EtchCon Checkout for Bachs

EtchCon Checkout for Bachs connects supported WordPress commerce, membership, form, and donation plugins to Bachs hosted checkout.

EtchCon Checkout for Bachs is independently developed by Etchpoint and is not affiliated with or endorsed by Bachs Technologies Limited.

Version 1.0.0 supports one-time payments for:

• WooCommerce
• Paid Memberships Pro
• Gravity Forms
• Fluent Forms Pro payment forms
• GiveWP

The plugin uses a shared payment core with exact amount verification, signed webhook verification, event deduplication, safe fulfillment, reconciliation tools, diagnostics, and provider-confirmed refunds.

Customers are redirected to Bachs hosted checkout to enter payment details. The plugin does not collect or store full card numbers, CVV/CVC values, or other raw card credentials.

Recurring payments and subscriptions are not included in version 1.0.0.

Configuration

Bachs Payments > Settings provides one shared configuration for WooCommerce, Paid Memberships Pro, Gravity Forms, Fluent Forms, and GiveWP.

The active environment requires:

• A matching Bachs secret API key (sk_sandbox_... for Sandbox or sk_live_... for Live).
• The active Bachs webhook signing secret.

The settings screen also supports an optional previous webhook secret during secret rotation and an optional organization ID for stricter provider verification.

For sites that prefer secret management through wp-config.php, the following constants remain supported and take precedence over dashboard values when defined:

• ETCHPOINT_BACHS_ENVIRONMENT – sandbox or live.
• ETCHPOINT_BACHS_SANDBOX_SECRET_KEY – sandbox secret key.
• ETCHPOINT_BACHS_LIVE_SECRET_KEY – live secret key.
• ETCHPOINT_BACHS_WEBHOOK_SECRET – active webhook signing secret.
• ETCHPOINT_BACHS_WEBHOOK_SECRET_PREVIOUS – previous webhook secret during secret rotation.
• ETCHPOINT_BACHS_ORGANIZATION_ID – optional organization identifier.

Dashboard-managed secret values are stored in the WordPress options table and are never displayed back in plaintext after saving. They are deleted when the plugin is uninstalled. Financial/audit records remain retained as described below.

Live payments require HTTPS.

Refunds

Administrators can request Bachs refunds from Bachs Payments > Refunds.

Full refunds are supported. Partial refunds are supported when the Bachs settlement currency matches the original WordPress transaction currency. If Bachs settled the charge in a different currency, use a full refund so the plugin does not guess an exchange rate. Bachs currently permits one refund operation per charge, so a partial refund consumes the refund operation for that charge.

A refund is not treated as complete merely because the API accepted the request. The plugin waits for signed provider evidence confirming the refund before applying the corresponding local refund state.

Reconciliation and diagnostics

Bachs Payments > Reconciliation can safely re-check provider state and retry incomplete WordPress fulfillment.

Bachs Payments > Diagnostics provides read-only configuration and integration checks. Secret values and full provider responses are not displayed.

External Service

This plugin requires Bachs, a third-party payment service provided by Bachs Technologies Limited. The plugin contacts Bachs only when a configured administrator or customer uses functionality that requires the payment service, such as creating or retrieving checkout sessions, verifying payments, requesting refunds, or receiving Bachs webhooks.

Bachs service: https://bachs.io/

Bachs Merchant Terms: https://bachs.io/buyer-terms

Bachs Privacy Policy: https://bachs.io/privacy

Bachs developer documentation: https://docs.bachs.io/

Service endpoints used by the plugin:

• Sandbox API: https://sandbox-api.bachs.io
• Live API: https://api.bachs.io
• Hosted checkout: https://checkout.bachs.io

A Bachs merchant account and applicable Bachs service access are required to process payments. Bachs may charge fees under its own terms and pricing. Etchpoint does not control Bachs availability, eligibility decisions, fees, settlement, or payment processing rules.

Data sent to Bachs

For checkout creation, the plugin sends the transaction currency and amount, success and cancel return URLs, an opaque payment reference, correlation metadata identifying the WordPress integration and local transaction record, and customer contact information required for hosted checkout. This includes the customer email address and can include the customer name and phone number when available from the originating integration.

Payment details entered by the customer on hosted checkout are submitted directly to Bachs rather than to this plugin.

When an administrator initiates a refund, the plugin sends the Bachs charge identifier, requested refund amount, internal reference/idempotency information, and an optional administrator-entered refund reason.

The plugin also retrieves payment or refund records from Bachs when verification, reconciliation, diagnostics, or webhook processing requires authoritative provider state.

Local data and privacy

The plugin stores operational payment records in custom WordPress database tables. These records can include the integration name, local WordPress record identifier, Bachs checkout/charge/refund identifiers, amount, currency, processing status, timestamps, error information, and an optional refund reason.

For webhook deduplication and audit processing, the plugin stores provider event identifiers and a SHA-256 hash of the webhook payload. It does not persist the complete raw webhook payload.

The plugin does not store raw card credentials.

Payment, webhook, reconciliation, and refund records are intentionally retained when the plugin is uninstalled. They can be important financial and audit records and are not automatically deleted. Site owners are responsible for retention and deletion in accordance with their legal and operational requirements.

Because local transaction identifiers can link these records to orders, memberships, form submissions, or donations managed by other plugins, those integrations may contain personal data under their own retention policies.