Vendusio Checkout Network

Make more of every completed order.

Vendusio Checkout Network brings the Vendusio GiftBox to your WooCommerce order-confirmation (Thank-You) page. After the purchase is complete, customers can explore relevant offers from participating advertisers, creating an additional opportunity to get value from your existing post-purchase traffic without adding steps to checkout or payment.

This plugin uses the external Vendusio Ads service. An account, authorised domain and public key are needed; no local plugin license or feature unlock is required.

Post-purchase monetization: choose the right program

Vendusio offers distinct commercial programs for stores that host the GiftBox:

• Distributor – advertising revenue sharing: Eligible, approved high-volume ecommerce sites may host the GiftBox without running their own ad campaigns and receive an agreed share of net Cost Per Engagement (CPE) revenue actually collected by Vendusio from valid offer reveals attributed to their site. Distributor eligibility, volume requirements and approval apply.
• Publisher – advertise and host: Stores can host the GiftBox and also advertise their own offers through Vendusio. The Publisher benefit is preferential CPE advertising rates under the applicable terms, rather than the Distributor revenue share.

A GiftBox impression is not a paid event. Merely displaying or opening the GiftBox does not generate a payout. Revenue sharing is conditional on program eligibility and valid, collected engagement revenue; earnings and results are not guaranteed. Compare the programs and current terms.

What the plugin does

• Automatically places the GiftBox after a completed WooCommerce order when enabled.
• Provides the [vendusio_checkout_banner] shortcode for manual placement on supported pages.
• Connects or rechecks a configured domain through Vendusio’s Alive telemetry signal; optional site-wide heartbeat can be enabled separately, and is off by default.
• Uses a version-pinned HTTPS bootstrap with SHA-384 Subresource Integrity (SRI).
• Offers WordPress admin settings for the public key and automatic GiftBox display.
• Works without WooCommerce for supported manual shortcode placements; automatic order-confirmation placement requires WooCommerce.

The plugin does not modify checkout, manage campaigns or determine program eligibility. These are handled by Vendusio.

External service, data and privacy

This plugin connects to Vendusio Ads, an externally hosted advertising and attribution service operated by Vendusio Ltd. Saving a public Vendusio integration key does not enable site-wide heartbeat. The optional site-wide domain heartbeat setting is off by default and requires an explicit administrator action. If enabled, the external Vendusio script loads on ordinary non-admin public pages and makes HTTPS requests to the Vendusio service for JWT authorization and domain-status (alive) telemetry, as described below. The requests include a pseudonymous browser ID, public integration key and order or technical reference, but do not explicitly include IP address or User-Agent as application payload parameters. The WooCommerce order-confirmation GiftBox, when configured, uses the same external service but is controlled separately from site-wide heartbeat. Disable both integration features or remove the public key to stop frontend script loading by this plugin. Administrators must implement applicable visitor consent controls (for example via their consent-management solution), as a WordPress administrator setting by itself does not constitute a visitor’s consent. This plugin does not provide a built-in visitor consent banner.

Browser identifier and site-wide heartbeat: When the Vendusio browser script is loaded, it may generate a random 32-character hexadecimal browser_id in the browser and keep it in the site’s localStorage under vnd:browser-id:v1, reusing it for subsequent visits until browser storage is cleared. This pseudonymous browser identifier is sent in the query string of HTTPS requests to the Vendusio /jwt endpoint, together with the public integration key and an order or technical session reference. It is also sent when the optional site-wide heartbeat is enabled: the heartbeat’s /jwt request occurs when the script initializes, while the following alive event to /telemetry is locally limited to at most once every six hours per browser/key/site combination. In heartbeat-only mode the script does not fetch offers, display the GiftBox or register offer views/reveals. The heartbeat application payload does not explicitly include an IP address or User-Agent. However, a server receiving an HTTPS request can see the connecting IP address and may receive the browser’s User-Agent HTTP header. Vendusio Proxy currently forwards that header and derives HMAC-based anti-abuse values from connection details; these are HTTP/proxy processing details, not extra fields in the heartbeat JSON payload. The heartbeat and browser identifier are not enabled for ordinary public pages unless the administrator explicitly enables site-wide heartbeat; a separately configured order-confirmation GiftBox continues to load Vendusio’s browser script for its service functions. The plugin does not itself manage visitors’ consent, which remains the site’s responsibility where applicable.

For checkout integration, the PHP portion passes a public key, a limited order reference and, where supplied, a commercial market-country code to the Vendusio script. It does not intentionally include purchased items, order totals, customer names, billing/shipping addresses, customer email or payment-card data in those parameters. An order reference may nevertheless be personal data when linkable to a shopper. The browser-side integration can read applied coupon codes where available and transmit offer/claim references, impression/open/reveal/click and attribution events, as well as the shop domain. It does not add IP address or User-Agent as explicit fields to these event payloads; connection IP, User-Agent HTTP headers and HMAC-derived anti-abuse values may nonetheless be processed by the Vendusio service and Proxy. Browser storage can be used for session state, attribution and domain heartbeat. An email is collected for marketing only if the shopper submits a separate optional promotional opt-in form.

Remote resources and connection requests:

• Pinned public-page bootstrap: https://vendusio.com/vendusio-sri/vendusio-bootstrap-e132abb94a5d.php
• Connect/Recheck: https://vendusio.com/wp-json/vendusio-proxy/v1/jwt
• Connect/Recheck telemetry: https://vendusio.com/wp-json/vendusio-proxy/v1/telemetry

Connect/Recheck updates the local connection indicator after confirmed telemetry. HTTPS and SHA-384 SRI verify script bytes, but do not sandbox JavaScript or replace consent. CSP may need to allow Vendusio endpoints. Avoid duplicate GiftBox installations.

Vendusio Ltd, 20/22 Wenlock Road, London N1 7GU, United Kingdom, company no. 17540120. Support: support@vendusio.com.

• Service and integration details
• Terms and conditions
• Privacy policy
• Data protection roles