SMT Toolkit for WooCommerce

SMT Toolkit for WooCommerce provides independent modules for store management, pricing, checkout, customer engagement and integrations. Enable only the modules your store needs.

Available modules include scheduled discounts and promotions, role-based pricing, rewards, wishlist, AJAX catalog navigation, cart recovery, newsletters, social integrations, product imports, store configuration, AI product search, and an optional CRM connection.

Monopay and LiqPay provide hosted payment pages, verified bank notifications, payment status checks, manager-confirmed full or partial refunds, bank receipts, and closing or blocking outdated unpaid payment attempts. Refunds start only after a manager confirms the action. Unknown outcomes block duplicate requests.

Monopay receipts are downloaded as PDF; LiqPay sends receipts only to the signed-in manager’s profile email, never to the customer. LiqPay’s documented receipt API does not return a PDF or download URL. Closing a LiqPay checkout form blocks access on the site, while an already opened bank page may remain payable until expiry. Existing payments from other gateway plugins are not migrated.

Configure payment keys in WooCommerce > Settings > Payments after enabling the module. Finish outstanding old-gateway payments before switching. Detailed module features, migration instructions and operational limits are included in MODULES.txt.

Optional external services and their data use are documented in the External Services section. AI Search uses a store-configured OpenAI key. CRM endpoints require authentication and a dedicated service role with narrowly scoped read/write permissions. Period-wide payment reconciliation belongs in the CRM.

The plugin includes Ukrainian translations. WooCommerce-dependent modules require WooCommerce to be active.

External Services

Monopay / LiqPay (optional)

When enabled and configured, Monopay sends the order reference, amount, currency, payment description and callback/return URLs to api.monobank.ua. The customer pays on the bank-hosted page. LiqPay sends equivalent signed checkout data to www.liqpay.ua and uses its server API for status checks. Merchant credentials authenticate server requests; private credentials are never included in checkout forms or logs. No card details are collected by SMT Toolkit. Requests occur when starting a payment, receiving a notification or checking status manually/by cron.

Documentation: https://api.monobank.ua/docs/acquiring.html and https://www.liqpay.ua/doc/api/information/status_payment
Provider terms/privacy: https://monobank.ua/terms and https://www.liqpay.ua/uk/information/user

This plugin connects to external services to provide its functionality.

Google Drive API

The Google Drive Importer module connects to the Google Drive API to allow users to import files and images from their own Google Drive accounts into WooCommerce.

What data is sent:
– Google Drive file IDs
– Google Drive folder IDs
– API key supplied by the site owner

When data is sent:
– When an administrator starts an import manually
– When an administrator-configured scheduled import runs

Why data is sent:
– To retrieve selected files and images from the user’s Google Drive account

Service provider:
– Google LLC

Terms of Service:
https://policies.google.com/terms

Privacy Policy:
https://policies.google.com/privacy

OpenAI API

The AI Search module connects to the OpenAI API to parse natural-language search queries and, when enabled, build a semantic embeddings index from your product catalog.

What data is sent:
– Customer search queries typed into the AI Search widget, used for intent parsing
– Product titles, short descriptions, brand and taxonomy terms, used for embeddings indexing (no customer account data)
– API key supplied by the site owner

When data is sent:
– When a visitor submits an uncached search query that is long enough to use AI parsing
– During an index build or rebuild, manually triggered by an administrator or by an admin-configured cron task
– Short/local-only searches and cached searches may be handled without an OpenAI request

Why data is sent:
– To convert natural-language search text into structured WooCommerce filters
– To compute vector embeddings used for semantic matching

Service provider:
– OpenAI, L.L.C.

Terms of Service:
https://openai.com/policies/terms-of-use

Privacy Policy:
https://openai.com/policies/privacy-policy

Nova Poshta API (optional)

The Store Settings module can connect to the Nova Poshta API to provide city autocomplete and a warehouse/parcel-locker picker during Classic checkout.

What data is sent:
– Nova Poshta API key supplied by the site owner
– City search text entered by the visitor
– Selected settlement reference when loading warehouses

When data is sent:
– Only when the Nova Poshta picker is enabled and a visitor searches for a city or loads warehouses

Why data is sent:
– To find Nova Poshta settlements, branches and parcel lockers

Service provider:
– Nova Poshta LLC

API License Agreement:
https://static.novaposhta.ua/sitecard/misc/doc/API_license_agreement.pdf

Privacy Policy:
https://static.novaposhta.ua/sitecard/misc/doc/Privacy_policy.pdf

Social Login Providers (optional)

The Social module can optionally connect to Google and Facebook for one-click login. These connections only run when an administrator has configured the corresponding OAuth credentials and a user clicks the login button.

What data is sent:
– OAuth token round-trips initiated by the visitor’s click

When data is sent:
– Only on explicit user action (clicking a social-login button)

Why data is sent:
– To authenticate the user via the chosen provider

Service providers:
– Google LLC: https://policies.google.com/terms / https://policies.google.com/privacy
– Meta Platforms, Inc. (Facebook): https://www.facebook.com/legal/terms / https://www.facebook.com/privacy/policy/

Social Publishing, Instagram Feed and Sharing Links (optional)

The Social module can publish newly created posts or products to configured social accounts, retrieve an Instagram Business feed, and create visitor-initiated sharing/contact links. Nothing is sent unless the relevant feature and provider are configured; sharing and contact links send data only after the visitor clicks them.

What data is sent:
– Site owner credentials or access tokens for enabled publishing/feed providers
– Published post or product title, permalink and generated sharing message
– Instagram Business account ID when retrieving feed items
– The current page URL, sharing text or configured contact identifier when a visitor clicks a sharing/contact link

When data is sent:
– After a post or product is first published and automatic publishing is enabled
– When an enabled Instagram feed is loaded or its cache is refreshed
– When a visitor explicitly clicks a social sharing or contact link

Why data is sent:
– To publish content, retrieve configured Instagram media, or open the selected third-party sharing/contact service

Service providers:
– Meta Platforms, Inc. (Facebook, Instagram, Threads and Messenger): https://www.facebook.com/legal/terms / https://www.facebook.com/privacy/policy/
– X Corp.: https://x.com/en/tos / https://x.com/en/privacy
– LinkedIn Corporation: https://www.linkedin.com/legal/user-agreement / https://www.linkedin.com/legal/privacy-policy
– Tumblr, Inc.: https://www.tumblr.com/policy/en/terms-of-service / https://www.tumblr.com/privacy
– Mastodon: the service provider, terms and privacy policy depend on the instance URL configured by the site owner
– Telegram Messenger Inc.: https://telegram.org/tos / https://telegram.org/privacy
– Viber Media S.a r.l.: https://www.viber.com/en/terms/ / https://www.viber.com/en/terms/viber-privacy-policy/
– WhatsApp LLC: https://www.whatsapp.com/legal/terms-of-service / https://www.whatsapp.com/legal/privacy-policy

Google and Meta Analytics Scripts (optional)

The Store Settings module can load Google Analytics/Google Ads and Meta Pixel scripts after interaction when a site owner enables delayed analytics and supplies the corresponding IDs.

What data is sent:
– Configured measurement, advertising or pixel ID
– Page, browser, device, cookie and interaction data collected by the enabled provider’s script according to that provider’s configuration and policies

When data is sent:
– Only when the site owner enables the corresponding analytics integration and the delayed script is loaded in a visitor’s browser

Why data is sent:
– To provide analytics, advertising measurement and configured conversion tracking

Service providers:
– Google LLC: https://policies.google.com/terms / https://policies.google.com/privacy
– Meta Platforms, Inc.: https://www.facebook.com/legal/terms / https://www.facebook.com/privacy/policy/