Fathom

GDPR overview

GDPR is addressed explicitly and in detail. Fathom Video Inc. names itself data controller for its own processing and data processor when acting on a business customer's instructions. The privacy policy, dated 11 August 2025, sets out the lawful bases it relies on in the EEA and the UK, namely consent, contractual necessity, legal obligation and legitimate interest, and enumerates access, rectification, restriction, objection, portability, automated-decision and complaint rights. An Article 27 representative is designated: DataRep in Cork for the EU and in London for the UK. Transfers rely on Standard Contractual Clauses or on the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. framework, with JAMS as the dispute body and FTC oversight. A data processing agreement is published, and obtaining consent from every meeting participant is contractually pushed onto the user.

Who owns the data?

On a personal individual account you keep the copyright and other proprietary rights in your User Content, and Fathom may only use, reproduce and format it as needed to deliver the service and to share it with the people you choose. On a company Team Account the same content belongs to your employer, and access is governed by the administrator's settings. Fathom acts as data controller for its own processing and as data processor when it handles content on a business customer's instructions. Product feedback is the exception: suggestions you send are assigned outright to Fathom. Content is tied to one email address and cannot be moved between accounts.

Reuse rights

Fathom states that it uses the data it collects to run and improve the service, provide support, prevent fraud and market its own product. Calendar access is read-only and serves only to detect upcoming meetings. De-identified data drawn from your meetings is used by default to train and refine Fathom's in-house AI models, and you can switch that off in your account settings; an organisation on a Team plan can switch it off for every user at once. The third-party AI subprocessors named in the help centre, Anthropic, OpenAI and Google, are contractually barred from training their own models on it. Fathom says it does not sell meeting content or attendee data, and that advertising partners receive device information only. As the end user you may reuse, export, share and delete your own recordings, transcripts and summaries without asking permission.

Data retention & training

Hosting summary

All Fathom data is stored in the United States, for every user, and no European residency option is offered. The privacy policy states plainly that the services are hosted in the US and intended for visitors located there, and that users elsewhere consent to the transfer. The web front end sits behind Cloudflare, and the domain resolves to a US-located address. The data processing agreement declares encryption in transit and at rest, and points to a hosted trust centre for the published subprocessor list; the help centre names Anthropic, OpenAI and Google as the AI subprocessors. Transfers out of the EEA rely on Standard Contractual Clauses or on the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. framework, all of which Fathom states it is certified under. For customers who need a contract, Fathom publishes a data processing agreement and says it will sign one for EU and UK users on request.