Privacy policy

Effective 21 October 2026

GSP OpenCart Migration (“the App”) is provided by GspTechnologies (“we”, “us”). It copies data from a merchant's OpenCart store into their Shopify store. This policy explains what information the App handles when a merchant installs and uses it, and the choices merchants have.

1. Information we collect

From Shopify, when you install the App

• Your shop domain (for example your-store.myshopify.com) and an access token that lets the App act on your store with the permissions you approve during installation.
• Store settings needed for the migration: store currency, inventory locations and sales channels.
• Subscription status from Shopify Billing (plan name and whether it is active). Payments are processed by Shopify; we never see or store card or bank details.

Information you give us

• If you connect with our OpenCart extension: the connection code shown on the extension's page in your OpenCart admin. It contains your store URL, the address of the extension's endpoint and a secret key that the extension generated inside OpenCart. We store these three values with your migration, encrypted with AES-256-GCM. You can invalidate the code at any time with Generate new key in OpenCart.
• If you connect with the bridge file: the URL of your OpenCart store, the address of the bridge file if you uploaded it somewhere else, and a secret bridge key that the App creates for your Shopify store and places in the file you download (gsp-bridge.php). The key is encrypted with AES-256-GCM before it is stored, and you can replace it at any time with Regenerate key.
• Your migration choices (which data types to migrate) and anything you send to our support address.

The OpenCart extension and the bridge file

OpenCart has no API that can read a whole store, so the App reads it through a small piece of code on your server (the “bridge”). On OpenCart 3 you install our extension (gsp-shopify-migration-oc3.ocmod.zip) from your OpenCart admin; on other versions you upload the PHP file gsp-bridge.php to your OpenCart folder. Both run the same code. The bridge is read-only: it only runs read queries on a fixed list of store tables (products, categories, customers, addresses, orders, coupons, information pages and related settings such as currencies and order statuses), and answers only requests signed with your key. It never reads customer or admin passwords, password salts or login tokens, API keys, sessions, or your payment, shipping and extension settings, and it never changes anything in your store. The extension keeps working while your store is in maintenance mode. Uninstalling the extension in OpenCart deletes its key, so access stops immediately; you can delete the bridge file at any time. We recommend doing one or the other once your migration is finished.

Store data processed during a migration

When you run a migration, the App reads from your OpenCart store through the bridge and writes to your Shopify store: product names, descriptions, options, prices, SKUs, models, barcodes, stock levels, weights, images, tags, manufacturers, attributes, categories, information pages and SEO data (meta titles, descriptions and SEO keywords). This data is transferred directly from OpenCart to Shopify and is not kept on our servers after it has been written. Product images, and images used in pages, are fetched by Shopify directly from their original URLs and stored in your Shopify store.

To make migrations reliable and repeatable, we keep:

• An ID map linking each OpenCart record ID to the Shopify record created from it, so running a migration again updates records instead of duplicating them.
• Migration history: status, progress counts, and a report of warnings and errors that refers to records by their OpenCart ID.
• The OpenCart store URLs you have migrated from, used to apply your plan's store limit.

Customer personal data

If you choose to migrate customers or orders, the App reads your customers' names, email addresses, phone numbers and billing/shipping addresses, and your order history (items, amounts, taxes, shipping, discounts, payment method name and status), from OpenCart and creates them in your Shopify store. We process this information only to perform the migration you request, on your behalf, as your data processor:

• Customer and order details are transferred directly to Shopify and are not stored on our servers. We keep only OpenCart IDs linked to the Shopify IDs (so re-running a migration updates instead of duplicating), and report lines that refer to customers by their OpenCart ID.
• Email-marketing consent is never invented: customers are not subscribed to marketing unless the source data records an opt-in.
• Customer passwords and payment details are never read or migrated: the bridge strips password, salt and token columns before anything leaves your server.
• We do not contact your customers. Account invitations are only sent if you choose to send them from Shopify.

Technical data

Like most web services, our servers and hosting provider record basic request logs (such as IP address, timestamp and requested page) to operate and secure the service. These logs are kept for a limited time and are not used for advertising.

2. How we use information

• To perform the migrations you start, and to show their progress and reports.
• To let you resume, re-run or update a migration without creating duplicates.
• To manage your subscription and apply your plan's limits.
• To provide support when you contact us, and to diagnose and fix problems.
• To keep the App secure and prevent abuse.

We do not sell your information, use it for advertising, or use your store data to train machine-learning models.

3. Sharing

We share information only with:

• Shopify: the platform the App runs on, which receives the data the App writes to your store.
• Infrastructure providers that host our servers and database, under agreements that require them to protect the data and use it only to provide their service to us.
• Authorities, when required by law, or to protect our rights, users or the public.
• A successor organization if GspTechnologies is involved in a merger or acquisition, subject to this policy.

4. Retention and deletion

• You can delete any migration from your history inside the App at any time. This removes its record and report.
• Uninstalling our extension in OpenCart deletes its key there, so the App (or anyone holding the connection code) can no longer read your store, immediately.
• When you uninstall the App, running migrations are stopped, and your stored OpenCart connection details (including any connection code's endpoint, store URL and key) and your bridge key are deleted immediately; your Shopify access tokens are removed too. An old bridge file left on your server then no longer works with the App. The extension's key lives in OpenCart, so uninstall the extension there as well. Shopify then sends us a data-deletion request (shop/redact) 48 hours after uninstall, and we permanently delete all remaining data for your store: migration history and reports, the ID map, source store records and our copy of your purchases.
• Shopify data-protection requests about individual customers (customers/data_request and customers/redact) are answered promptly. Because the App does not store customer details, there is nothing to export; on a redact request we delete the ID link and report lines for that customer.
• Products and collections created in your Shopify store belong to you and stay there unless you delete them.

5. Security

• All connections use HTTPS. Requests from Shopify are verified with Shopify's signatures.
• Your bridge key, connection code and store connection details are encrypted at rest (AES-256-GCM).
• Every request to the extension or bridge file is signed with your key (HMAC-SHA256) and is only accepted for ten minutes, so it can't be replayed; unsigned requests learn nothing beyond the fact that the file exists.
• The bridge is read-only; the App never writes to your OpenCart store or its database.
• Access to production systems is limited to staff who need it to operate the service.

No system is perfectly secure. If we learn of a security incident affecting your data, we will notify you and the relevant authorities as required by law.

6. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or California privacy laws), you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to complain to a data-protection authority. To exercise these rights, email contact@gsptechnologies.com. We respond within 30 days.

If you are a customer of a merchant using the App, please contact that merchant first: they control their store data. We will help them respond to your request.

7. International transfers

Our servers and providers may be located outside your country. Where required, we use appropriate safeguards, such as standard contractual clauses, for international transfers of personal information.

8. Children

The App is a business tool for merchants and is not directed to children under 16.

9. Changes to this policy

We may update this policy as the App changes. We will change the effective date above and, for significant changes, notify merchants in the App or by email.

10. Contact

GspTechnologies
Address to be added
Email: contact@gsptechnologies.com