Fathom

Individual users retain copyright and proprietary rights in their User Content, while Team Account content belongs to the company. Fathom's license to use that content is limited to what is necessary to provide the Service.

The Terms treat meeting notes, recordings, and transcripts as User Content owned by the individual or company, which covers AI-generated summaries of the user's own meetings. However, any 'Feedback' the user provides is fully assigned to Fathom, and the policy is not explicit about ownership of AI-generated derivative outputs beyond the User Content framing.

Fathom states it does not authorize third-party AI providers (e.g., OpenAI, Anthropic, Google) to train on user data, but it reserves the right to use de-identified data derived from User Content to train its own in-house models. An opt-out exists in account settings, but training is enabled by default based on account configuration.

Users can delete their account and request deletion of content; Fathom targets deletion within 30 days of an account deletion request but does not guarantee the timeframe, and backups may persist up to 30 days. There is no fixed retention schedule—data is kept 'as long as necessary'—and Team Account members cannot have their data deleted on individual request, requiring the Customer administrator to act.

Sharing with service providers and integrations (CRMs, Slack, Zoom, etc.) is integral to the service and disclosed; Fathom commits not to sell Meeting Content Information or attendee data. However, Device Information is shared with third-party advertisers, and personal information may be transferred in a corporate merger or sale, which are broader than core service needs.

The policy provides multiple concrete opt-out mechanisms: users can opt out of AI training on de-identified data in account settings, unsubscribe from marketing emails, opt out of email tracking consent, and use NAI/DAA pages to opt out of ad tracking. An arbitration opt-out is also available within 30 days.

The consumer documents reference GDPR, CCPA, UK GDPR, and Illinois/Colorado biometric laws as applicable regulatory frameworks, and name a HIPAA BAA and DPA by reference. However, the consumer Terms and Privacy Policy do not themselves present SOC 2 or ISO audit evidence; such certification claims appear only in marketing copy and the enterprise DPA. No ISO 27001/42001 or NIST/EU AI Act attestations appear in the consumer text.

The consumer documents provide no transparency into how the AI summarization models behave, no explainability commitments, and no consumer-facing auditability of model outputs. The policy is essentially silent on model behavior and auditing.

The Privacy Policy makes only general commitments to 'reasonable' physical, technical, and organizational safeguards and expressly disclaims any guarantee of security. The consumer text names a trust center (trust.fathom.video) and references subprocessors, but does not detail encryption, pen testing, or incident response, and discloses no breach history.

The Terms establish a clear delta: free-edition users receive no indemnities or warranties and can be terminated at any time, while paid and Team Accounts get cure periods and indemnification. Team Account data belongs to the company and is governed by admin-controlled settings and the Customer's own privacy policy.

Fathom states it does not edit, screen, or monitor User Content as a general matter, but reserves the right to access it to respond to support requests or to investigate fraud, abuse, or legal violations. This is a limited but real reservation of human access.

The Privacy Policy discloses that Fathom may access, preserve, and disclose personal information in response to law enforcement requests, court orders, and subpoenas, and in corporate transactions. The Terms impose binding individual arbitration with a class-action waiver, limiting users' litigation avenues (though a 30-day arbitration opt-out exists).

Fathom collects substantial PII (name, email, IP, device identifiers, job title, calendar and meeting content) and optionally collects voiceprint biometric data (SPI) on an opt-in basis with a dedicated consent notice. It disclaims collecting other sensitive categories as a controller, but meeting recordings may inherently contain sensitive content for which the Customer is the controller.

Both the Terms (Last Updated March 4, 2026) and Privacy Policy (Last Updated August 16, 2026) are recent relative to the October 2026 analysis date, and both substantively address the AI-first nature of the product, including in-house model training, third-party model providers (OpenAI, Anthropic, Google), and integrations. The product surface references a corporate change ('FATHOM IS NOW PART OF SUPERHUMAN') not reflected in the policy text, a minor coverage gap.

Two distinct consumer documents (Terms of Service and Privacy Policy) were supplied and compared, and they are mutually consistent on key points such as the no-third-party-AI-training commitment, the AI training opt-out, and the 30-day deletion/backup timeframe. No contradictions were identified between them.