Fathom procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “Throughout these Terms the use of the word “including” means “including but not limited to.” If any part of these Terms is held to be invalid or unenforceable, the unenforceable part will be given effect to the greatest extent possible, and the remaining parts will remain in full force and effect. Privacy Matters. Please read the Fathom Privacy Policy (the “ Privacy Policy ”) carefully for information relating to our collection, use, storage, and disclosure of your personal information. The Fathom Privacy Policy is incorporated by this reference into, and made a part of, these Terms. If you are subject to an applicable law that requires a data processing agreement, Fathom’s Data Processing Agreement (“DPA”) available at https://fathom.ai/dpa is hereby incorporated by reference. If the Health Insurance Portability and Accountability Act ("HIPAA") applies to you, the Fathom Business Associate Agreement available at https://fathom.ai/baa is hereby incorporated by reference. Where we have an arrangement in place with a customer who is encouraging you to use our Service (for example, your employer or another business or organization), we in some circumstances obtain and process your personal information on behalf of and at the instructions of such a customer. Their privacy policies will apply to the processing of your information and we encourage you to read their privacy policies. Additional Terms. Your use of the Service is subject to all additional terms, policies, rules, or guidelines applicable to the Service or certain features of the Service that we may post on or link to from the Service (the “Additional Terms”). ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Fathom complies with the EU-U.S. Data Privacy Framework (the “EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. Fathom has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (the “EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Fathom has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (“DPF”) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/ . In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Fathom commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States, the European Union, the United Kingdom, and/or Switzerland (as applicable). ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ Our Services are hosted in the United States and intended for visitors located within the United States. If you choose to use the Services from the European Union or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your personal information outside of those regions to the United States for storage and processing. Also, we may transfer your personal information from the U.S. to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Services. By providing any information, including personal information, on or to the Services, you consent to such transfer, storage, and processing. When we transfer your personal information outside of the European Economic Area, including to the U.S., we shall ensure that relevant safeguards are in place to afford adequate protection for your personal information in compliance with relevant data protection laws such as Standard Contractual Clauses or the Data Privacy Frameworks.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ You can delete your Fathom account at any time from your account settings. If you no longer use our Services, your account and the personal information in it will remain unless you actively delete the account from your account settings. If we receive an account deletion request, we will use commercially reasonable efforts to delete your recordings and personal information within 30 days of your account deletion request, although we cannot guarantee that deletion will always occur within this timeframe. However, if we are legally required to retain that information under applicable laws, we will retain your personal information, subject to the “Data Retention” Section above, but we will take measures to pseudonymize it. If you deauthorize Fathom through your Google or Outlook account settings, your Fathom account will be disabled until you reconnect either an Outlook Calendar or Google Calendar account. As noted above, linking an Outlook Calendar or a Google Calendar account is core to our Services and without a linked Outlook Calendar or a Google Calendar, you will not be able to successfully use our Services. Please note that, if you use our Services through a business account of one of our customers, for example your employer or another business or organization, their privacy policies will apply to the processing and deletion of your information. We will not be able to delete the personal information on the business account on your request. If you have questions about your privacy on the Services or this Privacy Policy, please contact us at privacy@fathom.video .” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ A notifiable data breach scheme is currently in place in Australia. We are committed to adhering to this scheme as an important step in preventing and managing serious privacy breaches. A "data breach" means unauthorised access to, or disclosure, alteration, loss, or destruction of, personal information —or, an action that prevents us from accessing personal information on either a temporary or permanent basis. An "eligible data breach", in accordance with the Australian Privacy Act, occurs when there is a data breach that is likely to result in serious harm to any of the individuals to whom the information relates and we are unable to prevent the likely risk of serious harm with remedial action. We, including all our people, take breaches of privacy very seriously. If we suspect a privacy breach has occurred, our priority is to contain and assess the suspected breach. In doing so, we will: take any necessary immediate action to contain the breach and reduce the risk of harm; determine the cause and extent of the breach; consider the types of information involved, including whether the personal information is sensitive in nature; analyse the nature of the harm that may be caused to affected individuals; consider the person or body that has obtained or may obtain personal information as a result of the breach (if known); and determine whether the personal information is protected by a security measure. If we believe an eligible data breach has occurred we will, as soon as practicable, notify the Office of the Australian Information Commissioner and all affected individuals or, if it is not possible to notify affected individuals, provide public notice of the breach (in a manner that protects the identity of affected individuals).” | Captured 2026-07-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We store all personal information for as long as necessary to fulfill the purposes set out in this Privacy Policy, or for as long as we are required to do so by law or in order to comply with a regulatory obligation. When deleting personal information, we will take measures to render such personal information irrecoverable or irreproducible, and the electronic files which contain personal information will be permanently deleted.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “If we receive an account deletion request, we will use commercially reasonable efforts to delete your recordings and personal information within 30 days of your account deletion request, although we cannot guarantee that deletion will always occur within this timeframe. However, if we are legally required to retain that information under applicable laws, we will retain your personal information, subject to the “Data Retention” Section above, but we will take measures to pseudonymize it.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Fathom complies with the Principle regarding accountability for onward transfers. Fathom remains liable under the Principles if its onward transfer recipients process personal information in a manner inconsistent with the Principles, unless Fathom proves that it was not responsible for the event giving rise to the damage. Depending on the circumstances, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Other Meeting Participants. When you use our Services to record a meeting, we may share a copy of that meeting with other meeting participants (according to your Services automatic sharing configurations and requests) if we have their email address. Vendors and Service Providers. We may disclose any information we receive with vendors and service providers retained in connection with the provision of our Services. We disclose Meeting Content Information with a limited number of service providers and vendors solely to help us provide and deliver the Services to you. Third Party App Integrations. When you connect a third party application such as Google, Microsoft, Zoom or any other compatible third-party conferencing application to our Services, we may share information such as your meeting notes, links to video clips, or portions of the meeting transcript with that third party. Please note that you will not be able to successfully use our Services without connecting your Google or Microsoft calendar to our Services. Marketing. We do not sell, or share your personal information with non affiliated companies for their own direct marketing purposes, unless we have your permission. We do not sell Meeting Content Information or information about your meeting attendees to anyone. Third Party Advertising. We work with third party advertisers to show you ads for Fathom’s Services. Some of our third party advertisers are members of the Network Advertising Initiative ( https://optout.networkadvertising.org ) or the Digital Advertising Alliance ( https://optout.aboutads.info ). ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “The use of your personal information following any of these events will be governed by the provisions of this Privacy Policy in effect at the time the applicable information was collected. Consent. We may also disclose your personal information with your permission.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 7. DETAILS ON THE OUTSIDE TOOLS/SOFTWARE CONNECTED TO OUR SERVICE ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “Marketing. We do not sell, or share your personal information with non affiliated companies for their own direct marketing purposes, unless we have your permission. We do not sell Meeting Content Information or information about your meeting attendees to anyone.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may provide tools through the Service that enable you to export information (such as User Content) to third-party services, including through features that allow you to link to an account on the third-party service, such as through your CRM systems. By using one of these tools, you agree that we may transfer that information to the applicable third-party service. Third-party services are not under our control, and, to the fullest extent permitted by law, we are not responsible for any third-party service’s use of your exported information.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Fathom uses third-party payment processors, such as Stripe, to process payments. Your credit card details are communicated directly from your browser to these payment processors. Fathom only sees the payment card type, the last four digits of your credit or debit card number and billing address. Please see Stripe’s terms of service and privacy policy for more information on how they use, and store your personal information.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “If you do not wish to receive such ads, please visit their opt-out pages to learn about how you may opt out of receiving web-based ads from member companies. You can access any settings offered by your mobile operating system to limit ad tracking, or you can install the AppChoices mobile app to learn more about how you may opt out of ads in mobile apps. Information received by these parties includes Device Information. For the avoidance of doubt, information received by these third parties does not include your Meeting Content Information, Registration Information, or your Fathom account information. As Required By Law and Similar Disclosures. We may access, preserve, and disclose your personal information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order, subpoena or other legal process; (b) respond to your requests; (c) detect and investigate security incidents and potentially illegal or prohibited activities; or (d) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through the Services. Merger, Sale, or Other Asset Transfers. We may transfer your personal information to advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets or stock. ” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.