Who we are, and our role
TTP ("Trust The Process") is operated from Singapore and designed to comply with the Personal Data Protection Act (PDPA), including the PDPC's Advisory Guidelines on children's data. For personal data inside an academy's workspace, the academy is the data controller ("organisation" under PDPA) and TTP acts as its data intermediary (processor), handling data only on the academy's instructions. For enquiries made through this website, TTP is the controller.
Data protection contact: hello@ttp.football. We aim to acknowledge within 2 working days.
What we collect, and why
Website enquiries: the details you submit, such as name, academy, contact and what you tell us, used solely to respond. No tracking cookies, no advertising analytics, nothing sold - ever.
In the product: player profiles, squad, development plans, coach feedback, match involvement, awards, guardian and staff accounts, schedules and attendance. Collected because that is the product: making a child's development visible to their own family and academy.
Children's data - the rules we build to
Children's accounts exist only after verifiable parental consent, recorded per child with a consent trail. By construction: no private adult-to-child messaging, no public rankings or leaderboards of children, and match statistics are family-private, visible only to the child's own family and academy staff. Media photos require separate, revocable consent. These are database-level rules, not settings.
Where data lives, and who can see it
Core product records are held on Singapore-based infrastructure, Supabase/AWS ap-southeast-1, encrypted in transit and at rest. Access is enforced by row-level security at the database layer: guardians see their own children only; coaches see their assigned squads; academy staff see their academy only. Academies are isolated from each other.
AI Coach Note Assist: if an academy enables this staff-only feature, a coach may ask TTP to improve a rough typed or dictated coaching note. The request can include the rough note or short audio clip, selected focus-area ratings and bounded player context such as active goals, released feedback, IDP history and confirmed attendance or match facts. TTP does not store the audio, transcript or AI suggestion from this route, and the coach must review before saving any feedback through the normal TTP workflow.
AI requests are sent to OpenAI as an AI subprocessor. OpenAI's current API data controls state that API data is not used to train OpenAI models unless the customer explicitly opts in; abuse monitoring or application-state retention may apply depending on endpoint and account settings. TTP sends the note-improvement request with storage disabled where supported. OpenAI processing may involve international transfer outside Singapore unless a separate regional/data-retention configuration is agreed.
Subprocessors: Supabase (database and authentication, Singapore region), Vercel (application hosting), Resend (transactional email), OpenAI (staff-only AI note assist when enabled). We add none without updating this page.
Retention and deletion
An academy controls its own data lifecycle. Our defaults: enquiry data is deleted within 12 months of the conversation closing; when a family leaves an academy, the academy's access to the child's record closes with the enrolment, and families may request export or deletion of their child's data at any time, actioned within 30 days. When an academy leaves TTP, its data is exported to it and then deleted from production within 60 days.
If something goes wrong
Any suspected exposure of child data is treated as our highest-severity incident: credentials revoked and keys rotated immediately, scope assessed, the affected academy notified without undue delay, and where thresholds are met, notification to the PDPC in line with PDPA breach notification requirements. We do not sit on bad news.
Families outside Singapore
TTP is Singapore-based and PDPA-first. If an academy enrols families from other jurisdictions, for example the UK or EU, we work with that academy on the applicable additional obligations such as UK/EU GDPR before their families go live.
Your rights
Access, correction, export and deletion of your or your child's personal data, and withdrawal of consent: request any of these via your academy or directly at hello@ttp.football. You may also complain to the PDPC at pdpc.gov.sg.