Who we are
Nitro is published by OpenCart24, which is the data controller for everything described on this page. Write to [email protected] for anything to do with your data, including the requests described under Deletion and access.
What the extension sends
The Nitro extension has to ask this server whether the store it is installed on is licensed. To do that it sends four things, and only these four:
- the store domain — the storefront hostname or hostnames the OpenCart install serves;
- the email address entered in Nitro's admin, which is what a license is issued against;
- the extension version, so the admin can tell you when an update exists;
- the OpenCart version and the PHP version the store runs on — two numbers, so that support knows what it is looking at without asking you, and so we know when it is safe to stop supporting an old one.
Once a license or trial exists for a store, this server issues a token for it and the extension sends that token back on later checks. The token identifies the license. It says nothing about the store, and it is generated by us — it is not derived from anything of yours.
Like any HTTP request, a license check arrives with the network address it was sent from. We use it to rate-limit the endpoint and to cap how many brand-new trials one address can start in a day; it is not stored against your license, and it is not used to identify you.
What it never sends
The extension collects no usage statistics. It does not report page views, traffic, cache hit ratios, settings, performance measurements, product or order counts, the theme, the other extensions installed, or anything else about how the store is used or how it is doing. The two version numbers above are the whole of what it says about the server, and they are sent because a support reply is worse without them.
It sends no customer data and no order data. Your customers' names, addresses, emails, carts and orders never leave your server — Nitro reads them on your server to build pages, and there is no path in it that transmits any of that anywhere.
There is no analytics script, no beacon, no crash reporter and no third-party service inside the extension.
Your account
The first time an email address is seen by the license API, we create an account record for it so that the trial or license has an owner. That record is a shell: the address, and nothing else. It has no password and it is not verified.
There is no registration and no password. To see the licenses on an address you enter it in the customer portal and we email you a link; opening the link is what proves the address is yours. The link works once and expires after fifteen minutes. If the address has no licenses on it, that mail offers to set an account up instead, and the account is only created if you finish that form.
While a trial is running on your store, and for a short period after it ends, we send that address a few emails about it: how to tell whether Nitro is working, that the trial is about to end, and that the domain can take another one. There are four of them at most, they stop the moment you buy, and every one carries a one-click unsubscribe that ends them for good. Nothing else is ever sent to that address unless you ask for it.
A 7-day trial is recorded against the store domain it was issued for, and we keep that record — it is how one trial per domain every 30 days is enforced. What we hold is the domain, when it last took a trial and how many it has taken, and it survives the license it belonged to.
This website
This site sets no analytics, advertising or tracking cookies, and embeds nothing from a third party — the fonts are served from this domain, not from a font provider.
If you send a message through the support form, we store what you typed — your name, your email address, the subject and the message — because that is the message. Alongside it we store a salted hash of the network address it came from, so the form can be rate-limited; the address itself is not kept.
Paying for a license
Buying a license writes an order record here — the store domain, the email address you entered, the amount, and the dates the payment moved through — and the payment itself is handled by PayPal, the only third party involved in it. You approve it on PayPal's own pages: your card or PayPal account details are entered there and never reach this site. We send PayPal the amount, the currency, the store domain the license is for — it is the description on the payment — and our order reference, which PayPal prints on your receipt as the invoice number; we do not send it your email address. What comes back, and is stored with the order, is the email address of the PayPal account that paid, the country on that account, and PayPal's own identifiers for the order and the payment. We keep those because a payment has to be traceable to the license it bought, and because the address that pays is often not the address the license is issued to — that pair is the first thing we look at when you ask us about a payment. We store no card details and no copy of PayPal's reply: when a payment fails, what reaches our log is a status code and PayPal's reference for the call, never the response itself. The record of a payment outlives the license it bought — deleting a license does not delete the fact that money changed hands. What PayPal does with what it holds is its own to explain, in PayPal's privacy statement.
How long we keep it
Licenses and the accounts that own them are kept for as long as the license exists — a paid license is lifetime, so its record is too. Trial claims against a store domain outlive the trial itself, because the next 30-day window for that domain is counted from them. Support messages are kept while they are useful for supporting you, and deleted on request.
Deletion and access
Write to [email protected] from the address you want to ask about, and tell us what you want:
- A copy of what we hold for that address — the account, its licenses and any support messages.
- A correction, if something is wrong.
- Deletion of the account and its support messages.
Deleting an account deletes the licenses attached to it, which means the stores those licenses cover stop being licensed. We will say so before doing it rather than afterwards. One thing we cannot delete is the record of the trials a store domain has taken: it is not personal data — it is a domain, a date and a count — and removing it would hand a fresh trial to whoever asks for that domain next, without waiting out the 30 days.