=== CreatesWowTech Affiliate Program for WooCommerce ===
Contributors: kvhsolutions
Tags: affiliate, woocommerce, referral, commission, payouts
Requires at least: 6.8
Tested up to: 7.0
Requires PHP: 8.2
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Affiliate program for WooCommerce with referral tracking, commissions, wallets, withdrawals, and marketing tools.

== Description ==

CreatesWowTech Affiliate Program for WooCommerce helps store owners recruit affiliates, track referred visits and orders, calculate commissions, and manage withdrawals from WordPress.

It supports referral links and affiliate coupon attribution, configurable first- or last-click tracking, percentage/fixed/hybrid commission rules, multi-tier commissions, affiliate wallets, and built-in payout workflows. The plugin is compatible with WooCommerce High-Performance Order Storage (HPOS) and Cart/Checkout blocks.

Plugin homepage: [CreatesWowTech Affiliate Program](https://www.createswowtech.com/plugin/affiliate-program-for-woocommerce/)

Developed by [CreatesWowtech](https://www.createswowtech.com).

WooCommerce is a trademark of Automattic Inc. This plugin is not affiliated with or endorsed by Automattic.

== External services ==

This plugin can optionally connect to a third-party service to generate QR code images for affiliate referral links.

= goQR.me / QR code API (api.qrserver.com) =

**What it is used for:** When a store owner enables **Generate QR** under Affiliates → Settings → Tracking, the affiliate dashboard can display a QR image for the affiliate’s referral URL.

**What data is sent and when:** The referral URL (for example your store URL with the affiliate referral parameter and optional UTM parameters) is included in a GET request to `https://api.qrserver.com/v1/create-qr-code/` whenever that dashboard QR image is loaded in a visitor’s browser. No other affiliate profile fields are sent by this plugin for QR generation. **This feature is disabled by default.** If Generate QR stays off, no data is sent to this service.

**Service provider:** Foundata GmbH / goQR.me (QR code API at api.qrserver.com).

* Terms of Service: https://goqr.me/legal/tos-api.html
* Privacy Policy: https://goqr.me/de/rechtliches/datenschutz-api.html
* Privacy overview (English): https://goqr.me/privacy-safety-security/
* API documentation: https://goqr.me/api/doc/create-qr-code/

= Optional webhooks (site-owner configured) =

If you enable webhooks and enter endpoint URLs under settings, this plugin may POST event payloads (such as affiliate, commission, or withdrawal identifiers and related metadata) only to the HTTPS public URLs **you** configure. Those destinations are chosen by the store owner; you are responsible for documenting and complying with each endpoint provider’s terms and privacy policy. No webhook traffic is sent unless you configure endpoints.

= Key features =

* Affiliate application and approval workflow
* Unique affiliate codes, referral URLs, deep links, and optional QR codes
* First-click, last-click, and multi-touch attribution settings
* Visit, conversion, campaign, and analytics event records
* Coupon-based affiliate attribution when no referral cookie is present
* Percentage, fixed, and hybrid commissions
* Product, category, brand, customer-role, coupon, and affiliate-specific rules
* Optional multi-tier commission levels and lifetime attribution
* Affiliate wallets with auditable credit and debit transactions
* Withdrawal requests with PayPal, bank transfer, store credit, and manual workflows
* Marketing creatives, affiliate coupons, audit logs, and optional webhooks
* Self-referral protection, duplicate-IP checks, refund clawbacks, and fraud flags
* My Account affiliate dashboard plus Gutenberg and Elementor integrations
* REST API endpoints for authenticated affiliate data
* Developer hooks for payout providers, commission amounts, attribution, and settings

= Privacy =

The plugin stores affiliate profile data, referral attribution data, and transactional records in your WordPress database. Depending on your configuration, this can include payment email addresses, IP addresses, user-agent strings, landing/referrer URLs, and order attribution.

Optional outbound connections are described under **External services** above (QR code API when enabled; admin-configured webhooks when configured).

Store owners are responsible for their privacy policy, retention settings, and legal obligations.

== Installation ==

1. Upload the `createswowtech-affiliate` folder to `/wp-content/plugins/`, or install the ZIP through **Plugins → Add New → Upload Plugin**.
2. Activate **CreatesWowTech Affiliate Program for WooCommerce**.
3. Ensure WooCommerce 10.0 or newer is installed and active (also declared via `Requires Plugins`).
4. On activation, the plugin creates its database tables, affiliate role, and default pages when missing.
5. Configure program, tracking, commission, wallet, payout, and fraud settings under **Affiliates → Settings**.
6. Affiliates can use **My account → Affiliate** or the generated dashboard page.

== Frequently Asked Questions ==

= Does this require WooCommerce? =

Yes. This plugin requires WooCommerce 10.0 or newer.

= Where do affiliates see their links and commissions? =

Approved affiliates can open **My account → Affiliate**, or visit the Affiliate Dashboard page created on activation.

= How are commissions created? =

When an attributed WooCommerce order is processed, the plugin creates pending commissions for eligible line items. They are approved when the order reaches the configured status (`completed` by default).

= Are QR codes sent to a third party? =

Only if you enable **Generate QR** in Tracking settings (off by default). When enabled, the referral URL is sent to the goQR.me QR code API (`api.qrserver.com`) to render the image. See **External services** for the data details and links to their [Terms of Service](https://goqr.me/legal/tos-api.html) and [Privacy Policy](https://goqr.me/de/rechtliches/datenschutz-api.html).

= Does uninstall delete my data? =

No. By default uninstall preserves program data. Define `CWTA_REMOVE_DATA` as `true` in `wp-config.php` before uninstalling to remove plugin options and custom tables.

= Why does this plugin create WordPress user accounts? =

Affiliate applications must be tied to a WordPress user so approved affiliates can sign in with a normal WordPress session and use the My Account / affiliate dashboard. The plugin does not implement a custom login flow and never auto-logs applicants in after signup.

Public account creation runs only when **Affiliates → Settings → Enable registration** is on. That setting is enforced server-side in the registration service and form/AJAX handlers (not only in the shortcode UI). Logged-in applicants always use their existing account. Guest applicants without an email match are created through core `wp_insert_user()` (which fires `user_register`) with the low-privilege `cwta_affiliate` role, honeypot + IP rate limiting, and WordPress new-user notification emails.

== Screenshots ==

1. Affiliates admin list with approval actions.
2. Tabbed affiliate program settings (general, tracking, commission, wallet, fraud).
3. WooCommerce My Account affiliate dashboard with referral link and commissions.
4. Withdrawals management and wallet activity.

== Changelog ==

= 1.0.0 =
* Initial release.
* Affiliate registration, My Account dashboard, referral tracking, commission rules, wallets, withdrawals, fraud controls, marketing assets, REST API, and extensibility hooks.
* Security hardening: nonce + capability checks on mutating requests, early field-level sanitization (including registration POST), cookie and settings input cleanup, webhooks, wallets, and roles.
* Registration: enforce `enable_registration` server-side; create guest accounts only via `wp_insert_user()` when needed; never auto-login.

== Upgrade Notice ==

= 1.0.0 =
Initial public release.
