Fathom Analytics is privacy-first website analytics software operated by Conva Ventures Inc. (doing business as Fathom Analytics), a private company incorporated and registered in British Columbia, Canada, publicly named as 100% independently owned with no VC investment. Its own marketing site states the product anonymizes IP addresses and identifies visitors without using cookies, avoiding cookie-consent banners, and its privacy policy frames Fathom as a GDPR Article 28 data processor for its customers' website-visitor data, bound by a published data processing addendum. The company documents an 'EU Isolation' architecture adopted specifically to address the Schrems II ruling, keeping EU visitor data within the EU. A wart: following a significant DDoS attack on its own website, Fathom began retaining partial access logs (timestamp and total requests per IP) on usefathom.com itself. No named-firm security audit, transparency report with counts, or regulator/breach action was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
7 ON FILE
COLLECTION
Fathom Analytics' marketing site states its analytics software anonymizes IP addresses and other visitor data without using cookies, which it presents as the reason customers do not need cookie-consent banners for Fathom's tracking.
Fathom's privacy policy discloses that, following a significant DDoS attack against its own website, the company began keeping partial access logs recording only timestamps and total request counts per IP address, not which pages were viewed, for cyberattack protection and traffic analysis purposes.
Fathom Analytics' homepage states the company is '100% independently owned, zero VC pressure,' a self-declared funding/governance claim distinguishing it from venture-backed analytics competitors.
Fathom Analytics' imprint page names the legal operator as Conva Ventures Inc. (Business Number 716722285), incorporated and registered in British Columbia, Canada, doing business as Fathom Analytics, with Jack Ellis named as managing partner.
Fathom's privacy policy states that when a customer uses Fathom Analytics on their website, the customer is the data controller and Fathom is the data processor, bound by GDPR Article 28 obligations including processing only on the customer's instructions and governing the relationship through a published data processing addendum.
Fathom's privacy policy discloses a significant DDoS attack against its own website as the reason it began retaining partial access logs; no personal-data breach, regulator action, or named-firm security audit was found in this research.
Fathom's GDPR compliance page states the company addressed the Schrems II ruling by launching an 'EU Isolation' architecture and has documented its Schrems II compliance, keeping EU visitor data processed within the EU rather than transferred to non-EU infrastructure.