HL Hunt Payment Gateway for WooCommerce lets you accept Visa, Mastercard, American Express, Discover, and other major cards as well as ACH bank account payments directly on your checkout page.

Key Features:

PCI Compliant — Card and bank data is tokenized client-side via PCI Vault. Raw numbers never reach your server.
ACH / Bank Payments — Accept payments directly from checking or savings accounts (enable in gateway settings).
Simple Setup — Enter your API keys from the HL Hunt dashboard and you’re ready to go.
Test Mode — Use test API keys (sk_test_xxx) to test payments without processing real charges.
Refunds — Process full or partial refunds directly from the WooCommerce order page.
Webhooks — Automatic order status updates via secure HMAC-signed webhooks.
HPOS Compatible — Fully supports WooCommerce High-Performance Order Storage.

Third-Party Services

This plugin connects to the following external services to process payments:

HL Hunt Payment API

When a customer places an order, the plugin sends payment data (amount, currency, vault token, order metadata) to the HL Hunt API at https://payments.hlhunt.org for charge creation, refunds, and status polling. This communication only occurs when a customer initiates a checkout or when a merchant processes a refund.

PCI Vault (by SnapBill, Inc.)

Card data entered by the customer is sent directly from the customer’s browser to PCI Vault (https://api.pcivault.io), a PCI DSS Level 1 certified card vault. Raw card numbers never pass through your WordPress server. The plugin loads a JavaScript SDK (hlhunt.js) from the HL Hunt server to facilitate this secure tokenization.

What Data Is Sent Externally

To PCI Vault (from customer’s browser): Card number, expiry date, CVC, cardholder name; OR routing number, account number, account holder name.
To HL Hunt API (from your server): Vault token (not raw payment data), charge amount, currency, payment type, order ID, order key, customer IP address, charge descriptions, customer name and email (for receipts and customer records).
No data is collected or sent for analytics, tracking, or advertising purposes.