smartEngin buy

smartEngin buy turns your own WordPress site into a shop for digital products — documents, e-books, templates, any file you sell. There is no marketplace in between: your site takes the payment, writes the invoice and serves the download.

No commission per sale. No foreign branding. No customer data at a third party. Everything runs in your own database; the only outside parties are the payment providers you switch on.

What you can sell

• Files — PDF, ZIP, images, audio, video, office documents: everything WordPress itself accepts as an upload. Delivered through short-lived signed links, never a public URL.
• One-time purchases and subscriptions, monthly or yearly.
• Several items in one order, with a cart and a single payment.

Selling and getting paid

• Offer cards on any page — the block “smartEngin Offer cards” or [sels_cards product="your-product-slug"]. Buyers never leave the page.
• Stripe and PayPal, including subscriptions and Stripe’s redirect methods (Klarna, Amazon Pay, Bancontact, eps …).
• A test mode that runs a complete purchase — order, invoice, customer account, download — without a payment provider, so you can try everything before going live.
• Coupons and discount codes, shared for a campaign or unique per customer.
• [sels_preis] writes the current price into your running text, so a price change leaves no stale number on a landing page.

Invoices and bookkeeping

• Invoices with gap-free, frozen numbers, plus credit notes. They are printable HTML pages that any browser saves as PDF — no PDF library involved, so nothing breaks when a server lacks one.
• A small-business tax mode for the German § 19 UStG rule, with the required sentence on the invoice.
• Refund a payment in Stripe or PayPal and the matching credit note is written here automatically.
• A payment check that lists only the orders where something does not add up. An empty screen means everything went through cleanly.

Your customers

• A customer account with magic-link sign-in: purchases, invoices and downloads in one place, no password.
• Automatic renewal and expiry reminders for subscriptions.

Setting it up with an AI assistant

Stripe keys, webhooks, tax settings, invoice numbers — that is where most people get stuck. Under “Help & docs” one click copies a briefing about your installation into ChatGPT or Claude, which then tells you what is still missing. No account, no setup, nothing leaves your site. If your assistant can read online by itself, an optional read-only connection lets it check your settings directly: off until you switch it on, never exposing a secret, never able to change anything, and it closes itself when its short-lived code expires.

Extensions

• smartEngin Courses adds trainings, courses and videos with a member area, sold through this plugin. https://smartengin.de/smartengin-courses/
• smartEngin Licence & buy is the same core plus licence keys, activation limits and an update server for software you sell. It replaces this plugin; your data stays. https://smartengin.de/smartengin-licence-buy/

External services

This plugin connects to external services only when YOU switch them on and only to take a payment. Nothing is transmitted while they are switched off.

Stripe

Used to take card payments and subscriptions when you enter your Stripe keys under Settings → Payment providers.

• What is sent, and when: at the moment a customer starts a payment, your server sends the amount, the currency, your order number and the customer’s e-mail address to Stripe’s API at https://api.stripe.com. Card details are entered in Stripe’s own form and go directly to Stripe — the plugin never sees or stores them.
• The checkout page loads Stripe’s JavaScript library from https://js.stripe.com — in the visitor’s browser, and only once that visitor has actually started a card payment, never on page load. Stripe then reports the result of the payment back to your site.
• Domains contacted: api.stripe.com (from your server), js.stripe.com (from the visitor’s browser). No other Stripe address is used.
• Service provided by Stripe, Inc. — terms of service, privacy policy.

PayPal

Used to take PayPal payments and subscriptions when you enter your PayPal credentials under Settings → Payment providers.

• What is sent, and when: at the moment a customer starts a payment, your server sends the amount, the currency and your order number to PayPal’s API at https://api-m.paypal.com — or at https://api-m.sandbox.paypal.com while you are testing with sandbox credentials. The customer signs in with PayPal directly; the plugin never sees those credentials.
• The checkout page loads PayPal’s JavaScript SDK from https://www.paypal.com — in the visitor’s browser, and only once that visitor has actually started a PayPal payment, never on page load. PayPal then reports the result of the payment back to your site.
• Domains contacted: api-m.paypal.com (or api-m.sandbox.paypal.com in sandbox mode) from your server, and www.paypal.com from the visitor’s browser. No other PayPal address is used.
• Service provided by PayPal, Inc. — user agreement, privacy statement.

No other external service is contacted. The plugin does not phone home, does not collect statistics and does not load fonts, scripts or images from anywhere else.

Privacy

The plugin stores what a purchase needs: name, e-mail address, billing address when your invoice settings require one, the ordered items and the invoice. This data lives in tables on your own site and is never sent anywhere but to the payment provider handling that payment.

Invoices are kept because tax law requires it; they are not deleted automatically. Secret keys (Stripe, PayPal) are never exported, never shown again after saving and never included in any support or setup output.

Beyond the purchase itself, the plugin keeps two short technical logs on your own site — for you as the site owner, and for nobody else:

• A security log of sign-in attempts, both to the WordPress backend and to the passwordless customer account. It records what was typed in (username or e-mail address), the visitor’s IP address, the result and the time — that is what makes a repeated attack visible on the Security screen. Passwords are never stored, and no payment data ever reaches it. These rows are deleted automatically after a retention period you set yourself: 90 days by default, seven at the least.
• An access log for the optional read-only connection an AI assistant can use to help you set the shop up (smartEngin buy → REST API). That connection is switched off until you enable it and generate a short-lived code, and it switches itself back off when that code expires; while it is on, the last 30 accesses are kept with address, route and result. It is capped at 30 entries and is removed whenever the plugin is uninstalled, together with the connection settings and the code.

Neither log is sent anywhere. “Remove all data” on uninstall clears both, along with everything else the plugin stored.