=== HL Hunt Payment Gateway for WooCommerce ===
Contributors: hlhuntinc
Tags: woocommerce, payment gateway, credit card, hlhunt, pci compliant
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
WC requires at least: 6.0
WC tested up to: 9.3
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept credit and debit card payments through HL Hunt. PCI-compliant — card data never touches your server.

== Description ==

HL Hunt Payment Gateway for WooCommerce lets you accept Visa, Mastercard, American Express, Discover, and other major cards directly on your checkout page.

**Key Features:**

* **PCI Compliant** — Card data is tokenized client-side via PCI Vault. Raw card numbers never reach your server.
* **Simple Setup** — Enter your API keys from the HL Hunt dashboard and you're ready to go.
* **Test Mode** — Use test API keys (sk_test_xxx) to test payments without processing real charges.
* **Refunds** — Process full or partial refunds directly from the WooCommerce order page.
* **Webhooks** — Automatic order status updates via secure HMAC-signed webhooks.
* **HPOS Compatible** — Fully supports WooCommerce High-Performance Order Storage.

== Installation ==

1. Upload the `hlhunt-woocommerce` folder to `/wp-content/plugins/`.
2. Activate the plugin through the 'Plugins' menu in WordPress.
3. Go to WooCommerce → Settings → Payments → HL Hunt.
4. Enter your Secret Key and Publishable Key from the HL Hunt dashboard.
5. (Optional) Set up a webhook in your HL Hunt dashboard pointing to: `https://yoursite.com/?wc-api=hlhunt_webhook`
6. Enable the gateway and save.

== Frequently Asked Questions ==

= Where do I find my API keys? =

Log in to your HL Hunt dashboard at payments.hlhunt.org. Navigate to Developers → API Keys.

= Is this plugin PCI compliant? =

Yes. Card data is collected in the browser and sent directly to PCI Vault (a PCI DSS Level 1 certified vault). Raw card numbers never touch your WordPress server.

= How do I test payments? =

Use test API keys (sk_test_xxx / pk_test_xxx) and the test card number 4242 4242 4242 4242 with any future expiry and any 3-digit CVC.

= How do webhooks work? =

Add a webhook endpoint in your HL Hunt dashboard pointing to `https://yoursite.com/?wc-api=hlhunt_webhook`. The plugin will automatically verify the HMAC signature and update order statuses.

== Third-Party Services ==

This plugin connects to the following external services to process payments:

= HL Hunt Payment API =

When a customer places an order, the plugin sends payment data (amount, currency, vault token, order metadata) to the HL Hunt API at `https://payments.hlhunt.org` for charge creation, refunds, and status polling. This communication only occurs when a customer initiates a checkout or when a merchant processes a refund.

* [HL Hunt Website](https://hlhunt.org)
* [HL Hunt Terms of Service](https://hlhunt.org/legal/terms)
* [HL Hunt Privacy Policy](https://hlhunt.org/legal/privacy)

= PCI Vault (by SnapBill, Inc.) =

Card data entered by the customer is sent **directly from the customer's browser** to PCI Vault (`https://api.pcivault.io`), a PCI DSS Level 1 certified card vault. Raw card numbers never pass through your WordPress server. The plugin loads a JavaScript SDK (`hlhunt.js`) from the HL Hunt server to facilitate this secure tokenization.

* [PCI Vault Website](https://pcivault.io)
* [PCI Vault Terms of Service](https://pcivault.io/terms)
* [PCI Vault Privacy Policy](https://pcivault.io/privacy)

= What Data Is Sent Externally =

* **To PCI Vault (from customer's browser):** Card number, expiry date, CVC, cardholder name.
* **To HL Hunt API (from your server):** Vault token (not raw card data), charge amount, currency, order ID, order key, customer IP address, charge descriptions.
* **No data is collected or sent for analytics, tracking, or advertising purposes.**

== Changelog ==

= 1.0.0 =
* Initial release.
* Credit/debit card payments via HL Hunt API.
* PCI Vault tokenization (SAQ-A eligible).
* Full and partial refunds.
* Webhook handler with HMAC-SHA256 verification.
* HPOS compatibility.
* Test mode support.
