Data processing
When you audit a site, you decide what gets processed and we process it for you. This is what that means.
Last updated: 10/12/2026
Draft pending legal review. The text is complete and describes what the service actually does, but a lawyer has to review it before it counts as final. One piece of information is also missing: the company isn’t incorporated yet, so its legal name, registered address and tax number aren’t here.
1. Who’s who
There are two different kinds of processing and it helps not to mix them up. For your account data — your name, your email, your payments — we’re the controller, and the privacy policy covers that. For personal data that appears on the sites you audit, you’re the controller and we’re the processor: we handle it on your instructions.
2. What we process and what for
Subject matter: crawling the sites you tell us to and producing reports. Duration: for as long as you have an active account. Nature: automated reading of public pages, analysis and storage of the result. Types of data: whatever appears in the public content of those pages, such as names, email addresses or phone numbers published on them. Data subjects: the people whose data is published on those sites.
3. Instructions
We only process that data to provide the service and to do what you ask from the app: adding a site, running an audit, scheduling monitoring or sharing a report. We don’t use it for anything else, we don’t sell it and we don’t train models on it.
4. Confidentiality
Anyone on our side with access to that data is bound to confidentiality, access goes by role, and any support access to a customer account is logged with the date and the user.
5. Security measures
Encryption in transit and at rest, role-based access control, mandatory two-step verification in the admin panel, access logging, daily backups kept for 30 days and a restore test every month.
6. Subprocessors
We rely on the providers listed on the subprocessors page, which are bound by obligations equivalent to these. We’ll give at least 30 days’ notice before adding a new one, and you’ll be able to object.
7. Data subject requests
If someone writes to us to exercise their rights over data that appears on one of your sites, we pass it on to you, because you’re the one who decides. And we help you answer: from the app you can delete a site and its reports whenever you want.
8. Security breaches
If there’s a breach affecting your data we’ll tell you without undue delay, with what we know at the time: what happened, what it affects, what we’re doing and what we suggest you do. We’ll fill in the details as we get them.
9. Audits
You can ask us for whatever information you need to check that we meet these terms, by writing to support@fathomaudit.com. If your organization needs a formal audit, we’ll talk about how to do it without putting other customers’ data at risk.
10. Return and deletion
When you close your account you can export your data from Settings, and we delete what’s left within 30 days. Backups overwrite themselves within their retention period.
11. International transfers
The same ones the privacy policy describes: some providers are outside the European Economic Area and those transfers rely on standard contractual clauses.
12. Changes
We’ll publish any change on this page, with its date, and give you at least 30 days’ notice if it affects what we do with the data we process for you.