Privacy & legal
Collecting attendee data means being able to say what you collect, why, who processes it and for how long — and being able to prove what each person agreed to. Privacy & Legal keeps your event's legal documents in one place with a version number on every published copy, and keeps an audit trail of consent that you can export when a regulator, a sponsor's legal team or an attendee asks.
How it works
Open Settings → Privacy & Legal. The screen has three tabs: Documents, Audit & Reports and Cookie consent. Consent statements are listed on the Consent Collection tab of Experience rules.
Documents Three cards — Privacy Policy, Terms & Conditions and Data Processing Agreement (DPA) — each showing its status (Not Set, Generated, Uploaded or Published) and version.
Generate Builds a document from a template using what you enter: organization and event name, data controller, contact email, the data you collect, the processors you use (payments, email, SMS, analytics), the retention period and the jurisdiction. You can preview it before publishing.
Upload Register your own lawyer's document instead: a PDF, DOCX or TXT file up to 10 MB. See What works today below.
Publish Makes the document the active version and increases its version number. Publishing the Privacy Policy or Terms & Conditions also asks every attendee to read and accept that version before they can enter the event app — including people who accepted an earlier one. The confirmation says so before you publish. The DPA is never shown to attendees.
Audit & Reports Every consent record — attendee, document, whether consent was Accepted or Withdrawn, timestamp, IP address and document version — filterable by action and date range and exportable as CSV or Excel.
Cookie consent Whether visitors to your event pages are asked for cookie consent, and every place on the event that makes them: the Google Analytics 4 connector, a Custom HTML section, or an embed from a service that sets its own cookies (Loom, Wistia, Google Drive/Docs/Slides, Canva, SlideShare, Office) on a published website page, app page or booth page. Here you word the banner (up to 300 characters) and set its privacy or cookie policy link. You can't switch the banner off: it appears only when something on the event needs it, and visitors from the EU/EEA, the UK, Switzerland and Quebec must allow it before any of that runs.
- Publishing a new version after people have consented shows how many attendees consented under the previous version, and offers Send Re-consent Emails so you can ask them to agree to the new text. You can also dismiss it.
- Consent records are never edited or deleted. A withdrawal is a new record; the original acceptance stays in the trail.
- Until a privacy policy exists, the pre-launch checklist shows a warning: you should not collect attendee data without one.
What works today
Generating, previewing and publishing versioned documents works, and so does asking attendees to accept them. Three parts are not finished yet: Upload records the file's name and size but does not store the file itself, so keep your own lawyer's text published somewhere you control (your website, say) as well; which version of a document each attendee accepted is recorded but not yet listed on Audit & Reports — that tab lists answers to your consent questions, and its export (CSV or Excel) holds exactly those; and Send Re-consent Emails counts the affected attendees but sends nothing — they are asked again anyway, the next time they open the event.
Step by step
Publish a privacy policy
Open Settings → Privacy & Legal.
On the Privacy Policy card, click Generate — or Upload to use your own file.
For a generated document, fill in the organization, event, data controller, contact email, the data you collect, your processors, the retention period and the jurisdiction, then click Generate.
Tick only the data your forms actually collect — the policy should describe what you really do.
Review the preview, then click Publish and confirm. The card now shows Published with version 1.
From now on, every attendee is asked to read and accept it the next time they open the event in the app, before they see anything else.
Repeat for Terms & Conditions and the Data Processing Agreement if you need them.
Export a consent report
Open the Audit & Reports tab.
Filter by Action (Accepted or Withdrawn) and Date Range if you need a slice.
Click Export and choose CSV or Excel.
The file holds every consent record the filter selects — the attendee's name and email, the consent, the exact question wording they answered, Accepted or Withdrawn, the time on the event's clock, the document version, IP address and browser.
Word the cookie banner
Open Settings → Privacy & Legal and select the Cookie consent tab.
The top card tells you whether visitors are asked at all and lists everything on the event that makes them.
Type your own Banner text, or leave it blank to keep the standard wording.
Plain text only, up to 300 characters. The buttons and the cookie categories never change.
Enter your Privacy or cookie policy link (https), or leave it blank to use the privacy policy link from your website footer.
Check the Preview for both EU, UK, Switzerland, Quebec and Elsewhere, then click Save.
The preview is the real banner. Use Show again after clicking a button in it.
What attendees see
In the attendee app
Attendees are asked for consent once, when they create their account: on the Create your password step after an invitation, or the password step at the end of registration. They tick a line agreeing to Moostoo's own Terms of Use and Privacy Notice (they are creating a Moostoo account, which works across every event), accepting your privacy policy and terms and conditions, and agreeing to the organizer receiving their registration details. Moostoo's two documents are always named. Each document you have published here is a link in that line too, and clicking it opens the published text in a full-screen reader without leaving the form. A document you have not published is not mentioned, and a draft saved after publishing is not shown until you publish it. The box is never pre-ticked, and they cannot set a password or use a sign-in provider without it. Someone who ticks it there is not asked about the same documents again when they enter the event.
In the attendee app
Attendees who already have an account — or who have not yet accepted the version you published — see your documents first when they open the event, before anything else of the event loads. Each document has a Read button that opens its full text; they tick that they have read and accept it and click Accept and enter. Until they do, the app shows nothing of the event: not the home, programme, people, messages or notifications, and the event's items are left out of their all-events agenda, invitations, messages and notifications. Back to my events leaves without accepting. When you publish a new version they are asked again, for the changed document only. Their acceptance is recorded with the document version and the time. A team member impersonating an attendee is not asked and cannot accept on their behalf.
On the event website
When something on a page needs consent, visitors see a cookie banner at the bottom of the screen with your wording and policy link, and a Cookie settings link in the website footer (and under the registration form when Google Analytics is connected). Visitors from the EU/EEA, the UK, Switzerland and Quebec see Accept all, Reject all and Preferences; until they allow it, Google Analytics does not load and Custom HTML or cookie-setting embeds show a placeholder of the same size. Elsewhere everything runs and the banner simply tells them, with a way to switch it off. A browser sending Global Privacy Control is treated as a refusal.
Tips
- Have your own counsel review a generated document before publishing. It is a well-structured starting point, not legal advice.
- Publish a new version rather than replacing the old one when the substance changes, so the version history shows what applied when.
- Publish your privacy policy and terms before you invite attendees, so they accept them while creating their account instead of on a separate screen the first time they open the event.
- Legal documents and consent questions can be copied into next year's edition when you clone the event.