Fathom

GDPR overview

GDPR compliance is claimed explicitly, with a GDPR badge shown alongside SOC 2 Type II, HIPAA and SSO/SCIM on the home and overview pages. A public DPA, updated 5 May 2026 and based on the Common Paper Data Processing Agreement 1.1, is available at fathom.ai/dpa; it incorporates the EEA Standard Contractual Clauses, modules 2 and 3, and the UK Addendum. Fathom is certified under the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. DPF, with JAMS as recourse body. An Article 27 representative is designated: DataRep, Cork, Ireland, with a UK address in London. The privacy policy, updated 16 August 2026, lists EEA, Swiss and UK rights, from access and erasure to portability, objection and complaint to a supervisory authority, exercised through privacy@fathom.video after identity verification. Approved subprocessors are published on trust.fathom.video, with ten business days' notice before any change.

Who owns the data?

On a personal individual account, the user retains any copyright and other proprietary rights in their User Content, meaning recordings, transcripts and notes. On a company Team Account, the same User Content belongs to the company, and access is governed by the settings applied by the Team Account administrator. User Content is tied to the account email address and is not transferable between accounts. Fathom acts as data controller for individual accounts, and as processor or service provider where an enterprise customer is the controller. Fathom uses the content to deliver the service and, depending on account settings, to train its own models on de-identified data.

Reuse rights

Users can reuse their own meeting output without asking Fathom for permission: recordings, transcripts, summaries, clips and downloads can be played, exported and shared, within the limits set by a Team Account administrator. On Fathom's side, the data collected is described as Meeting Content Information: notes, audio and video recordings, transcripts, meeting content, participant names and email addresses, and Google or Outlook calendar information, read on a read-only basis. Depending on account settings, Fathom may create de-identified data from that material to train, improve and customize its own in-house AI models, and an opt-out is available in account settings. Fathom states that it does not authorize third parties, naming OpenAI, Anthropic and Google, to use this data to train their models. Meeting Content Information is shared with a limited number of service providers solely to deliver the service, and is explicitly excluded, along with registration and account information, from the data passed to third-party advertisers. Fathom states that it does not sell personal data for money, while noting that its HubSpot analytics sharing may qualify as a sale or a share under California law. A voiceprint is collected only from iOS app users who give explicit consent.

Data retention & training

Hosting summary

Fathom states that its service is hosted in the United States and intended for visitors located in the United States, while explicitly anticipating use from the European Union and the United Kingdom. No European data residency option is published, and no broader hosting region is named beyond the country itself. Transfers outside the European Economic Area, including to the United States, are covered by Standard Contractual Clauses or the Data Privacy Frameworks: Fathom is certified under the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. DPF, and refers unresolved complaints to JAMS. The DPA, updated 5 May 2026, incorporates the EEA Standard Contractual Clauses, modules 2 and 3, and the UK Addendum. Approved subprocessors, with their country of location and the processing tasks they perform, are listed on the trust center at trust.fathom.video, and Fathom undertakes to give ten business days' notice before any change. Custom retention policies are offered on the Enterprise plan. European organizations should therefore treat Fathom as a US-hosted processor operating under transfer safeguards, not as a regional deployment.