Xobito for WooCommerce

Xobito for WooCommerce connects your store to Xobito, a WhatsApp Business messaging platform. Once the store is linked, Xobito can send your customers WhatsApp messages for the things that happen in your store: an order is placed, paid, shipped, cancelled or refunded, a customer signs up, or a shopper leaves checkout without ordering.

The plugin only reports what happens. Which alerts go out, to whom, and when, is set in Xobito, not here.

This plugin is not affiliated with or endorsed by Meta or WhatsApp. A Xobito account is required.

What it does

• Tells Xobito when an order is created, changes status, is refunded or is deleted.
• Tells Xobito when a customer account is created.
• Captures the contact details a shopper types at checkout, while they are still on the page, so an abandoned checkout can be followed up. WooCommerce keeps no record of a checkout that is never submitted, so this can only be caught in the browser.
• Shows whether the store is linked, and lets you disconnect it.

What it does not do

• It sends nothing until you paste a store key and link the store.
• It adds no front-end widgets, banners or tracking pixels, and loads no scripts from other sites.
• It does not install or update anything from outside WordPress.org.

External services

This plugin connects to Xobito (https://api.xobito.com) to deliver store events. Xobito is the service the plugin exists to connect to; without a Xobito account it does nothing. The service is operated by Saeculum Solutions Private Limited.

• Terms & Conditions: https://xobito.com/terms-conditions
• Privacy Policy: https://xobito.com/privacy-policy
• Refund & Cancellation Policy: https://xobito.com/refund-cancellation-policy

Nothing is sent until you paste a store key and press Link store. Every request is signed with that key.

When data is sent, and what

1. When you link the store, and when you disconnect or deactivate: the store’s address, the site name and the plugin version.
2. When you open WooCommerce > Xobito: a request asking Xobito whether the store is linked. It identifies the store by its key and sends no customer data.
3. Orders (created, status changes, refunds, deletion): order number and status, total and currency, payment method and payment link, dates, and the customer’s name, email, phone number and billing country, plus the line items (name, quantity, price) and any refunds.
4. New customer accounts: the customer’s name, email, phone number and billing country.
5. Checkout, before an order is placed: the email, phone number, name and country the shopper has typed into the checkout form, the cart items and total, and a checkout link. It is sent at most once per minute per checkout, and a “completed” signal is sent when the order is paid. To switch checkout capture off, for example until you have shopper consent, untick Checkout capture under WooCommerce > Xobito. Developers can also add add_filter( 'xobito_wc_capture_enabled', '__return_false' ); to force it off.

Your responsibilities

You are the data controller for your shoppers’ information. Please describe this sharing in your own privacy policy and, where the law of your shoppers’ country requires it, get consent before capturing checkout details. The plugin does not show a consent prompt of its own.

What is stored on your site

The store key and whether Xobito confirmed it (one option), and a small marker on each order recording the last status that was reported (_xobito_sent_status). Short-lived (60 second) transients, named xobito_cap_*, stop the same shopper being reported repeatedly. Uninstalling the plugin removes the key; the order markers are left in place.

Source code

The settings screen is written in React and TypeScript and compiled into a single file, assets/dist/admin.js. That file is minified. The complete human-readable source is included in this plugin, in the source/ folder.

To rebuild it (Node.js 22 or newer):

1. cd source
2. npm ci
3. npm run build
4. The result is source/plugin/assets/dist/admin.js, identical to assets/dist/admin.js.

The PHP files, uninstall.php and assets/checkout.js are not compiled or minified.

Third-party libraries

The compiled admin.js contains these MIT-licensed libraries, whose notices are reproduced here as the MIT licence requires:

• React 18.3.1 and React DOM 18.3.1, Copyright (c) Meta Platforms, Inc. and affiliates
• Scheduler 0.23.2, Copyright (c) Meta Platforms, Inc. and affiliates
• Tailwind CSS 4.3.3 (the generated utility styles), Copyright (c) Tailwind Labs, Inc.

Permission is hereby granted, free of charge, to any person obtaining a copy of these libraries and associated documentation files, to deal in them without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies, subject to the following conditions: the above copyright notice and this permission notice shall be included in all copies or substantial portions of the software. THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.