Who we are, and our role
TTP ("Trust The Process") is operated from Singapore. We build around the obligations in Singapore's Personal Data Protection Act (PDPA) and the PDPC's guidance on children's data. This page explains our current operating approach; it is not a certification or legal advice.
For academy workspace data, the intended model is that the academy is the organisationand TTP acts as its data intermediary only where TTP processes the data under the academy's written instructions. Those roles must be recorded in the academy agreement. TTP remains the organisation for data it controls directly, including website enquiries and its own account, security and service-administration records.
Data protection contact: hello@ttp.football. We aim to acknowledge within 2 working days.
What we collect, and why
Website enquiries: the details you submit, such as name, academy, contact and what you tell us, used solely to respond. No tracking cookies, no advertising analytics, nothing sold - ever.
In the product: player profiles, squad, development plans, coach feedback, match involvement, awards, guardian and staff accounts, schedules and attendance. Collected because that is the product: making a child's development visible to their own family and academy.
Children's data - the rules we build to
The academy is responsible for establishing the appropriate lawful basis and obtaining any required parent or guardian consent before adding a child. TTP records the linked guardian and the consent state supplied through the academy workflow. By construction: no private adult-to-child messaging, no public rankings or leaderboards of children, and match statistics are family-private, visible only to the child's own family and academy staff. Media photos require separate, revocable consent. These are database-level rules, not settings.
Where data lives, and who can see it
Core product records are held on Singapore-based infrastructure, Supabase/AWS ap-southeast-1, encrypted in transit and at rest. Access is enforced by row-level security at the database layer: guardians see their own children only; coaches see their assigned squads; academy staff see their academy only. Academies are isolated from each other.
AI Coach Note Assist: if an academy enables this staff-only feature, a coach may ask TTP to improve a rough typed or dictated coaching note. The request can include the rough note or short audio clip, selected focus-area ratings and bounded player context such as active goals, released feedback, IDP history and confirmed attendance or match facts. TTP does not store the audio, transcript or AI suggestion from this route, and the coach must review before saving any feedback through the normal TTP workflow.
AI requests are sent to OpenAI as an AI subprocessor. OpenAI's current API data controls state that API data is not used to train OpenAI models unless the customer explicitly opts in. OpenAI may retain abuse-monitoring logs containing customer content for up to 30 days by default, and endpoint-specific retention can also apply. TTP sends Responses requests with storage disabled. OpenAI processing may involve international transfer outside Singapore unless a separate regional or data-retention configuration is agreed. See OpenAI's API data controls.
Subprocessors: Supabase (database and authentication, Singapore region), Vercel (application hosting), Resend (transactional email), OpenAI (staff-only AI note assist when enabled). We add none without updating this page.
Retention and deletion
We retain personal data only while it is needed for the purpose for which it was collected, to provide the service, or to meet legal, security and audit obligations. When an enrolment ends, the family's active academy access closes. Export, correction and deletion requests are handled with the academy according to the applicable agreement and law.
A formal paid-customer retention schedule and deletion timetable are being finalised as part of Singapore legal review. Until that is complete, we do not publish fixed deletion deadlines that are not yet contractually supported.
If something goes wrong
Any suspected exposure of child data is treated as our highest-severity incident. We contain the issue, assess its scope and notify the affected academy without undue delay. Where TTP is acting as a data intermediary, the academy determines whether notification thresholds are met; TTP supports the academy's assessment and response. PDPC guidance requires a notifiable breach to be reported as soon as practicable and no later than three calendar days after that determination. See the PDPC's breach notification guidance.
Families outside Singapore
TTP is Singapore-based and PDPA-first. If an academy enrols families from other jurisdictions, for example the UK or EU, we work with that academy on the applicable additional obligations such as UK/EU GDPR before their families go live.
Your rights
For academy records, request access, correction, export, deletion or consent withdrawal through your academy first; TTP supports the academy in responding. For website enquiries or other data controlled directly by TTP, contact hello@ttp.football. You may also contact the PDPC.