=== Ollicom Form Builder ===
Contributors: ollicom
Tags: forms, contact form, form builder, payments, ai
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.7
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Build drag-and-drop forms, manage entries, and connect optional email, AI, payments, webhooks and Google Sheets—all free.

== Description ==

Build drag-and-drop forms, manage entries, and connect optional email, AI, payments, webhooks and Google Sheets—all free.

Ollicom Form Builder is a practical form builder by Ollicom. Start from 25 editable templates, keep entries in your WordPress database, and enable the connections you choose. Every Ollicom Form Builder feature is available without a paid plugin upgrade, submission quota or Ollicom account.

= Build a form and publish it =

* Start with 25 ready-to-edit templates for contact, support, quote requests, bookings, events, feedback, jobs, privacy requests and more.
* Arrange text, email, message, dropdown, checkbox, radio, number, date, phone and website fields with drag and drop, touch controls or keyboard controls.
* Set required fields, edit success messages and preview the form while editing.
* Create as many forms as your WordPress site needs, each with its own `[ollicom_form id="123"]` shortcode.
* Create a draft WordPress page containing a form shortcode from the form list.
* Delete a page, a form, or both together with separate confirmed actions.
* Keep the Ollicom identity visible in the WordPress admin. The optional public “By Ollicom” credit is off by default.

= Keep entries useful and under your control =

* Save submissions in dedicated tables in your WordPress database.
* Email new entries to the address you choose. Configure SMTP and send a test email without another mail plugin.
* Review local mail and integration-delivery logs. “Accepted” means WordPress handed a message to its mail transport; it does not prove inbox delivery.
* Reply to a submission directly from the WordPress admin. Review the conversation history and use the configured WordPress mail or SMTP transport.
* Ask OpenAI for an editable reply draft using the existing API key, saved knowledge and website scan. The draft is never sent until an administrator reviews and sends it.
* Export entries, payment references, AI answers and mail logs as CSV.
* Set automatic entry and mail-log retention, keep data on uninstall if you choose, and use WordPress personal-data export and erasure tools.
* Reduce basic spam with a honeypot and submission throttling.

= Accept one-time payments =

* Connect your own Stripe account or PayPal Business account; keys are entered in Ollicom Form Builder → Integrations and used server-side.
* Enable a fixed one-time payment on a form. The amount and currency are stored in the form configuration, never trusted from the visitor's browser.
* Stripe Checkout creates a server-side session. On return, Ollicom Form Builder checks the session, paid state, entry reference, amount and currency. An optional signed Stripe webhook endpoint can confirm completed sessions if the visitor closes the return page.
* PayPal uses its Orders API: Ollicom Form Builder creates an order, sends the visitor to PayPal for approval, captures it server-side and verifies the completed status, entry reference, amount and currency.
* Use Stripe test keys or the PayPal Sandbox to test before changing to live credentials. Ollicom Form Builder does not handle card details. Stripe or PayPal transaction fees and account terms apply. Review the [Stripe Services Agreement](https://stripe.com/legal/ssa), [PayPal legal agreements](https://www.paypal.com/be/legalhub/home), [Stripe Checkout documentation](https://docs.stripe.com/api/checkout/sessions) and [PayPal Orders API documentation](https://developer.paypal.com/api/rest/integration/orders-api).
* Supported payment currencies in the editor: EUR, USD and GBP. Recurring payments and variable-price products are not included in this release.

= Send outbound events and spreadsheet rows =

* Send successful form entries to one HTTPS webhook endpoint. Requests include a timestamped HMAC-SHA256 signature (`X-OlliForms-Timestamp` and `X-OlliForms-Signature`) and an idempotency key. Events are `entry.created` or `entry.paid`.
* Optionally append each successful entry to Google Sheets with a Google Apps Script web app. The Integrations screen includes an example receiver and signature check. The spreadsheet receives entry/form IDs, UTC timestamp, event, payment status and the submitted values as JSON. Review the [Apps Script Content Service guide](https://developers.google.com/apps-script/guides/content) and [Apps Script Additional Terms](https://developers.google.com/apps-script/terms).
* Inspect recent HTTP delivery results in the administrator-only integration log. Ollicom Form Builder records status and safe diagnostics, not the submitted request body.
* Webhook and Google Sheets delivery transfers form data to the endpoint or Google account you configure. Enable these connections only after reviewing data access and your privacy notice.

= Optional AI tools =

* Generate an editable draft form from a written brief and selected fields.
* Add business facts and response guidance, or scan up to 20 public pages on this same website. Schedule a daily or weekly refresh.
* Enable AI replies per form and explicitly select which non-email answers may be sent for processing. Visitors are shown a notice when AI replies are enabled.
* If the AI cannot find a reliable answer, or the AI reply email fails, Ollicom Form Builder sends the submitter a standard receipt email and still notifies the site administrator.
* Test the OpenAI API connection and inspect administrator-only diagnostics when an AI request fails.

AI is optional and forms work without an API key. The site owner supplies an OpenAI API key and pays OpenAI directly for API usage. Form generation sends the administrator's brief and field choices to OpenAI. An enabled AI reply sends only the fields selected by the administrator (email fields are excluded), plus configured knowledge, instructions and scanned website text. This content is sent to OpenAI for processing; it is not sent to Ollicom. Ollicom Form Builder uses the knowledge as answer context and does not fine-tune a model. See OpenAI's [API data controls](https://openai.com/policies/api-data-usage-policies/) and [Business Terms](https://openai.com/policies/business-terms/).

= Integrate with WordPress =

The authenticated, read-only REST API exposes forms and entries at `/wp-json/olliforms/v1/forms` and `/wp-json/olliforms/v1/entries`. Requests require a WordPress user with the `manage_options` capability. Use HTTPS and a WordPress Application Password; entry responses can contain personal data.

== Installation ==

1. Upload the `ollicom-form-builder` folder to `/wp-content/plugins/`, or upload the plugin ZIP through Plugins → Add New → Upload Plugin.
2. Activate Ollicom Form Builder.
3. Open Ollicom Form Builder → Forms, choose a template or start from scratch, arrange the fields and save.
4. Publish the form and copy its shortcode, for example `[ollicom_form id="123"]`, into a page or post.
5. Set an email destination and send a test email. Configure SMTP under Ollicom Form Builder → Settings if your host's default mail setup is unreliable.
6. To accept payments, configure Stripe or PayPal credentials under Ollicom Form Builder → Integrations, then enable a fixed one-time payment in the form editor. Start with Stripe test mode or PayPal Sandbox.
7. To send entries to another service, configure the signed HTTPS webhook or Google Apps Script receiver under Integrations. Review the included setup example and update the site's privacy notice.
8. To use AI, add an API key and test the connection. Review the privacy notice, selected AI fields, answer knowledge and website crawl schedule before enabling AI auto-replies.

== Frequently Asked Questions ==

= Is Ollicom Form Builder free? =

Yes. Form creation, 25 templates, entries, CSV exports, mail logging, SMTP settings, the REST API, payment integrations, webhook delivery, Google Sheets delivery and AI tools do not require an Ollicom Form Builder paid upgrade. Stripe, PayPal and OpenAI may charge for their own services or transactions.

= Where are form submissions stored? =

In dedicated database tables on this WordPress site. Ollicom Form Builder does not send submissions to Ollicom. If you enable email, OpenAI, a webhook or Google Sheets, the corresponding data is sent to the service configured by the site owner.

= Does Ollicom Form Builder store payment-card details? =

No. Visitors pay on Stripe Checkout or PayPal. Ollicom Form Builder stores a provider reference, payment status, amount and currency alongside the form entry. The site owner is responsible for the payment account, refund handling, tax configuration and provider terms.

= How do I test payments safely? =

Use Stripe test API keys and its test-mode webhook secret, or set PayPal to Sandbox and enter Sandbox app credentials. Submit the form with the provider's test payment method and confirm the entry status and integration log. Switch to live credentials only when your payment page and account are ready.

= What is the Stripe webhook endpoint? =

The Integrations page shows the exact site-specific endpoint at `/wp-json/olliforms/v1/stripe-webhook`. Add it in Stripe's developer dashboard, copy its signing secret into Ollicom Form Builder, and subscribe to `checkout.session.completed`; add `checkout.session.async_payment_succeeded` if you enable delayed payment methods. Ollicom Form Builder verifies the provider signature and matches the session to the saved entry before processing it.

= How are outbound webhook requests signed? =

Ollicom Form Builder sends JSON over HTTPS with an `X-OlliForms-Timestamp`, an `X-OlliForms-Signature` in the form `sha256=<hex HMAC>`, and an `Idempotency-Key`. The signature is HMAC-SHA256 of `<timestamp>.<raw request body>` using the shared secret. Reject stale timestamps and compare signatures before processing; use the idempotency key to avoid duplicate work.

= How do I connect Google Sheets? =

Create a spreadsheet, open Extensions → Apps Script, and use the example code on Ollicom Form Builder → Integrations. Set a long random shared secret, deploy the script as a web app that executes as you, and paste its deployment URL and the same secret into Ollicom Form Builder. Google Apps Script Content Service may redirect its response; Ollicom Form Builder follows a small number of redirects. Restrict access to the sheet and script deployment as appropriate for your data.

= What data is sent to OpenAI? =

Form generation sends the administrator's prompt and chosen field options. AI auto-replies send only the fields the administrator selected for AI processing (never the email field), the answer knowledge and instructions, and any scanned website text. AI is opt-in per form. The visitor-facing form displays a notice when enabled. Do not select sensitive fields unless you have a lawful basis and have explained the processing in your privacy notice.

= Does “training” fine-tune the AI model? =

No. The knowledge base, website scan and response instructions are supplied as context for each answer request. They do not fine-tune a model.

= What happens if the AI cannot answer? =

Ollicom Form Builder sends the submitter a standard “we received your message” email, records the fallback status and reason for administrators, and sends the normal submission notification to the administrator. If the fallback email also fails, that failure is recorded in the mail log.

= Can I reply to a submission from WordPress? =

Yes. Open Ollicom Form Builder → Entries and choose Reply beside a submission. Ollicom Form Builder shows the original entry and previous replies, then sends your message through the configured WordPress mail or SMTP transport. You can ask OpenAI to draft a response using your saved knowledge and website scan. The draft is editable and is sent only after you click Send reply. Only fields explicitly marked “Share with AI” are included in the AI request.

= How do I connect OpenAI? =

Save an OpenAI API key under Ollicom Form Builder → Settings and use “Test API connection”. The key remains on this WordPress site and is used server-side. You can also define `OLLIFORMS_OPENAI_API_KEY` in `wp-config.php`. OpenAI API charges are separate from any ChatGPT subscription.

= How do I access the REST API? =

Authenticate as a WordPress user with the `manage_options` capability, preferably with an Application Password over HTTPS. Use `GET /wp-json/olliforms/v1/forms` to list forms and `GET /wp-json/olliforms/v1/entries?page=1&per_page=20&form_id=123` to read submissions. Entry data can contain personal information; do not expose credentials or responses publicly.

= Can I make more than one form? =

Yes. Create as many forms as your WordPress site needs. Each form has its own numeric shortcode.

= Can I remove the “By Ollicom” credit? =

The public credit is optional and off by default. The Ollicom brand remains visible in the WordPress admin and plugin identity.

= Which SMTP provider should I use? =

Ollicom Form Builder works with standard SMTP providers. Enter the host, port, encryption and provider-issued credentials under Settings. Free plan limits and configuration can change; check the current provider documentation before relying on a quota. A successful test means the transport accepted the message, not that inbox delivery is guaranteed.

== Screenshots ==

1. See your forms, entries and email setup at a glance on the dashboard.
2. Manage forms, shortcodes, entries and linked pages from one screen.
3. Start with one of 25 editable form templates.
4. Configure REST API access and payment providers including Stripe and PayPal.
5. Set up outbound webhooks and Google Sheets delivery.
6. Build a form with drag-and-drop fields, admin notifications and optional AI answers.

== Privacy ==

Ollicom Form Builder stores form responses, administrator-written replies, and mail and integration-delivery log records in the site's WordPress database. The administrator controls retention and whether saved entries and replies are preserved on uninstall. Payment records include the provider reference, payment status, amount, currency and form submission; Ollicom Form Builder does not collect card details. The plugin does not collect IP addresses or browser fingerprints. SMTP credentials, payment API credentials and shared webhook secrets are stored on the site and used server-side. Optional OpenAI requests transfer only the administrator-selected information described above to OpenAI. AI reply drafts are sent only when an administrator requests a draft, and are not sent automatically. Enabling Stripe, PayPal, a webhook, or Google Sheets sends relevant payment or form data to that provider or endpoint. Update the site's privacy policy to identify enabled services, purposes, retention and lawful basis.

== Changelog ==

= 1.0.7 =
* Renamed the plugin to Ollicom Form Builder and adopted the approved `ollicom-form-builder` slug and text domain.
* Added the `[ollicom_form]` shortcode while retaining `[olliforms]` as a compatibility alias.
* Enqueued the test-email action through a nonce-protected link, added a fixed result notice, and tightened field schema validation and sanitization on save and read.
* Audited privileged admin-post handlers for capability checks and nonce verification.
* Improved the explicit escaping of entry conversation markup.
* Documented the safe generated SQL placeholders and read-only reply notice for Plugin Check.

= 1.0.5 =
* Sanitized the saved entry conversation markup with an explicit HTML allowlist to address Plugin Check output-escaping feedback.

= 1.0.4 =
* Removed the 100-form cap. Create forms manually, from templates or with AI without a built-in form-count ceiling.

= 1.0.3 =
* Grouped automatic AI answers and administrator replies inside each entry in the Entries list.
* Added a configurable administrator email signature for replies sent from an entry; the final signed message is saved in conversation history and included in CSV exports.
* Added accessible help text and uninstall cleanup for the signature setting.

= 1.0.2 =
* Added an admin reply workspace for each submission with conversation history, direct email sending and mail-log integration.
* Added optional OpenAI reply drafts using the saved API key, knowledge and website scan; only fields explicitly marked “Share with AI” are sent, and drafts require administrator review before sending.
* Included saved replies in CSV export, WordPress personal-data export and erasure, retention cleanup and form deletion.

= 1.0.1 =
* Separated the one-time payment settings from the AI auto-answer panel in the form editor.
* Clarified that admin submission notifications are sent automatically to the configured address, separately from AI replies to visitors.

= 1.0.0 =
* First stable release with 25 editable templates, drag-and-drop forms, entries, CSV exports, SMTP and mail logs, optional AI tools, Stripe and PayPal payments, signed webhooks, Google Sheets delivery and the authenticated REST API.
* Finalized WordPress.org readme, GPLv2-or-later license, privacy disclosures and release metadata.

= 0.6.4 =
* Documented justified custom-table database access and direct OpenAI API compatibility exceptions for Plugin Check.

= 0.6.3 =
* Made prepared REST entry queries explicit to satisfy WordPress SQL analysis.
* Clarified nonce protections for display-only admin notices and signed payment returns.
* Sanitized integration endpoint input before URL validation.

= 0.6.2 =
* Improved prepared SQL statements for plugin-owned tables.
* Hardened payment redirects and addressed Plugin Check output, CSV stream, input-validation and readme findings.

= 0.6.1 =
* Added concise, keyboard-accessible help tooltips to form, AI, email, payment, privacy and integration settings.
* Tooltips also appear for dynamically added form fields and explain their labels, placeholders, required state, choices and AI sharing.

= 0.6.0 =
* Added fixed one-time payment checkout with Stripe Checkout and PayPal Orders.
* Added server-side payment verification, signed Stripe webhook processing and protection against amount, currency, session and entry-reference mismatches.
* Added signed outbound webhooks, idempotency keys, Google Sheets delivery through Google Apps Script and administrator delivery logs.
* Added payment fields to entry exports and the authenticated REST API, plus privacy and retention cleanup.
* Added integration setup guidance, payment privacy notes, test-mode instructions and a Google Apps Script receiver example.

= 0.5.1 =
* Added authenticated read-only REST endpoints for forms and paginated submissions.
* Made the public Ollicom credit optional and off by default for WordPress.org directory compliance.
* Removed unfinished integrations from the active list and documented their availability accurately.
* Rewrote the plugin readme with installation, privacy, AI data-flow, REST API and support-fallback details.
* Fixed a duplicate unreachable return in the submission shutdown handler.

= 0.5.0 =
* Send a standard receipt confirmation when AI cannot answer or the AI email cannot be delivered.
* Mark the entry as “Fallback sent” and retain the reason for administrators.
* Continue sending the submitted question to the administrator through the normal notification email.

= 0.4.9 =
* Save notification email status immediately, before the AI reply step.
* Show AI generation and AI email sending as separate processing states.
* Mark interrupted submissions as failed with an administrator-visible diagnostic when WordPress reports a fatal error.

= 0.4.8 =
* Added admin-only diagnostics for failed AI replies, including OpenAI HTTP/API error details and request IDs when provided.
* Added AI error details to the entry CSV export.

= 0.4.7 =
* Added configurable daily or weekly scheduled refreshes for the website knowledge scan.

= 0.4.6 =
* Increased the size and weight of the Ollicom credit.

= 0.4.5 =
* Added a same-site public page scanner to provide website information as context for AI auto-replies.

= 0.4.4 =
* Added a sticky save bar to the form editor so save actions remain accessible while editing.

= 0.4.3 =
* Added separate delete actions for a linked page, a form, or a form and its page, with confirmation and related data cleanup.

= 0.4.2 =
* Fixed the OpenAI connection test by using the API's minimum-compatible output token limit.

= 0.4.1 =
* OpenAI connection tests now show safe diagnostic details for authentication, permissions, model, quota, API and server connection errors.

= 0.4.0 =
* Added visual examples for all 25 form templates, an updating live form preview and a shortcode-to-page draft creator.
* Fixed the OpenAI settings form structure and added clear saved-key feedback.

= 0.3.0 =
* Added per-form AI auto-answer, editable answer knowledge, submission and answer CSV export, test-email logging and mail-log export.
* Added mail-log retention and privacy erasure handling.
* Added a 100-form cap with individual numeric shortcodes and optional SMTP configuration, test-email and transport logging.
* Added 25 customizable form templates and accessible field reordering with drag, touch and keyboard controls.

= 0.2.0 =
* Added optional AI form generation with selected fields, required choices and editable draft output.
* Added OpenAI API key settings, model setting and connection test.

= 0.1.0 =
* First installable release with form editing, local entries, email notifications, CSV export, templates and privacy settings.