Name: BazaarSpot for WooCommerce
Author: BazaarSpot

BazaarSpot is a shopping marketplace where shoppers discover products from independent stores. This plugin connects your WooCommerce store to your BazaarSpot online store:

Catalog sync. Products, variations, stock, prices and categories are sent to BazaarSpot when you connect, and again whenever they change.
Online store branding. Your store name, tagline, logo, site icon and base country are kept up to date on your BazaarSpot online store page.
Collections. Your product categories appear as collections on BazaarSpot.
Product reviews. Approved product reviews appear on your BazaarSpot online store page, marked as from your store. Turn this off under BazaarSpot > Catalog sync.
Instant Checkout. Shoppers who buy from your BazaarSpot page land in your own WooCommerce checkout with their cart and details filled in. Shipping, coupons, taxes and payment work as for any other order.
Order reporting. Orders placed through Instant Checkout, and later status changes and refunds on them, are reported back to BazaarSpot.

Syncing runs in the background through WooCommerce’s Action Scheduler, so editing products never waits on the network.

You need a free BazaarSpot account. You can create one while connecting: Connect to BazaarSpot takes you to bazaarspot.net to sign up or sign in.

External services

This plugin connects your store to BazaarSpot (https://bazaarspot.net), the marketplace service operated by BazaarSpot. Nothing is sent until a store administrator clicks Connect to BazaarSpot on the BazaarSpot settings page. After you disconnect or delete the plugin, nothing more is sent.

Connecting your store (api.bazaarspot.net):

Connect. When you click Connect to BazaarSpot, the plugin sends your site address, the address of the BazaarSpot settings page, your site title, your WooCommerce base country, and a one-way hash of a secret generated on your site. Your browser then opens bazaarspot.net, where you sign in and confirm the connection.
Finishing the connection. While you are connecting, each visit to the BazaarSpot settings page sends that secret to check whether you have confirmed. Once you have, BazaarSpot returns your connection details, and the secret signs everything the plugin sends from then on.
Domain verification. While you are connecting, the public REST route /wp-json/bazaarspot/v1/verification and a bazaarspot-shop-verification meta tag on your homepage show the ID of the connection in progress, and nothing else. BazaarSpot fetches them to confirm the plugin runs on your site. Both disappear once the store is connected or you press Start over. If BazaarSpot connects your store but keeps your online store hidden until it can verify your site, both stay until verification passes.
Verify now. While your online store is hidden, clicking Verify now sends the connection’s ID and its secret to ask BazaarSpot to check your site again. BazaarSpot then fetches the verification route or your homepage.

Data the plugin sends to BazaarSpot (ingest.bazaarspot.net) once connected:

Catalog. Product IDs, names, descriptions, SKUs, prices, stock, images, variations, attributes, categories, tags, brands and product URLs. Sent when you connect, when you press “Sync items now”, and when a product or category changes. When you trash or delete a product, its ID is sent so BazaarSpot removes it.
Online store details. Site title, tagline, URL, logo, site icon and WooCommerce base country. Sent when you connect, when you press “Sync store details now”, and when these settings change.
Product reviews. Unless you turn off Share product reviews with BazaarSpot: for each approved, rated product review, its comment ID, product ID and URL, star rating, review text, date, and the reviewer’s display name, which BazaarSpot shortens to a first name and last initial. The reviewer’s email address and IP address are never sent. Sent after each full catalog sync and when a review is approved or edited. When a review is unapproved, marked as spam, trashed or deleted, or you turn sharing off, the plugin tells BazaarSpot which reviews to keep and BazaarSpot removes the rest.
Instant Checkout orders. Only for orders that started on BazaarSpot: order ID and number, date, status, currency, totals, refunds, and the products, quantities and prices bought. No customer name, email, phone or address is sent.
Order deletion requests. When WooCommerce erases or anonymizes one of those orders, BazaarSpot is asked to remove its copy.
Dashboard sign-in. When you click Open BazaarSpot dashboard, the plugin asks BazaarSpot for a one-time sign-in link to your online store dashboard.
Disconnect notice. When you disconnect or delete the plugin, BazaarSpot is told the connection is closed.

Data BazaarSpot sends to your store: when a shopper starts Instant Checkout, BazaarSpot calls the REST route /wp-json/bazaarspot/v1/checkout with the cart and the contact and shipping details the shopper entered. They are used only to prefill your checkout. Every request is signed with your connection’s secret, and unsigned requests are refused.