=== Ultimo Bots ===
Contributors: ultimobots
Tags: chatbot, ai assistant, chatgpt, ai agent, chat
Requires at least: 5.4
Tested up to: 6.8
Requires PHP: 7.4
Stable tag: 1.0.6
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Ultimo Bots helps you add a powerful AI assistant to your site - effortlessly.

== Description ==
First-time onboarding, safe bot_id injection (no arbitrary code), and a simple settings screen (Bot ID input + "Modify Chatbot" link).

Ultimo Bots empowers WordPress users to deploy smart, multilingual AI chatbots that engage visitors, capture leads, and deliver instant support - all with zero coding.

=== What You Can Do ===
- Convert visitors with 24/7 lead capture and support  
- Automatically display a chatbot that speaks your brand's voice  
- Train your bot with website links or document uploads  
- Customize the widget (font, colors, tone, border radius, logo)  
- Generate leads 24/7 fully automatically  
- Monitor real questions to understand your audience  
- Integrate instantly without writing a single line of code  

=== How It Works ===
- On activation, the plugin registers your site with the Ultimo Bots service and stores a site-specific secret.  
- In Settings -> Ultimo Bots, paste your Bot ID. The plugin safely renders a container and enqueues the chat widget script (no raw <script> injection).  
- The front end loads the lightweight widget script and fetches the bot's widget configuration.  

== External services ==
This plugin connects to external services operated by Ultimo Bots to function. The integration is required to register your site securely and render your chatbot. Below are the services, what they are used for, and what data is transmitted.

=== 1) Ultimo Bots Portal API (site registration) ===
- What: https://portal.ultimo-bots.com/api/auth/wordpress/save_secret  
- When: Once during plugin activation.  
- Purpose: Register your WordPress site and exchange a site-specific identifier used for secure operations.  
- Data sent:  
  - site_id (random UUID generated in your WordPress site)  
  - site_url (your WordPress home URL)  
  - site_secret (random secret generated in your WordPress site)  
  - Admin user's email, first_name, last_name (to associate the site with an account)  
- Data received:  
  - wordpress_secret_id (an internal identifier used by the service)  
- Why it is needed: Establishes a trusted linkage so only your site can update its own configuration.  
- Policies: Terms of Service: https://www.ultimo-bots.com/terms - Privacy Policy: https://www.ultimo-bots.com/privacy  

=== 2) Ultimo Bots Widget Configuration API ===
- What: https://portal.ultimo-bots.com/api/widget_configuration/{bot_id}  
- When: On public page views where the chatbot is displayed.  
- Purpose: Retrieve the Widget Configuration for your Bot ID (for example colors, sizes, welcome messages).  
- Data sent:  
  - bot_id (path parameter)  
  - Optionally host_url (query parameter) when provided by the widget, used for basic operational analytics (for example "widget loaded" events)  
- Data received:  
  - Widget configuration JSON (theme colors, dimensions, feature flags, etc.)  
- Why it is needed: Required to render and style the chatbot on your site.  
- Policies: Terms of Service: https://www.ultimo-bots.com/terms - Privacy Policy: https://www.ultimo-bots.com/privacy  

=== 3) Ultimo Bots Widget Script Host (static asset) ===
- What: https://robert-kloepsch.github.io/ultimo-bots-widget/dist/bundle.js  
- When: On public page views where the chatbot is displayed.  
- Purpose: Load the chat widget client code.  
- Data sent: Standard CDN/HTTP request metadata (IP, user agent) as with any static asset request.  
- Why it is needed: Delivers the client script that powers the chatbot UI.  
- Policies: Terms of Service: https://www.ultimo-bots.com/terms - Privacy Policy: https://www.ultimo-bots.com/privacy  

Important: This plugin does not accept or store arbitrary HTML/JS/CSS from users. It only stores a Bot ID and generates safe markup internally. The widget script is properly enqueued via WordPress functions.

== Installation ==

1. Upload the `ultimo-bots` folder to `/wp-content/plugins/`  
2. Activate the plugin via Plugins -> Installed Plugins  
3. On activation, the plugin generates site credentials and securely registers your site with Ultimo Bots
4. If there is no active bot on your site you will be redirected to the Ultimo Bots Onboarding Flow which will let you create an account, create your chatbot and integrate it within 2 minutes 
Ongoing: Within your wp dashboard of Ultimo Bots you can manage the Bot ID and click the modify chatbot button to be forwarded to the Ultimo Bots Dashboard

== Frequently Asked Questions ==

= Do I need a separate Ultimo Bots account? =  
Yes. You need an Ultimo Bots account to create and manage your chatbots. When you activate the plugin, your WordPress site is registered with the service. You then sign in to the Ultimo Bots portal to create a bot and copy its Bot ID.

= What exactly does the plugin send to the service? =  
On activation: site_id, site_url, a random site_secret, and the admin's email, first_name, and last_name, to associate the site with your account.  
On page load: your bot_id is used to fetch widget configuration, and the static widget script is loaded from the widget host.  

= Is the integration secure? =  
Yes. A unique secret is generated during activation and is required for protected operations. All service calls are over HTTPS. The plugin never evaluates arbitrary code from options.

= Does this plugin inject custom code? =  
Yes. It injects a safe container <div> and enqueues the Ultimo Bots widget script. This is required for the chatbot to appear on your site. Users cannot add arbitrary CSS/JS/PHP - only the Bot ID is stored, and the markup is generated automatically.

= Can I remove all data if I uninstall? =  
Yes. Uninstalling the plugin removes the plugin's options (including credentials and snippet container) from your WordPress database. It does not delete any data in your Ultimo Bots account.

= Will this slow down my site? =  
The widget is lightweight and is enqueued in the footer. Real-world performance depends on your theme and other plugins, but the script is designed to be efficient.

== Privacy ==
This plugin communicates with Ultimo Bots services as described in External services. Please review:  
- Terms of Service: https://www.ultimo-bots.com/terms  
- Privacy Policy: https://www.ultimo-bots.com/privacy  

== Screenshots ==

1. Ultimo Bots admin settings page (Bot ID + portal link)  
2. Seamless onboarding flow after activation  
3. Chatbot widget visible on a public page  

== Changelog ==

= 1.0.6 =  
* Removed powered by link in the snippet

= 1.0.5 =  
* Compliance update: Documented external services and data flow  
* REST endpoint now accepts bot_id only (no arbitrary HTML); plugin rebuilds safe markup internally  
* Front-end assets are properly enqueued (wp_enqueue_script)  
* Added thorough escaping in admin output  
* Production HTTPS endpoints set for service calls  

= 0.9.3 =  
* Compliance refinements and code tidy-up  
* Unified option keys under ultibo_ prefix; added one-time migration from legacy keys  
* Uninstall routine removes both new and legacy keys  

= 0.9.2 =  
* Initial public release: onboarding, secure registration, REST integration, auto-injection, and portal access  

== Upgrade Notice ==

= 1.0.5 =  
Compliance and stability improvements (no feature changes). Safe to update.

= 0.9.3 =  
Internal compliance refinements (enqueue, option prefixes). Safe to update; no visible changes.