receiving party, that the receiving party already had, or that it develops independently, and it does not prevent a disclosure required by law. These obligations continue for as long as the information remains confidential, including after these Terms end.

17. Warranties and disclaimers

Except for the obligation to provide Moimio Hosted with reasonable skill and care in section 14, and to the extent permitted by law, Moimio Hosted is provided without warranties of any kind, whether express or implied, including any implied warranties of satisfactory quality, fitness for a particular purpose, or non-infringement. Moimio Hosted is a tool to help you run Events; it is not a substitute for your own legal, data-protection, or safeguarding compliance, which remains your responsibility. This section does not exclude any warranty or right that cannot be excluded by law.

18. Suspension and dormancy

Pistio may suspend or limit your access to Moimio Hosted if it reasonably believes you are in breach of these Terms, if your use puts Moimio Hosted, its systems, or other customers at risk, or if required by law. Pistio may suspend access immediately and without prior notice where it reasonably believes this is necessary to deal with illegal content, a security threat, or a legal or law-enforcement requirement. For other suspensions, Pistio will give you notice and an opportunity to resolve the issue where practicable and lawful. Where reasonably practicable, Pistio will restore your access once the reason for the suspension has been resolved.

If an Account is inactive for a continuous period of 24 months, Pistio may pause it. Data retention, export, and deletion timescales are described in the Privacy Policy and, for Participant Data, in the Data Processing Agreement.

19. Termination

You may stop using Moimio Hosted and close your Account at any time. Either party may terminate these Terms if the other is in material breach and does not remedy it within a reasonable time after notice.

On termination, your right to use Moimio Hosted ends. The handling of your data after termination, including any export window and the timing of deletion, follows section 11, the Privacy Policy, and the Data Processing Agreement. The treatment of any unused Credits on termination follows the Refund Policy. Sections that by their nature should survive termination will survive, including sections 9, 10, 11, 15, 16, 17, 20, 21, 24, and 25.

20. Limitation of liability

Nothing in these Terms limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited or excluded by law. Nothing in these Terms limits any statutory rights that Participants or other data subjects have under data-protection law.

Subject to the paragraph above, Pistio will not be liable for indirect or consequential loss, for loss of profits, revenue, business, goodwill, or anticipated savings, for business interruption, or for loss of or damage to data to the extent it results from your failure to keep your own records or backups.

Subject to the first paragraph of this section, Pistio's total liability arising out of or in connection with these Terms and Moimio Hosted, whether in contract, tort, or otherwise, is limited in aggregate to the total fees you paid for Moimio Hosted in the 12 months before the event giving rise to the liability.

21. Indemnity

You will indemnify Pistio against reasonable losses, damages, and costs it incurs arising from your breach of these Terms, from your unlawful use of Moimio Hosted, or from your processing of Participant Data without a lawful basis or in breach of data-protection law. Pistio will notify you of any claim, will not settle it without consulting you, and will let you take part in the defence.

22. Changes to these Terms

Pistio may update these Terms from time to time. If a change is material, Pistio will give you reasonable notice, for example by email or through Moimio Hosted, before it takes effect. If you continue to use Moimio Hosted after a change takes effect, you accept the updated Terms. If you do not accept a change, you should stop using Moimio Hosted; the Refund Policy governs any refund of unused Credits.

23. Force majeure

Neither party is liable for any failure or delay in performing its obligations, other than an obligation to pay amounts already due, that is caused by events beyond its reasonable control. These include failures or outages of hosting, cloud, payment, connectivity, or DNS providers, cyber attacks such as denial-of-service attacks, power or internet failures, acts of government or regulators including sanctions, epidemics and pandemics, natural disasters, fire, flood, war, terrorism, and civil unrest. The affected party will take reasonable steps to limit the effect. If an event beyond reasonable control continues for more than 30 days, either party may terminate these Terms on notice.

24. General

  • Entire agreement. These Terms, together with the Refund Policy, the Data Processing Agreement, and the Privacy Policy, are the entire agreement between you and Pistio about Moimio Hosted and replace any earlier understanding on that subject. You acknowledge that you have not relied on any statement or representation that is not set out in these Terms. Nothing in this clause limits any liability for fraud or fraudulent misrepresentation.
  • Order of precedence. If there is a conflict, the Data Processing Agreement governs for the processing of Participant Data, and the Refund Policy governs for refunds; otherwise these Terms govern.
  • No waiver. A failure to enforce a provision is not a waiver of it.
  • Severability. If a provision is found unenforceable, the rest remain in effect.
  • Assignment. You may not assign these Terms without Pistio's consent. Pistio may assign or transfer them in connection with a reorganisation or transfer of its business, on notice to you.
  • No third-party rights. No one other than you and Pistio has any right to enforce these Terms.
  • Notices. Pistio will send notices to the contact details on your Account; you can reach Pistio at [email protected]. You agree that electronic communications satisfy any legal requirement for notices to be in writing, where the law allows.
  • Language. These Terms are written in English. If Pistio provides a translation and there is a conflict, the English version governs.

25. Governing law and jurisdiction

These Terms and any dispute or claim arising out of or in connection with them are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

26. Contact

Questions about these Terms can be sent to [email protected], or by post to Pistio, 66 Paul Street, London EC2A 4NA, United Kingdom.