PallasMark – Video Proof & Buyer Approval for WooCommerce

PallasMark helps WooCommerce teams document packing with photo or video evidence. An authorized
staff member manually captures proof in the PallasMark workflow while an order is being packed,
then the merchant can optionally share a completed proof with the buyer.

The evidence can help a merchant respond to an “item not as described” claim, delivery question,
return, or chargeback. It does not guarantee a dispute outcome, delivery, or recovery of funds.
PallasMark does not automatically capture every order and does not make shipping, refund, or
chargeback decisions for the store.

This plugin connects the WooCommerce store to PallasMark with a one-time connect token. After the
merchant clicks Connect to PallasMark, it registers the order webhooks that send order activity
to the configured PallasMark service. The plugin also provides the WooCommerce-side settings and
evidence views; capture and optional buyer sharing happen in the PallasMark workflow.

What this plugin does:

• Adds a WooCommerce → PallasMark settings page.
• Connects the store with a one-time token and registers order.created / order.updated
  webhooks through WooCommerce’s modern REST API (wp_api_v3).
• Re-registers only PallasMark/drProof webhooks, replacing stale copies instead of creating
  duplicates.
• Adds a read-only PallasMark evidence panel to classic and HPOS WooCommerce order screens.
• Shows proof and return-evidence status and links on customer order views when PallasMark has
  written a buyer-visible link; stores can also use [pallasmark_order_evidence].
• Supports authenticated exact lookup for order numbers, tracking values, product SKUs, and
  barcodes, with a bounded local alias index and SHA-256 lookup hashes.
• Shows local webhook health and a nonce-protected re-register action.

What this plugin does not do: it does not capture media automatically, guarantee a successful
chargeback or dispute response, stop an order from shipping, issue a refund, or decide whether a
buyer is right. Any buyer decision or shipment gate depends on the configured PallasMark workflow
and the merchant’s process. Sharing evidence with a buyer is an optional merchant action.

After connecting the store, click Connect WooCommerce inside PallasMark (Integrations) to grant
the read/write REST keys needed for PallasMark to write proof status and links back onto orders.
The webhook connection lets order data flow in; the REST keys enable write-back.

External service disclosure: PallasMark is a hosted Software as a Service product. This plugin
talks to it in two distinct ways:

1. Support telemetry (optional). It is off by default. If a store manager opts in, at most once
   every 24 hours the plugin sends this site’s public URL and plugin/WordPress/WooCommerce version
   numbers. It sends no order, customer, or product data and can be turned off at any time.
2. Store connection (explicit, your click). After you paste a connect token and click
   Connect to PallasMark, the plugin exchanges the token and store URL for a webhook secret and
   configures WooCommerce order webhooks. Those webhook payloads can include customer, billing,
   shipping, product, and order-status data for real order activity.

Use of the service is subject to the
PallasMark Terms of Service and
Privacy Policy.

Privacy

This plugin sends data to the PallasMark URL configured on its settings page (the default is
https://app.pallasmark.com) in the situations described above:

• Only after optional support telemetry is enabled: a throttled daily heartbeat containing this
  site’s URL (home_url()) and plugin/WordPress/WooCommerce version numbers only.
• After you click “Connect to PallasMark”: the one-time token exchange and, while connected,
  WooCommerce order webhook payloads that can include order/customer data.
• When PallasMark searches after a scan: the scanned identifier is sent in an authenticated
  request body. The plugin’s local lookup table stores only its SHA-256 hash; the identifier is
  not put in request URLs or stored as plain text by the index.

Deactivation, uninstall, and the explicit Disconnect action remove this plugin’s WooCommerce
webhooks and local connection credentials, stopping new order delivery. Existing evidence in
PallasMark is retained. Uninstall also removes the optional telemetry preference.