Privacy Policy

1. Information We Collect

1.1 Account Registration Information

When you or your institution registers for TRIS, we collect: full name, institutional email address, job title (e.g., Head Coach, Recruiting Coordinator, Offensive Coordinator), institution name, department, and phone number (optional). Each staff member receives an individual account. Account creation requires a verified institutional email domain.

1.2 Billing & Payment Information

When your institution subscribes to a TRIS plan, we collect billing contact name, billing address, and payment method details. Credit card numbers, ACH routing numbers, and wire transfer details are processed directly by our payment processor (Stripe) and are never stored on TRIS servers. We retain billing transaction records (dates, amounts, invoice numbers) for accounting and tax compliance purposes.

1.3 Prospect Evaluation Data

Our field agents collect the following about high school and transfer portal athletes through publicly observable means: full name, position, high school or current institution, graduation year, city and state, physical measurements (height, weight, wingspan, arm length, hand size), athletic testing results (40-yard dash, shuttle, vertical, etc.), position-specific skill assessments, character and behavioral observations, game film notes, social media presence data from public profiles, and NIL market indicators.

All prospect data is generated by TRIS evaluators from publicly observable sources. We do not access education records, medical records, institutional databases, or private communications. For a detailed description of what we collect and do not collect, see our FERPA Compliance page.

1.4 Platform Usage Data

We automatically collect information about how you interact with our platform, including: pages and features accessed, search queries and filter selections, prospect profiles viewed and saved, time spent on platform, device type, operating system, browser type and version, IP address, and referral source. This data is collected through server logs and essential analytics tools.

1.5 Communications Data

When you contact us for support, submit a form, or communicate with our team, we collect the content of those communications along with any metadata (timestamps, email addresses, subject lines). This data is used to respond to your inquiry and improve our service.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing, maintaining, and improving the TRIS platform and evaluation services
• Authenticating users and managing role-based access controls
• Processing subscription billing, invoices, and payment transactions
• Delivering prospect evaluations, composite scores, and analytics to subscribing programs
• Generating TRIS Composite Scores and predictive models from aggregated evaluation data
• Notifying subscribers of new evaluations, platform updates, and service communications
• Responding to support requests, inquiries, and feedback
• Monitoring platform security, preventing unauthorized access, and detecting fraud
• Analyzing usage patterns to improve platform features and user experience
• Complying with legal obligations, resolving disputes, and enforcing our agreements

We do not use your information for targeted advertising, behavioral profiling for marketing purposes, or sale to third parties.

3. Information Sharing & Disclosure

TRIS does not sell personal information or prospect evaluation data to any third party. We share information only in the following limited circumstances:

3.1 Subscribing Institutional Programs

Prospect evaluation data is made available to authenticated coaching staff at subscribing institutional programs. Each program's access is governed by their subscription tier and role-based permissions. Program-specific customizations (watchlists, notes, tags) are visible only to that program's authorized staff.

3.2 Service Providers

We use third-party service providers to operate our platform, including cloud hosting and infrastructure providers, database services, payment processing (Stripe), transactional email services, and analytics tools. These providers process data on our behalf under data processing agreements that restrict their use of TRIS data to the services they provide to us.

3.3 Legal Requirements

We may disclose information if required to do so by law or if we believe in good faith that such disclosure is necessary to: comply with a legal obligation, subpoena, or court order; protect and defend the rights or property of TRIS; prevent or investigate possible wrongdoing in connection with the service; or protect the personal safety of users or the public.

3.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify affected users of any change in ownership or control of their personal information.

4. Data Security

We implement industry-standard security measures to protect your information. For complete details on our security infrastructure, encryption standards, and access controls, see our Data Governance Policy. Key measures include:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for all data at rest
• SOC 2 Type II compliant infrastructure hosted in the United States
• Role-based access controls with multi-factor authentication for internal systems
• Regular third-party penetration testing and vulnerability assessments
• Automated encrypted backups with 30-day retention
• Dedicated incident response procedures with 72-hour breach notification

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

5. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right to Access: Request a copy of the personal information we hold about you
• Right to Correction: Request correction of inaccurate or incomplete information
• Right to Deletion: Request deletion of your personal information, subject to legal retention requirements
• Right to Data Portability: Request your data in a structured, machine-readable format
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances
• Right to Opt Out: Opt out of non-essential communications at any time via account settings or email unsubscribe links
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time

To exercise any of these rights, contact us at privacy@trissystems.com. We will respond to verified requests within 30 business days. We may ask for additional verification to process your request.

Athlete & Parent Rights

Athletes, parents, or legal guardians may request review or deletion of an athlete's prospect profile by submitting a verified request to privacy@trissystems.com. We will process verified requests within 30 business days. Deletion of a prospect profile removes it from all subscribing programs' views.

6. Cookies & Tracking Technologies

6.1 Essential Cookies

Required for platform functionality. These cookies manage authentication, session state, and security. They cannot be disabled without losing platform access.

6.2 Analytics Cookies

Used to understand how subscribers use the platform so we can improve features and performance. Analytics data is aggregated and anonymized. We do not use analytics cookies for advertising or cross-site tracking.

6.3 No Advertising Cookies

TRIS does not use advertising cookies, retargeting pixels, or cross-site tracking technologies. We do not participate in advertising networks or sell data to advertisers.

You can control cookie preferences through your browser settings. Disabling essential cookies may prevent you from accessing the platform.

7. Data Retention

We retain data for the minimum period necessary to fulfill the purposes described in this policy:

• Account data: Duration of subscription plus 90 days. After cancellation, program-specific configurations, watchlists, notes, and custom data are deleted within 90 days
• Billing records: 7 years for tax and audit compliance as required by law
• Prospect evaluation data: Athlete's eligibility window (typically 5 years from high school graduation) plus 1 year. Core evaluation data may serve multiple subscribing programs
• Platform usage data: 24 months, then aggregated/anonymized for product analytics
• Support communications: 3 years from resolution date
• Security and access logs: 3 years for audit and incident investigation purposes

8. Children's Privacy (COPPA)

TRIS does not knowingly collect personal information from children under 13 years of age. Our platform accounts are available only to institutional coaching staff aged 18 and older. Prospect evaluations involve athletes who are high school age (typically 14-18) and transfer portal athletes (typically 18-23). Evaluations of minors are based on publicly observable athletic performance at public events and do not involve direct collection of personal information from the minor.

If we learn that we have collected personal information from a child under 13, we will delete that information promptly. If you believe we have inadvertently collected information from a child under 13, please contact us at privacy@trissystems.com.

9. State-Specific Privacy Rights

California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know what personal information is collected, the right to delete, the right to opt out of sale (we do not sell personal information), and the right to non-discrimination for exercising privacy rights.

Other State Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with comprehensive privacy laws may have additional rights. We honor these rights consistent with applicable law. Contact privacy@trissystems.com to exercise state-specific rights.

10. International Data Transfers

TRIS processes and stores all data within the United States. If you access our platform from outside the United States, your information will be transferred to and processed in the United States. By using our services, you consent to this transfer. We do not currently offer data residency options outside the United States.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. Material changes will be communicated to registered users via email at least 30 days before taking effect. The “Last updated” date at the top of this page indicates when the policy was most recently revised. Continued use of the platform after the effective date of changes constitutes acceptance of the updated policy. Previous versions are available upon request.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at: