Fathom

Legal

Privacy notice

How Fathom handles personal data on fathom-exchange.com and in the Fathom app during the pilot.

Draft — to be reviewed by counsel before launch. This is a working first draft for the pilot. It is not yet final and may change. Bracketed items are placeholders.

Last updated: 28 September 2026 (draft)

1. Who we are

Fathom (“Fathom”, “we”) operates a business-to-business marketplace for subsea cable capacity at fathom-exchange.com. The controller of personal data is [legal entity name, registered number and address]. You can reach us at .

Fathom is intended for business users acting on behalf of their organisations. It is not directed at consumers or at anyone under 18.

2. What we collect

Access requests

When you submit the request-access form: your name, work email, company, role (seller, buyer or other), country if you give it, and the free-text description of routes and capacity you are interested in.

Accounts

Name, work email, company, country, account role, a hashed password (we never store it in readable form), and the date the account was created.

Marketplace data

The offers and requests you list (routes, products, capacity, contract terms, prices including reserve and maximum rates), proposals and your responses to them, auction bids, deals, and messages exchanged with Fathom’s deal desk.

Payments

Payments are processed by Stripe. We receive confirmation of payment and a Stripe reference for the deal; we do not receive or store card or bank account numbers.

Technical data

To protect the service from abuse we rate-limit requests. For this we store a one-way hash of your IP address combined with a secret key, not the IP address itself. Our servers may keep short-lived operational logs.

3. Why we use it

  • To review access requests and reply to them [legal basis: legitimate interests].
  • To provide the marketplace: matching, auctions, deals, invoicing and the deal desk [legal basis: contract].
  • To secure the service and prevent abuse [legal basis: legitimate interests].
  • To meet legal, tax and accounting obligations [legal basis: legal obligation].

We do not sell personal data, use it for advertising, or build marketing profiles.

4. Listings and confidentiality

Your listings are visible only to you and to Fathom’s operators. Other participants see only the terms of a proposal, auction or deal they are party to, with you identified by an alias. Once a deal is paid and active, your name, company and country are shared with that deal’s counterparty so the capacity contract can be concluded. The full rules are on the Trust page.

5. Who we share it with

  • Your counterparty, as described above, only once a deal is active.
  • Stripe, to process payments.
  • Cloudflare, which carries traffic to our servers and terminates HTTPS.
  • Hosting [hosting provider, once the service moves off the pilot server].
  • Professional advisers and authorities where required by law.

Some of these providers may process data outside your country. [Describe international transfer safeguards.]

6. Cookies and tracking

This website sets no cookies and loads no third-party scripts, fonts, analytics or advertising pixels. The Fathom app stores your sign-in token in your browser’s local storage so you stay signed in; signing out removes it. The installable app does not keep marketplace data for offline use.

7. How long we keep it

Access requests that do not lead to an account: up to [12] months. Account and marketplace data: for as long as the account is open, and afterwards as long as needed for legal, tax and dispute purposes, [typically 7 years for deal records]. Rate-limiting hashes: [a short period, e.g. 24 hours].

8. Security

Traffic is encrypted in transit. Passwords are stored as salted scrypt hashes. Access to marketplace data is enforced per account on the server, and access to the operator console is restricted to Fathom staff running the deal desk. No system is perfectly secure; if you believe your account or data is at risk, contact us immediately.

9. Your rights

Depending on where you are, you may have rights to access, correct, delete or export your personal data, to object to or restrict certain processing, and to complain to a data protection authority. To exercise them, email . Some marketplace records must be kept for legal reasons even if you close your account.

10. Changes and contact

We will update this notice as the pilot develops and before general launch, and will tell account holders about material changes. Questions: .