BitLuso Pay

BitLuso Pay adds Bitcoin and Lightning as a payment method at your WooCommerce checkout.

The customer chooses BitLuso, is sent to a payment page hosted by BitLuso, pays there, and comes
back to your order confirmation. Your shop never handles an address, an invoice or a private key,
and no card or wallet details are entered on your site.

How an order is settled

The customer’s return to your shop does not mark the order paid — they may close the tab or lose
signal. BitLuso calls your shop back over a signed HTTPS request instead, and the order moves only
on that:

• Payment detected — the order goes on hold while the transaction confirms.
• Payment settled — the order is completed, stock is reduced and your usual WooCommerce emails go out.
• Payment late or partial — the order goes on hold with a note explaining what happened, so money a customer really sent is never quietly discarded.
• Payment reverted — the order goes back to pending, because a transaction that was detected can still be replaced before it confirms.
• Payment expired or cancelled — the order is cancelled.

The plugin checks the amount and the currency against the order before completing it, and refuses a
payment that does not match.

Setup

Two fields. Paste the API key and API secret from your BitLuso dashboard into
WooCommerce → Settings → Payments → BitLuso Pay and save. Saving verifies the credentials and
registers your shop’s callback URL with BitLuso for you — there is no URL or secret to copy in the
other direction.

Refunds

Refunds are issued from your BitLuso dashboard, not from WooCommerce. A crypto refund needs a
destination address that your shop does not have, so the plugin reports an error rather than
recording a refund that never happened.

External service

This plugin is a client for BitLuso, a payment service operated by BitLuso
(https://bitluso.pt). The plugin is not useful without a BitLuso merchant account: the payment
page and the settlement run on that service. The funds do not — payments go directly to your
wallet.

Your site contacts https://portal.bitluso.pt in exactly three situations, and at no other time:

1. When you save the settings screen with the gateway enabled. Your API key is sent so the
   credentials can be verified, together with your shop’s callback URL so BitLuso knows where to
   report payments. Nothing is sent while the gateway is disabled, and nothing is sent on
   activation.
2. When a customer places an order and chooses BitLuso at checkout. To open the payment session
   the plugin sends the order total and currency, the order number and order key, the line items
   (name, SKU, quantity, price), the customer’s billing name, email address and country, your
   shop’s return and cancel URLs, the site language, and your site’s address (home_url()). This
   is personal data belonging to your customer, sent because it is what the payment requires.
3. When BitLuso reports a payment, BitLuso calls your site back. This is an inbound request,
   signed with a shared secret and rejected if the signature, the timestamp or the order key does
   not match.

No analytics, telemetry or usage data is collected, and the plugin does not contact any other
service.

Your customers also reach BitLuso directly: the payment page is hosted on portal.bitluso.pt, so
BitLuso receives their IP address and browser details when they arrive there, as any site does.

Using this plugin means all of that is handled under BitLuso’s terms of use and privacy policy
(both in Portuguese):

• Terms of use: https://bitluso.pt/termos/
• Privacy policy: https://bitluso.pt/privacidade/

If your shop serves customers in the EU, list BitLuso as a recipient of personal data in your own
privacy policy.