Fathom's privacy policy promises that every meeting you have already recorded keeps its terms after Superhuman's purchase, and makes no such promise for the meetings you record next. Fathom's privacy policy says that after an acquisition, your information "will be governed by the provisions of this Privacy Policy in effect at the time the applicable information was collected." The same policy says a revised version "will be effective when it is posted." Put those two sentences together. Past calls are promised Fathom's rules. Every call recorded after a rewrite gets the new owner's rules. And on Fathom's individual plans, whether meeting content trains Fathom's models is each employee's setting, not IT's.
That is the decision in front of CIOs, CISOs and privacy leads this week. The question isn't whether Superhuman will handle the data worse. It may handle it better. The question is whether you get your Fathom footprint under a contract and an admin console before the paperwork changes, or after. We saw the same pattern a few days ago when Alianza bought the meeting-bot API Skribby. This case is harder, because most Fathom accounts appear to have come from self-serve sign-ups, not procurement.
What Did Superhuman Actually Buy?
Superhuman bought a meeting notetaker that grew through self-serve sign-ups, and it plans to feed Fathom's transcripts into its agents. The company, which renamed itself from Grammarly and says it serves "over 40 million people, 50,000 organizations," announced the acquisition on September 14, 2026. The announcement calls Fathom "trusted by hundreds of thousands of companies."
According to TechCrunch, Fathom has more than 400,000 monthly active users, and over 1 million people have recorded meetings with it. It raised more than $30 million and was valued at $94 million in 2024, per PitchBook. Reworked reports that terms of the deal were not disclosed. Two of those figures belong together. Hundreds of thousands of companies against 400,000 monthly users suggests most customers have only a handful of users each. That looks like individual sign-ups, not negotiated enterprise contracts.
The integration plan is explicit. Superhuman says it will bring Fathom into Superhuman Go, email, calendar, Superhuman Docs, databases and AI agents. Its example: "An agent in Go could review the transcript of a team standup, draft the latest status updates for the team's project tracker in Superhuman Docs, and notify the project manager to review and approve them before they are finalized." Fathom CEO Richard White told TechCrunch that "if we were to operate Fathom as a stand-alone company, we would have to build a lot of things that are already in the Superhuman platform."
Several things are still unknown: price, timeline, pricing changes for customers, and any statement on data handling. The announcement covers none of them. Superhuman's community post says: "For now, this is simply a heads-up. We'll share more as plans develop." Reworked, citing White, says customers keep "the same app, login and user experience." Reworked also notes the deal leaves Granola, Fireflies, Otter.ai and Wispr as the main standalone notetakers.
Which Privacy Policy Governs a Fathom Recording Now?
Every recording made so far is governed by Fathom's current policy, last updated August 16, 2026. Nothing in that policy holds future recordings to the same terms. A time-of-collection clause is a privacy-policy term that binds whoever owns the company to the promises that were in force when each piece of data was collected. It is the archive's main protection. It does not protect anything recorded later.
Fathom's clause, under "Merger, Sale, or Other Asset Transfers," is unusually clear about the archive. The "Changes to this Privacy Policy" section is just as clear about the future:
- A revised policy "will be effective when it is posted."
- If Fathom materially changes how it uses information "previously collected from you," it "may notify you through the Service, by email, or other communication." That says may, not will. It also means the policy allows for changes to how the archive is used, so the at-collection promise is not airtight. The FTC has warned that adopting more permissive practices, such as AI training, through a "surreptitious, retroactive amendment" may be unfair or deceptive.
- "If you use the Service after any changes to the Privacy Policy have been posted, that means you agree to all of the changes."
The notice sentence covers only data already collected, so for a meeting recorded next month, the notice is the posted page itself. Continued use counts as agreement.
These are the current terms worth trying to keep. Fathom's policy says it may use de-identified meeting content "to improve our Service by training, improving, and customizing our in-house artificial intelligence models," with an opt-out in account settings. It also says it does not authorize "OpenAI, Anthropic, Google, etc" to train on that content. Fathom's help center adds that none of its AI sub-processors "(Anthropic, OpenAI, or Google) are contractually permitted to use our users' data to train their AI models." Fathom's biometric notice, also dated August 16, 2026, says voiceprints are not used for "product training." We found no language in Fathom's policy about sharing meeting content with a parent company or affiliates, and none was needed until now.
What Would Change Under Superhuman's Paperwork?
If Fathom is folded into Superhuman's terms, meeting content would fall under a policy written for cross-product use, which is the entire point of this deal. Superhuman's privacy policy, effective July 6, 2026, covers Superhuman Platform Inc. "and our subsidiaries (such as Grammarly Inc., Coda Project LLC, and Superhuman Labs LLC)." It also says: "Companies within the Superhuman corporate family may access information about you, including for business operations, product integration, development, and improvement, and to support promotion of our products."
That sentence is not sinister. It is the legal version of the standup-agent example above. It is also broader than anything in Fathom's current policy, and neither it nor Superhuman's Data Privacy Addendum, dated July 8, 2026, mentions Fathom yet.
The DPA matters more for a company buyer. Three terms stand out:
- Affiliates count as sub-processors. The definition covers "third parties or affiliates of Superhuman." Superhuman's sub-processor list includes affiliates in the US, Germany, Poland, Ukraine and Canada, and names Anthropic, OpenAI and Azure as generative AI providers. Fathom is not on it.
- Notice is opt-in. Superhuman commits to at least 30 days' notice of new sub-processors only if the "Customer opts in to receive such notifications using the dedicated form." If nobody at your company filled out that form, you get no notice.
- Your remedy is leaving. If an objection isn't resolved, Superhuman may decline to use the new sub-processor or "permit Customer to terminate or suspend the affected Service."
There is precedent for how these combinations go. When Grammarly bought Coda, Coda told customers they could "count on those docs to continue working as they do now." The rebrand announcement repeated that for Coda and Superhuman Mail users: "nothing changes about the products they rely on." Both promises were about the product. Today, Coda's documents appear as "Docs (formerly known as Coda)" in Superhuman's privacy policy, and Coda Project, LLC is on the sub-processor list as an affiliate. Keeping a product running and keeping its terms unchanged are different promises. It is the same distinction we drew when Meta bought Stilla after Stilla promised continuity.
Who Decides Whether Your Meetings Train a Model?
On Fathom's individual plans, each employee decides. Org-wide security controls, SSO, SCIM and custom retention are listed only on Enterprise. Here is how the tiers compare on Fathom's pricing page (annual billing, as of September 15, 2026) and in its help center:
| Fathom plan | Price | Who can turn off model training | Org-wide security controls, SSO/SCIM, custom retention |
|---|---|---|---|
| Free | $0 | Each user, in their own settings | Not listed |
| Premium | $16/month | Each user | Not listed |
| Team | $15/user/month | An admin can opt out all users | Not listed |
| Business | $25/user/month | Admin (includes everything in Team) | Not listed |
| Enterprise | Custom | Admin | Listed, plus a signed HIPAA BAA |
The help center puts it this way: "You can opt out of this anytime in your My Settings, and Organizations on Team Edition can opt out all users on their account by going to Organization Settings." Any recording made on a free account signed up with a work email is covered by one employee's checkbox.
Superhuman doesn't change this pattern. It inherits it. Its own Go plan table lists "Model training" as "Opt out" on Free, Pro and Business, and "Off by default" only on Enterprise. Its training-control article says the setting is on by default for self-serve multi-user Pro and off by default for Business and Enterprise accounts bought through sales. At both companies, the training control you get depends on how you bought the product, and most Fathom seats appear not to have been bought through sales.
The Strongest Case That Nothing Bad Happens
The best argument for doing nothing is that Superhuman's terms are, in some places, stronger than Fathom's. On policy changes, Superhuman says "If we make material changes, we will provide you additional notice, such as by sending you an email." That is will, where Fathom says may. Superhuman's Enterprise page says "customer content is never used to train AI models" and that all its products have SOC 2 Type 2. A notetaker last valued at $94 million may well end up with a more mature security program inside a company with an established enterprise sales team.
All of that can be true, and the timing still matters. Stronger stewardship is not the same terms. The corporate-family clause is broader in exactly the direction the deal is designed to go. And an emailed notice only protects the person who receives it. On a free account, that is the employee, at their work address, who can keep using the service and thereby accept the change.
What Happened the Last Time Notetaker Terms Were Tested?
The last time, the problem was the people on the other end of the call, who never agreed to anything. Brewer v. Otter.ai, filed in federal court in California in August 2025, alleges that Otter recorded conversations of participants who weren't Otter subscribers, used recordings to train its speech-recognition systems, and "shifted the responsibility for securing permissions to account holders." The claims include the Electronic Communications Privacy Act and California's Invasion of Privacy Act. On August 13, 2026, the court let those claims proceed, reasoning that a notetaker alleged to use recordings to train its own models can be a third-party eavesdropper rather than a mere tool. That is a ruling on the pleadings, not a finding of liability.
The lesson for this deal is simple. When your account executive records a customer call in Fathom, your customer's words are in that recording. Your customer accepted neither Fathom's policy nor Superhuman's. If the terms change, that exposure follows the recording, and your employee's account settings are the only control over it.
You also can't count on blocking the bot at the meeting platform. In a June 2025 Microsoft Q&A thread, an admin reported that Fathom "does not appear in the Teams Admin Center under 'Manage Apps.'" Microsoft's reply offered only indirect workarounds. The control that works is on the account, not the meeting.
What Should You Do Before Fathom's Terms Change?
Act while the policy you already know still governs new recordings. Nothing has been rewritten yet, but once it is, the change takes effect the day it's posted.
This Week:
- Find every Fathom account on your domains. Pull corporate card and expense data for Fathom charges, and review third-party app grants in Google Workspace and Microsoft Entra. Fathom's policy describes connecting to Google, Microsoft and Zoom accounts, and that connection leaves a grant you can see.
- Turn off training everywhere you can, and record the date. Team and Business admins can do it in Organization Settings. For individual accounts, send each user the instruction and collect a screenshot. If the terms change later, you will want proof of what was set beforehand.
- Decide on the Superhuman Go connector. The Fathom connector gives Go access to meeting summaries, transcripts, action items and recording links, and the community post already invites users to connect it. Until you have decided, the answer for employees is no.
- If you have a Superhuman DPA, subscribe to sub-processor notices today. The 30-day notice only goes to customers who have opted in.
This Month:
- Send Fathom four written questions. Will Fathom Video Inc. remain the contracting entity? Will the August 16, 2026 policy, including its training terms, cover recordings made after the deal closes? Will any Superhuman affiliate access meeting content, and for what purpose? How much notice will customers get before any change? A settings page is not a contract, which is the lesson from Stripe's OpenRouter deal.
- Consolidate or exit. If Fathom stays, move users onto one Enterprise contract, the only tier that lists org-wide security controls, SSO/SCIM, custom retention and a signed BAA. Put training-off and retention in the order form. If Fathom goes, export what you need and request deletion now, while the pre-deal policy applies. Fathom promises only "commercially reasonable efforts" to delete within 30 days of an account deletion request, so start the clock early.
Before Renewal:
- Rewrite your notetaker rule for external calls. Require notice to outside participants. Turn off automatic sharing on customer calls, since Fathom's policy says it may share a copy "with other meeting participants (according to your Service automatic sharing configurations and requests)." And name who approves a notetaker on any call that involves regulated data.
The Bottom Line
A decade of SaaS roll-ups taught procurement teams to read the change-of-control clause before a deal closes. AI notetakers don't fit that habit, because many of them were never procured. Employees adopted them one work email at a time. That means there's no negotiated contract, no assignment clause to trigger, and often no admin to receive the notice. Fathom's policy actually gives you something many vendors don't: a written promise that the past stays under the old rules. Treat it as a deadline, not a comfort.
Your archive has a written promise. Your next meeting doesn't.
Continue Reading
- Alianza Bought Skribby. Your Meeting Audio Changed Owners.
- Stripe Bought OpenRouter. A Toggle Is Not a Contract.
- Adobe Took Rilo's Team. Its Slack Token Never Expires.
- Stilla Promised Continuity. Meta Bought It for WhatsApp.
- AI Vendor Security Review: 6 Questions That Change the Answer
- Your AI Vendor Joined OpenAI in March. You Heard in August.