Bouzin Pay

Description

Bouzin Pay connects WordPress to Stripe and brings the essential commerce tools into one clear administration interface.

Main features:

• Stripe OAuth connection, with separate TEST and LIVE modes.
• Dashboard, products, prices, Checkout and Payment Links.
• Payment-method management from WordPress.
• Customers, invoices, subscriptions, refunds and promotion codes.
• Customer account with purchases, invoices and subscription access.
• Optional stock management.
• Optional Digital Files for protected downloads.
• Optional Protected Content for pages, posts, blocks and supported custom fields.
• Optional Licences & private updates.
• Optional Booking and photo-selling tools.
• French translations included.

Optional modules are disabled by default, so each site can enable only the features it needs.

Bouzin Pay does not store full card or bank details. Payments remain processed by Stripe.

Security

• Separate test and live keys.
• Server-side validation of products, prices, status, associations, and mode.
• WordPress access is granted only after confirmation of a paid and trusted Checkout Session.
• Signed webhooks with atomic deduplication and controlled retries.
• Idempotency keys for Stripe creation and action requests.
• Separate WordPress capabilities for sensitive operations.
• Redacted technical logs that exclude API keys, webhook secrets, signatures, client secrets, and payment methods.
• Signed checkout configuration and ownership checks before protected digital content is displayed.
• Authenticated, rate-limited digital delivery from encrypted containers whose storage path is never exposed to customers.

External service

This plugin connects to Stripe to create and manage payment-related objects and to process checkout and customer portal requests. Data sent to Stripe can include customer contact information, product and price identifiers, transaction details, subscription details, and request metadata required to perform the selected operation.

Stripe is an external service. Its use is subject to the Stripe Services Agreement and Stripe Privacy Policy.

If the administrator explicitly clicks Connect Stripe with Bouzin Pay, the plugin also contacts https://bouzin.ch/wp-json/bouzin-pay-connect/v1/. This optional connection service receives the WordPress site URL, a random installation identifier, the selected TEST/LIVE mode, the Stripe account identifier returned by OAuth, and an OAuth refresh token encrypted at rest on the service. Stripe App connected-account events are received centrally on bouzin.ch, verified with Stripe’s signing secret, then forwarded to the matching WordPress installation with a per-installation HMAC. If a site is temporarily unavailable, the raw event payload is encrypted while queued for retry and removed after successful delivery. Customer, payment, invoice, subscription, product and checkout API operations are not proxied through bouzin.ch; they continue directly from the merchant WordPress site to Stripe. Administrators can instead keep using manual Stripe credentials and never call this service.

If an administrator adds a product image hosted by another provider, visitors’ browsers contact that image host when the shop is displayed. The administrator is responsible for disclosing that provider where required.

Cart browser requirements

The central cart requires HTTPS, enabled first-party local storage and Web Locks support (current Chrome, Edge, Firefox and Safari). It stores a random attempt identifier, mode and public order reference, without contact details, so a reload or another tab can resume the same payment. Do not clear browser storage while a payment is unresolved. Legacy integrations calling the cart Checkout REST endpoint must send a 64-character random hexadecimal attempt_id and the selected mode; retries keep that identifier.

Development

Readable, uncompressed JavaScript and CSS source for every generated frontend asset is included in the source directory. The source-to-bundle mapping and build instructions are documented in source/README.md; the exact npm dependency and build commands are declared in package.json and locked in package-lock.json.

The catalogue assets in catalogue/assets are readable runtime source and require no bundling. Its PHP source, CSV examples and gettext generation script are included.

Credits and licenses

Bouzin Pay is derived from WPMarmite Pay 1.5.5. The original work is Copyright (C) 2024 WPMarmite, and the Bouzin Pay modifications are Copyright (C) 2026 Bouzin. WPMarmite is not affiliated with and does not provide support for Bouzin Pay.

Third-party copyright and license notices for Stripe PHP, Composer, Terser, and the included CA certificate bundle are provided in THIRD-PARTY-NOTICES.txt.

Privacy

Bouzin Pay can store Stripe identifiers, customer contact details, payment states, invoices, subscriptions, related object summaries, redacted logs, and webhook processing history in the WordPress database. It does not store full card numbers or full bank details.

When the optional one-click Stripe connection is used, the WordPress site stores an encrypted short-lived OAuth access token plus the Stripe account/connection identifiers. The central Bouzin Pay connection service at bouzin.ch stores the corresponding OAuth refresh token encrypted at rest and the minimum installation metadata needed to return refreshed access. It also receives signed Stripe App connected-account events and forwards them to the matching WordPress installation. Event payloads are encrypted only while queued for retry and are removed after successful delivery. The service is not used as a proxy for payment, customer, product, invoice, subscription or checkout API calls. Manual credentials remain available and do not require this service.

Protected digital content is linked to a Stripe product and remains subject to a server-side ownership check on each request. The plugin stores encrypted file metadata, purchase entitlements, refund state and an aggregate download count, but no IP address in digital download records. Invoice files and hosted invoice pages are delivered by Stripe and are not copied into the WordPress media library.

When the optional Protected content module is enabled, Bouzin Pay stores the selected product identifiers in page/post metadata and, where used, protected Gutenberg/ACF/Meta Box configuration. Access is evaluated from the same confirmed purchase and active-subscription records already associated with the signed-in WordPress account. The customer My content library lists only published destinations currently unlocked for that account.

Optional inventory stores product/session identifiers, quantities, revisions and durable deduplication records. A pending checkout creation request, which can include an email/customer identifier and return URLs, is encrypted locally until its session is recovered. Once the session is known, this payload is cleared. Unknown payments retain their reservation and recovery data for administrator review; no browser cancellation or local time limit silently releases them. Terminal stock attempts and paid/released reservation records are removed after 180 days in bounded daily batches; pending and uncertain payments are never removed automatically.

When the optional Licences & private updates module is enabled, Bouzin Pay stores licence identifiers and status, related product and purchase/subscription references, the associated WordPress user ID, and activation information such as site/home URLs, instance identifiers and plugin/WordPress versions. Manually granted licences can additionally store an optional recipient email address and a short administrator note; they do not create a Stripe payment or fake order. Activation tokens are kept as one-way hashes; a recoverable copy of the full licence key can be stored encrypted. The licence module does not use the visitor IP address as its licence identity. Private plugin releases additionally store release metadata and guarded ZIP packages locally. Eligible customers can download the current release from their Bouzin Pay account while the associated licence is valid.

When the optional Booking module is enabled, Bouzin Pay stores the service, appointment start/end time, booking status and, when applicable, payment/order linkage. Booking contact data such as email, customer name, phone number and an internal note are encrypted at rest when they are collected. Paid slot holds expire automatically; no-payment, manual, confirmed or cancelled booking records remain under the site administrator’s control and follow the plugin’s explicit full-removal setting on uninstall.

The plugin adds suggested privacy-policy text in the WordPress privacy guide. Site administrators remain responsible for adapting that text to their actual configuration and legal obligations.

The WordPress personal-data tools export local customer snapshots and purchase access, including customer records without a remaining WordPress account. Erasure removes contact details, free text, metadata and invoice download URLs from the local cache and removes the WordPress purchase/subscription associations. The same cleanup runs on account deletion. Unresolved encrypted checkout recovery must be resolved first; the eraser reports retained data instead of deleting payment recovery state.

Once a successful refund has revoked purchase access, a later refund delivery or bank refund failure does not automatically restore that access; the merchant must resolve the failed refund with the buyer.

Minimal financial identifiers and amounts, revoked purchase tombstones and keyed erasure fingerprints remain locally until explicit full removal of plugin data. These pseudonymous records prevent duplicate settlement, delayed webhook access restoration and reimport of erased contact details. The privacy eraser explicitly reports this retention. The suppression key is stored separately from WordPress authentication salts. Regular synchronization keeps other customer summaries until erasure or complete plugin-data removal; the merchant must define any further retention required for their business. No local privacy operation cancels billing or deletes Stripe’s records. A fresh authorized Stripe lookup in the administration can still retrieve records retained by Stripe.