=== Rastezh Suite Connect ===
Contributors: rastezhbg
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.5.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connects WooCommerce to Rastezh Suite: risk score for cash-on-delivery orders (Shield) and a non-blocking courier address check at checkout.

== Description ==
Rastezh Suite reads your orders and products through the WooCommerce REST API after you approve the connection. The plugin shows the risk score on each order and warns the customer when the city is not in the courier list. Compatible with HPOS and the checkout blocks.

== What you see ==
* A "Растеж" menu with yesterday's numbers (orders, profit, unpicked parcels, money at the couriers) and what to do today.
* A "Риск" column in the orders list and a risk/profit box on each order (works with HPOS and legacy order storage).
* A box on each product with SEO and backup status.
* SEO basics: titles, descriptions, image alt texts and 301 redirects that you approved in Suite are applied here, but only where no other plugin owns the field (Yoast, Rank Math, All in One SEO, SEOPress, Redirection are detected and left alone). Alt text is only added to images that have none. Missing brand, return policy and other fields are added to WooCommerce's own product structured data; a second Product block is never printed.
* Ads (Реклами): where the buyer came from (UTM, landing page and, only with ad consent, the Google/Meta click ids) is saved in the order, so Suite can tell which campaign brought it and, with consent, report delivered orders to Google Ads and Meta.
* On the plugin's own page only: a dismissible suggestion of a free review, shown only when your own numbers show a real problem.

== External services ==
This plugin connects to Rastezh Suite (https://suite.rastezh.bg), a paid service for online shops run by Rastezh Digital. Nothing is sent until you press "Connect" and approve the connection in WooCommerce.

When you press "Connect", the plugin sends Suite the site address, the shop name and a one-time code. Suite then opens your site once, to check that this plugin really runs there, before it gives out the shop key. The code is deleted right after.

What is sent and when is listed under Privacy below. In short: order and product numbers when you open them, the city and street typed at checkout for the address check, SEO, image and security status, encrypted site copies, and the script for the storefront modules you turn on in Suite.

Terms of service: https://suite.rastezh.bg/terms
Privacy policy: https://suite.rastezh.bg/privacy

If you connect Microsoft Clarity in Suite, the plugin adds the Clarity script to your shop. Terms: https://clarity.microsoft.com/terms Privacy: https://privacy.microsoft.com/privacystatement

== Privacy ==
When you open an order or a product, the plugin asks the Suite service you connected for that single order or product by its WooCommerce ID. No customer data is sent in the request.
At checkout the plugin sends only the typed city and street (not the customer's name or phone) to the Suite service you connected. Orders reach Suite through WooCommerce webhooks you authorise.
For "page not found" (404) addresses the plugin keeps and sends only the address path, how many times it was hit and whether the visitor came from a Google search. No IP address, user agent, cookie or query string is stored or sent. Logged-in users, bots other than Googlebot/Bingbot and requests for files (images, scripts, .php) are not counted.
The plugin tells Suite which SEO plugin is active (name, version, which of its parts are on), so Suite never offers to write a field that plugin owns.

For ads, the plugin keeps a first-party cookie "rz_src" (30 days, HTTP-only) with the UTM parameters and the landing address of the last ad visit. Click ids (gclid, fbclid) are added to it, and gclid, _fbc, _fbp, user agent and IP are written to the order, only when the visitor explicitly allowed advertising on your consent banner. Read from: Google Consent Mode "update" (a small script copies the answer to the "rz_cm" cookie; the site's default state is never treated as an answer), the WP Consent API, Complianz, CookieYes or Cookiebot. Other banners can answer through the "rz_ads_consent" filter. No answer or "no" = no identifiers; a "no" is recorded in the order as "no". The landing address is stored without click ids. These fields reach Suite in the order through the same WooCommerce webhooks; nothing extra is sent. The wording of your banner and privacy notice is your responsibility (talk to a lawyer).

For images, the plugin makes WebP copies (at most 2000 px) of product main images on your server and tells Suite the addresses and sizes. Nothing changes on the shop until you press „Публикувай“ in Suite; „Върни“ puts the old image back. For background removal the image address is sent to Suite's image service.

For the site copy, the plugin reads your files and database every night, encrypts them on your server (libsodium, a key made on your site) and uploads them to Rastezh Suite storage. Suite keeps a sealed copy of the key so you can restore after a reinstall; file contents are never readable in storage. If WordPress does not open, our support uploads a separate rescue file that restores a copy, with a code from Suite valid 24 hours. It is not part of this plugin. wp-config.php is never overwritten.

For protection, the plugin limits login tries (5 in 15 minutes per IP and per username), hides user names from logged-out visitors and can turn off XML-RPC. Once a day it sends Suite the WordPress and plugin versions, file checksums of core and plugins, and the paths of PHP files found in uploads/. File contents are not sent. This is not a firewall (WAF).

== Changelog ==
= 0.5.1 =
* Connect: Suite gives the shop key only to a site that proves it runs this plugin. Clear messages in Bulgarian, Romanian and English when the check fails.
* Checkout: new wording of the optional email consent.

= 0.5.0 =
* Images: WebP and size on the server, background removal through Suite, publish and revert from Suite.
* Site copy: nightly encrypted copy, „Копие сега“, restore from Suite, rescue with our support when WordPress does not open.
* Protection: login limits, hidden users, XML-RPC off, daily check report, update and quarantine from Suite.

= 0.4.0 =
* Ads: UTM, landing page, gclid, fbc/fbp, user agent, IP and ad consent saved in the order (classic and block checkout), identifiers only with explicit consent.

= 0.3.0 =
* SEO basics: approved titles/descriptions/alt/redirects, 404 log, SEO plugin detection, structured data additions.
