=== Bulgaro GDPR ===
Contributors: supremecommerce, freemius
Tags: gdpr, cookie consent, cookie banner, woocommerce, google consent mode
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.7.19
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

GDPR cookie consent banner, script blocker and consent register for WooCommerce, with Google Consent Mode v2 and checkout-safe detection

== Description ==

Bulgaro GDPR adds a GDPR cookie consent banner (cookie notice) to your WordPress site: it blocks analytics and marketing scripts until the visitor agrees, records every consent, and never breaks checkout.

The free plugin includes:

* A cookie consent banner with Accept, Necessary only, and category preferences — 14 languages or automatic browser detection
* Consent management with records stored as a pseudonymous SHA-256 id (no IP address) — GDPR and ePrivacy friendly
* Automatic blocking for known trackers (GA4, GTM, Meta Pixel, and others)
* Google Consent Mode v2
* A scanner that stays on your server
* Coverage for WordPress core cookies, WooCommerce, and payment providers
* A Consent Register showing how many consents were recorded and the most recent entries

Payment scripts are detected and never blocked, so checkout can finish. Covered providers include Stripe, PayPal, WooPayments, ePay.bg, BORICA, myPOS, EasyPay, Paysera, Revolut Pay, Mollie, Klarna, Adyen, Square, Braintree, Amazon Pay, Google Pay, Razorpay, PayU, 2Checkout, iCard, TBI Bank and NestPay virtual POS.

The admin screens are available in English and Bulgarian.

= Bulgaro GDPR Pro =

Bulgaro GDPR Pro is an optional paid add-on that adds:

* 10 extra banner color themes (15 in total) and 3 extra banner shapes
* Custom Scripts Manager — inject your own functional, analytics and marketing snippets, each fired only after the visitor consents to that category
* Consent Register audit tools — CSV export for audits and a configurable retention window
* A daily automatic website scan with an email alert when a new third-party tracking service appears

The free plugin is fully functional on its own; the add-on only adds the extras above. Learn more: https://supremecommerce.eu/bulgaro-gdpr/

= External services =

The core GDPR features — cookie banner, script blocker, scanner and payment coverage — work entirely on your own server and send no data anywhere. The only same-domain requests are from the built-in Website Scanner, which reads pages on your OWN site (same domain) with the user agent `BulgaroGDPR-Scanner`, and only when you start a scan from the admin. No visitor data is ever sent off your site.

Freemius (payments and licensing). The plugin uses the Freemius service to sell and manage the optional Pro upgrade: secure checkout, license activation, update delivery and (only if you opt in) anonymous usage diagnostics. On activation you are shown an opt-in screen that you can skip — the free plugin runs fully in anonymous mode and contacts Freemius only when you choose to connect, buy a license, activate one, or check for a Pro update. Data that may then be sent includes your site URL, WordPress/PHP versions, admin email and license key, used to deliver and validate your purchase. Freemius is operated by Freemius, Inc.
Terms: https://freemius.com/terms/ — Privacy policy: https://freemius.com/privacy/

The service and CDN domain names that appear inside the plugin code (for example Google Analytics, Stripe, jQuery/Swiper CDNs) are detection patterns only: they are text the scanner matches against the HTML of your own pages to recognise which third-party scripts a visitor's browser would load. The plugin never loads, enqueues or connects to any of them.

Payment and captcha hosts (Stripe, PayPal, ePay.bg, BORICA, reCAPTCHA, and the rest of the catalog) are loaded by those providers when a visitor reaches a form or checkout. This plugin does not contact them itself.

== Installation ==

1. Upload the `bulgaro-gdpr` folder to `/wp-content/plugins/`.
2. Activate Bulgaro GDPR from the Plugins screen.
3. Open Bulgaro GDPR → Settings and set the cookie policy URL.
4. Open Bulgaro GDPR → WordPress & Payments and confirm the shop's payment gateways are in the catalog.
5. Run Scan Website. Checkout, cart and a product page are included when WooCommerce is active.

Place `[bulgaro_consent_settings]` on the policy page so visitors can change their choice. Place `[bulgaro_cookie_table]` to list WordPress, WooCommerce and payment cookies. The "Create Cookie Policy page" button inserts both into a draft.

== Frequently Asked Questions ==

= Does this block card payments? =

No. Payment providers are classified as necessary and the script blocker ignores their URLs. ePay.bg, BORICA and NestPay are usually a form post; the scanner reads form actions on the checkout page.

= Does the plugin phone home? =

No. There is no license server and no remote call except the scanner reading your own URLs.

= Is the compliance score a legal guarantee? =

No. It is a technical configuration score.

== Screenshots ==

1. The consent banner on a live store — Accept all, Necessary only and Settings (14 languages, or auto-detect from the visitor's browser).
2. Dashboard: health checklist, privacy configuration score and the auto-blocking list at a glance.
3. Website Scanner: scanned URLs, detected services with consent category, detection source and recommended action.
4. Consent Register: totals, audit tools (CSV export, retention window, custom alert emails, daily auto-scan) and the most recent consents.
5. Settings: banner toggle, re-consent after policy changes and the cookie policy page.
6. Appearance: 15 color themes, 5 shapes and a live preview that shows exactly what visitors get.

== Changelog ==

= 1.7.19 =
* Improve: the Activate License screen now spans the full width, with Account and Pricing shown inside it.
* Change: removed the separate Upgrade item from the menu — upgrading is done from the Pricing section on the Activate License screen.
* Fix: reverted an activation change that could leave a freshly entered license unconnected.

= 1.7.18 =
* New: Account and Pricing now appear in full inside the Activate License screen — no more jumping to separate pages.
* Improve: entering a license key now unlocks PRO directly, without the extra email-confirmation step.

= 1.7.17 =
* Fix: license key activation on the free build — the Activate License screen returned an error (HTTP 400) because the activation endpoint was not registered on the free version; it is now always available.

= 1.7.16 =
* New: dedicated Activate License screen — paste your license key to unlock PRO (verified with Freemius).
* Change: shorter admin menu — the scanner and WordPress & Payments now live on the main screen; Account and Upgrade moved under Activate License.

= 1.7.15 =
* Improve: the settings Live Preview now sticks beside the visual controls. The Reopen button and Appearance (theme, shape, position) are grouped in one block and the preview follows as you scroll it, switches to match the control you are editing, and shows an uploaded logo (Pro) on the pill.

= 1.7.13 =
* Improve (Pro): the reopen-logo control now shows a short hint on the best image to upload (square 256×256px PNG or SVG), and the rarely used custom icon-colour field was removed to keep the setting simple.

= 1.7.12 =
* New: a one-time, dismissible review reminder in the admin, shown only after the plugin has clearly worked on your site (7+ days and at least 5 recorded consents). You can leave a review, snooze it, or dismiss it for good — it never nags.

= 1.7.11 =
* Fix (Pro): an uploaded logo on the reopen pill now shows in full instead of being squeezed into a small square — it keeps its aspect ratio at the pill height, up to a sensible max width, and loads a sharper source image.

= 1.7.10 =
* Fix (Pro): selecting an uploaded logo for the reopen pill is now saved. The logo choice is set programmatically, which did not trigger the settings auto-save; it now notifies the form so the change is stored.

= 1.7.9 =
* Fix (Pro): the "Upload logo" button on the reopen pill now opens the media library correctly. The picker script could load before the media library was ready and silently fail; it now runs reliably.

= 1.7.8 =
* New (Pro): a "GDPR" lettermark reopen icon (first Pro option). Replaced the Leaf icon.

= 1.7.7 =
* Fix: the free theme and shape names (Pure White, Sky Light, Mint Cream, Slate Gray, Bulgarian Flag, Slightly rounded, Rounded) are now translated in the Bulgarian admin, matching the Pro ones.

= 1.7.6 =
* Change: consent-export period now includes 24 months and defaults to it, matching the default 24-month retention; the other ranges stay selectable.

= 1.7.5 =
* New (Pro): the consent CSV export now has a period selector (last 1 / 6 / 12 months, or all time).
* Change: the Consent Register audit tools now carry a short explainer of their legal-evidence purpose.

= 1.7.4 =
* Fix: the Consent Register now shows the Pro audit tools (search, CSV export, retention) as a locked preview in the free version — previously they were not shown there at all.

= 1.7.3 =
* Change: the multilingual showcase always lists all 14 supported languages (plus "+ others"), even on single-language sites, so the full Pro capability is always visible. Any other site language is covered automatically via the translation plugin.

= 1.7.2 =
* Change: the multilingual AI disclosure preview now showcases all supported languages on single-language sites (and the real site languages on multilingual sites), instead of only one chip.

= 1.7.1 =
* Fix: completed the Bulgarian admin translation (a few AI-tool labels, the retention hint and "months" were showing in English).

= 1.7.0 =
* New (Pro): consent-retention quick presets (6 / 12 / 24 / 36 months) with a helper hint.
* New (Pro): scan alerts can go to multiple recipients (comma-separated) and run daily or weekly.

= 1.6.9 =
* Fix: the banner "AI Transparency" link is now translated in all 14 banner languages (previously only English and Bulgarian; others fell back to English).
* Change: AI disclosures now cover every banner language too (added Russian, Turkish, Czech), so the whole plugin is consistent.

= 1.6.8 =
* Change: the AI disclosure is now a clean, premium chip (sparkle + short label, no emoji) instead of a plain sentence.
* Change: the multilingual AI disclosure shows your site's actual active languages (Polylang / WPML / TranslatePress), not a fixed list.

= 1.6.7 =
* New: a Crown reopen icon (Pro) — the icon grid is now two full rows of six.
* Fix: the reopen pill is the same height with or without an icon (the "No icon" option is no longer shorter).

= 1.6.6 =
* Change: locked Pro options (themes, shapes, reopen icons) now show a consistent gold PRO badge instead of a padlock, matching the rest of the Pro UI.

= 1.6.5 =
* Fix: the reopen (revisit) pill is back to its original compact, premium size (an earlier version had enlarged it).

= 1.6.4 =
* Change: in the free version, Pro features are now shown as real, locked controls in their natural place (Custom Scripts textareas, AI tools, consent retention, email alerts) with a gold PRO badge — instead of a plain text list — so you can see exactly how each one looks.

= 1.6.3 =
* Change: the live-preview "Reopen" state now shows only the currently selected reopen button — centered and enlarged — and updates live as you change the icon or style (instead of a gallery of all icons).
* Change: "Sharp corners" is now a Pro shape (shown locked in the free version).
* Fix: Pro badges are now gold (brand colour) instead of blue, and shown on every locked Pro option.

= 1.6.2 =
* Fix: the live-preview "Reopen" state now reliably shows the full reopen-button gallery (asset version bumped so browsers load the new admin script instead of a cached copy). Gallery pills and the reopen button itself are larger and clearer.

= 1.6.1 =
* Fix: when both the Privacy Policy and AI Transparency links show in the banner, they are now clearly separated (a gap and a mid-dot divider) instead of running together.
* Fix: on multilingual sites, set the banner language to Auto and each language version now shows the banner — including the AI Transparency link — in its own language (follows TranslatePress / WPML / Polylang, then the browser).
* New: the live preview "Reopen" state now shows every reopen-button icon (free and Pro) on a real pill, so you can see exactly how each looks on the site; the reopen pill itself is a touch larger and more visible.
* New: the Pro reopen extras (your own logo, custom icon colour) now appear as a locked preview in the free version, so you can see what Pro adds.

= 1.6.0 =
* New: the reopen (revisit) pill can now carry an icon, in two styles — Colored and Glass/gold. Free icons: cookie, shield, settings. A third basic corner shape (Sharp) is now free too.
* New (Pro): reopen-button personalization — niche icons (diamond, gift, shopping bag, heart, paw, leaf, star), a custom icon colour, or your own uploaded logo on the pill.
* Bulgarian admin translation completed: every admin screen and field (AI Transparency, AI Register, Custom Scripts, Consent Register, the new reopen options, premium theme/shape names) is now fully translated; the per-language banner labels stay in their own language as before.

= 1.5.0 =
* New (Pro): AI auto-labeling — an "AI disclosure" toggle in the editor of posts, pages and WooCommerce products. Tick it and a small "created/assisted by AI" notice is added to the content automatically (above or below), in Bulgarian or English, with no shortcode to paste.
* New (Pro): AI Register — an internal accountability record of where your site uses AI: the AI systems you record by hand (name, provider, purpose, role), plus auto-detected declarations (the AI Transparency page, every item flagged AI-assisted, and AI-generated images), with one-click CSV export for a client or auditor.
* New (Pro): multilingual AI disclosures — the disclosure badges and the auto-label notice are shown in the visitor's language (Bulgarian, English, German, French, Spanish, Italian, Romanian, Greek, Polish, Dutch, Portuguese), picked from the active language, so they work with any translation plugin.
* New (Pro): AI image source marking — an "AI-generated image" toggle on the Media screen that embeds an IPTC source marker (Digital Source Type: trainedAlgorithmicMedia) into JPEG files and records the image in the AI Register. This marks the image source; it is not a signed C2PA credential.
* These are AI transparency/accountability aids; they do not by themselves make a site "AI Act compliant".

= 1.4.1 =
* Fix: the script blocker no longer wraps front-end page-builder edit sessions (Divi Visual Builder, Elementor, Oxygen, Bricks, WPBakery, Beaver Builder, Brizy, Thrive) in its output buffer, which could make the builder hang while editing. Blocking for normal visitors is unchanged, so consent coverage is not affected. Gutenberg was never affected.
* Improved: the generated AI Transparency page now has a fuller, clearer text (what is and isn't AI-assisted), in both Bulgarian and English, and uses the clean page template (site header kept, theme footer/sidebar skipped) like the Cookie Policy page.

= 1.4.0 =
* New (free): AI Transparency module for the EU AI Act (Art. 50). One-click generator that publishes an "AI Transparency" page explaining where your site uses AI — created in your dashboard language (English or Bulgarian), as a normal page you can edit with any builder.
* New (free): optional "AI Transparency" link in the consent banner, translated per visitor.
* New (free): [bulgaro_ai_notice] shortcode (a "you're chatting with AI" badge) and [bulgaro_ai_label] shortcode (an "AI-generated" badge) for disclosing AI on your content.
* This is an AI transparency/disclosure helper; it does not by itself make a site "AI Act compliant".

= 1.3.2 =
* Pro: new Custom Scripts Manager — add GA4, Meta Pixel or any custom snippet and tie it to a consent category; the script fires only after the visitor accepts that category (necessary scripts load immediately).
* Pro: new email scan alerts — the daily scan now emails you whenever a new third-party tracker appears on your site.
* Pro: Consent Register audit tools — searchable log (reference, date range, accepted category), CSV export of the full proof-of-consent trail, and a configurable retention window.
* Free is unchanged: all three features are part of the licensed Pro build only and ship in no part of the free download.

= 1.3.1 =
* Fix: prevented a possible "Cannot redeclare" fatal error during the free-to-Pro upgrade when both builds were briefly active. The plugin now follows the official Freemius safe-load pattern and migrates cleanly.

= 1.3.0 =
* New: Pro upgrade powered by Freemius — secure checkout, license activation and automatic Pro-update delivery. The free plugin runs in anonymous mode; the opt-in on activation is optional and skippable.
* Security: premium theme and shape code is now a separate licensed build. The 10 premium themes and 3 premium shapes no longer ship in the free download at all, so there is nothing to unlock without a real license.
* All existing free features are unchanged (5 themes, 2 shapes, banner, script blocker, scanner, payment coverage, consent register).
* readme: documented the Freemius service under "External services".

= 1.2.6 =
* Compliance: inline CSS is now enqueued via the WordPress functions (shared assets/css/public.css); the Google Consent Mode snippet is printed with wp_print_inline_script_tag(); load_plugin_textdomain() removed (WordPress.org auto-loads translations).
* The scanner's internal catalog no longer stores CDN host names as contiguous strings (they are detection patterns, not loaded resources) to avoid false "remote file" flags. No functional change.

= 1.2.0 =
* The premium features (the extra banner themes and shapes, the Custom Scripts Manager, and the Consent Register audit tools) now live entirely in the separate Bulgaro GDPR Pro add-on. The free plugin no longer bundles any locked premium code — it exposes extension points the add-on hooks into. All existing free features are unchanged.

= 1.1.0 =
* New: Consent Register admin page — total consents, last-30-days count and the most recent entries (date, accepted categories, policy version). PRO unlocks a searchable log, CSV export for audits, and a configurable retention window.
* PRO: auto-scan alerts can now be sent to a custom list of email addresses (comma-separated); leave it empty to use the site admin email.
* Hardening: the public consent endpoint is now rate-limited per source, a returning visitor updates their own record instead of creating a new row, and a daily maintenance task prunes records past the retention window — the consent table can no longer grow without bound.
* Reliability: the script blocker never emits an empty page if the HTML rewrite hits a PCRE limit on a very large page (falls back to the original HTML).
* Payment safety: inline scripts are matched only by tracker function signatures, and any inline script that references a payment/captcha host is left untouched — a bank/3DS snippet can never be caught by a broad tracker id.
* New detections: Criteo, Adform and Smartlook added to the catalog and the blocking ruleset.
* Admin: minor output-escaping hardening on the settings screen.

= 1.00.11 =
* Bug fix: clicking "Create Cookie Policy page" on a site that already has a policy page (slug cookie-policy or politika-za-biskvitki, created by hand or by another tool) no longer creates a duplicate "cookie-policy-2" page — the existing page is found and linked into the banner instead.

= 1.00.10 =
* Plugin and author links now point to the real home of the project — supremecommerce.eu (plugin page + author URI), instead of the old placeholder domain.

= 1.00.09 =
* The PRO badges on premium themes, shapes and the Custom Scripts Manager now appear only while those features are locked — with an active PRO license (or the owner's BGDPR_PRO_OWNER key) the settings screen looks native, without upsell labels.

= 1.00.08 =
* Scanner page polish: shorter title, last-scan time in a human format ("date, time — X ago"), a staleness hint when the scan is over 14 days old, a collapsible list of the exact scanned URLs, and an explicit green "Clean" state when nothing needs attention. Dashboard: the duplicated "Last scan" line was removed from the checklist (it lives in the score sidebar, now also in human format).

= 1.00.07 =
* The scanner now recognizes common UI libraries loaded from public CDNs (Slick Carousel, jQuery, Swiper, Owl Carousel 2) as necessary interface libraries — they no longer appear as unknown services needing manual review. Matching is path-qualified, so generic CDN hosts like cdn.jsdelivr.net are still flagged when they serve anything else.

= 1.00.06 =
* The example cookie table on the WordPress & Payments screen is now collapsible, same as the payment provider catalog — the page stays short and tidy.

= 1.00.05 =
* WordPress & Payments screen cleaned up: only active cache/optimization plugins are listed, inactive states are neutral gray instead of red, detected payment providers appear in a compact "On this site" block, and the full provider catalog moved into a collapsible section. Fixed the outdated cookie-table description.

= 1.00.04 =
* PRO split groundwork: the 10 premium themes, 3 premium shapes and the Custom Scripts Manager are now visible but locked in the free version (server-side enforced). Sites already using a premium shape/theme or saved script snippets keep them working (grandfathered). The future PRO add-on will unlock them via the new bgdpr_is_pro filter.

= 1.00.03 =
* Removed the premature "PRO" badges from Automatic Language Detection and Export/Import — both are full free features. PRO badges remain only on the premium themes, premium shapes and the upcoming Custom Scripts Manager.

= 1.00.02 =
* The Cookie Policy link now also appears in the Preferences view — after a visitor has consented, the page stays reachable via the floating "Cookies" button (previously the link existed only in the first banner view).

= 1.00.01 =
* First stable release — version numbering milestone; functionality identical to 0.10.10.

= 0.10.10 =
* Fix: the "Cookie settings" reopen link inside generated Cookie Policy pages now renders in the page's own language (e.g. "Настройки на бисквитките" in Bulgarian pages) instead of always following the site locale.

= 0.10.9 =
* Cookie Policy generator: the technical cookie-inventory table is no longer inserted into the generated page — section 4 now explains the cookie categories in plain language (the [bulgaro_cookie_table] shortcode remains available for sites that want the full table).
* Clean page template: generated pages now render through the plugin's own template — the site header and navigation stay, but theme footer widget areas and credits ("Archives", "Categories", "Designed by …") never appear, on Divi, Elementor, block (FSE) and classic themes alike. Existing generated pages are migrated automatically.

= 0.10.8 =
* The Preferences view is now identical in every banner position on desktop and tablet: float-left and float-right cards widen to the bottom-bar width and show the same 2-column category grid (mobile keeps the single column everywhere).

= 0.10.7 =
* Fix: the Bulgarian admin translation file (.mo) was structurally rejected by WordPress's MO reader (missing hash-table offset), so the BG/EN admin language switcher showed Bulgarian as selected but the panel stayed in English — rebuilt the translation file, Bulgarian now renders correctly.
* Live preview: desktop, tablet and mobile now share the same fixed-size preview window — the mobile view no longer looks cut off.

= 0.10.6 =
* Cookie Policy generator: the generated page now renders clean on any platform — no sidebar on Divi, Elementor's header/footer template when Elementor is active, automatic full-width/no-sidebar template selection on classic and block themes, and comments/pingbacks disabled under the policy text.

= 0.10.5 =
* Cookie Policy generator: the page is now published immediately with a clean /cookie-policy/ URL (no more drafts with ?page_id= addresses), follows the clicking admin's language, contains no guessed company data (clear placeholders instead), has no duplicated in-content title, and is created without a sidebar on Divi-based sites.

= 0.10.4 =
* Settings cleanup: the "Hidden" reopen-button option is removed (withdrawing consent must be as easy as giving it) — the "Cookies" pill is now the single, always-on revisit style.
* Settings cleanup: removed the "Cookie lifetime (days)" and "Policy version" fields (fixed 365-day lifetime, policy version is now managed internally; enabling "Require re-consent" bumps it automatically on save).
* Live preview: the Desktop tab now renders the true desktop layout (real 1200px viewport scaled to fit) instead of looking like the mobile view.
* Cookie Policy generator: the "Create Cookie Policy page" button now builds a complete, real policy page (9 sections, EN or BG depending on the site language, cookie table shortcode included), detects existing pages that already contain the consent shortcode, and shows a "View page" link when a policy URL is set.

= 0.10.3 =
* Polish: banner icon removed for a cleaner text-first layout; the whole category row in Preferences is clickable (bigger touch target); tighter row spacing; 38px button height; visible keyboard focus on buttons and toggles; mobile safe-area-inset support.
* Fix: an over-specific CSS reset (#bgdpr-banner *) was zeroing the designed paddings/margins inside the banner — the banner now renders with proper spacing on all pages; bottom/top bar widened to 720px so longer translations fit; float-card category list switches to one column to prevent text overlap.
* Removed the "Icon only" reopen-button style — the text pill ("Cookies") is now the single revisit style, which is also the legally safest option.

= 0.10.2 =
* Reopen pill is now text-only (no icon) with a one-word label: "Cookies" translated into all 14 banner languages.

= 0.10.1 =
* New banner languages: French, Polish and Czech (14 languages in total).

= 0.10.0 =
* WordPress requirements: core and WooCommerce cookies, cache-plugin exclusions, HPOS and checkout blocks already declared.
* Payment coverage for Bulgarian and EU checkouts. Payment scripts are never blocked.
* Scanner reads checkout form actions (ePay.bg, BORICA, NestPay).
* Shortcode `[bulgaro_cookie_table]` for the cookie policy page.
* Uninstall removes scan data and the admin language preference.
* Tested on WordPress 7.1.

= 0.9.1 =
* Consent banner, script blocker, website scanner and compliance score.
