Kitsuly Commerce is a commerce-native WordPress ecommerce platform with native store building, catalogue, checkout, shipping, tax, accounting, fulfilment and Stripe Connect payments.<\/p>\n\n
Kitsuly platform fees are controlled by the private T1K1 controller. Merchant plugin code never receives T1K1 Stripe secret keys.<\/p>\n\n
Kitsuly's built-in Site SEO analytics is disabled by default. It begins collecting local visit\/engagement statistics only after a site administrator deliberately enables that feature in Kitsuly settings. The built-in analytics records are stored in the site's own WordPress database and are not sent to Kitsuly, T1K1 or another analytics provider by that feature. Administrators can configure retention and exclude administrators.<\/p>\n\n
Features that contact external providers are separately disclosed below and are used only when the merchant connects, enables or invokes the relevant integration.<\/p>\n\n
Kitsuly Commerce connects to external services only when the merchant enables or uses the relevant feature. Credentials are stored in WordPress and sensitive integration values are encrypted where supported. External setup\/help links opened from Kitsuly launch in a new browser tab.<\/p>\n\n
If a site administrator deliberately submits the Kitsuly Support form, WordPress sends the administrator-provided name, email address, support area, subject, message and any optional screenshot to support@kitsuly.com using the site's configured WordPress mail transport. The message also includes the site's URL plus the installed Kitsuly Commerce, WordPress and PHP versions so the reported installation can be identified and diagnosed. This data is sent only when the administrator presses the support-form submit button.<\/p>\n\n
Kitsuly terms: https:\/\/kitsuly.com\/terms\/\nKitsuly privacy: https:\/\/kitsuly.com\/privacy\/<\/p>\n\n
Kitsuly uses the private Kitsuly Platform Controller hosted at https:\/\/t1k1.com for controller-backed payment and merchant social-integration features. When a controller-backed feature first needs registration, the plugin sends a generated installation identifier, site URL, Kitsuly admin return URL, signed-callback URL, Kitsuly edition and plugin version so that installation can be registered and authenticated.<\/p>\n\n
For payments and invoice payments, the controller receives the authenticated installation context plus the amount, currency, checkout\/order\/invoice reference, requested payment methods and Stripe payment identifiers required to connect the merchant account, create or retrieve payment intents, reconcile payments, process refunds and record transaction costs. Stripe.js is loaded from https:\/\/js.stripe.com\/v3\/. Card and wallet credentials are entered into Stripe-hosted Elements and are not stored by Kitsuly Commerce. Stripe webhook handling is controller-managed: individual merchant WordPress installations do not require or store a Stripe webhook signing secret ( For supported brokered social connections (Facebook, Instagram, Pinterest, X, LinkedIn and TikTok), the controller can receive the selected provider, return URL, site URL, store name and administrator email when the merchant deliberately starts a connection. When the merchant deliberately publishes through a brokered provider, it can also receive the selected provider plus the post title\/text, public link, public media URL and provider-specific publishing choices required for that post. Provider app secrets and controller-held social refresh tokens are not stored in the merchant WordPress installation.<\/p>\n\n For the optional AI Logo Creator, when an administrator deliberately asks Kitsuly to generate a logo, Kitsuly sends the authenticated installation context plus the brand brief (brand name, style\/feel, colours, optional symbols\/avoid notes) and generated image prompt to the private T1K1 controller. The controller may forward that prompt to its configured image-generation provider and returns temporary generated logo asset URLs for import into the merchant WordPress Media Library. Image-generation provider API credentials are not stored in the merchant WordPress installation.<\/p>\n\n Kitsuly Platform Controller: https:\/\/t1k1.com\/\nKitsuly terms: https:\/\/kitsuly.com\/terms\/\nKitsuly privacy: https:\/\/kitsuly.com\/privacy\/\nStripe terms: https:\/\/stripe.com\/legal\nStripe privacy: https:\/\/stripe.com\/privacy<\/p>\n\n When a merchant activates, validates or requests a domain change for an official Kitsuly Pro or Business licence, the plugin communicates with the Kitsuly Licensing API hosted at https:\/\/api.kitsuly.com. The service receives the licence key, normalised production domain, installation identifier and site URL required to verify the entitlement and enforce the approved one-domain licence. On the private Kitsuly owner store, authorised licence-management requests may also include customer email, company, plan and expiry details. Payment card credentials are not sent to the licensing API.<\/p>\n\n Kitsuly Licensing API: https:\/\/api.kitsuly.com\/\nKitsuly terms: https:\/\/kitsuly.com\/terms\/\nKitsuly privacy: https:\/\/kitsuly.com\/privacy\/<\/p>\n\n When the merchant opens the Signature Edition theme catalogue, Kitsuly may request up to four promoted theme-pack records from Kitsuly\/T1K1 endpoints. The catalogue request sends normal HTTP request metadata plus the Kitsuly plugin version in the User-Agent so compatible theme metadata can be returned. If the merchant deliberately chooses Install, Kitsuly downloads only that selected Kitsuly-native theme pack from the same validated HTTPS host and imports its layout\/JSON\/media assets into the local store. These are Kitsuly theme packs, not WordPress themes, and the plugin does not activate a WordPress theme.<\/p>\n\n Kitsuly: https:\/\/kitsuly.com\/\nT1K1: https:\/\/t1k1.com\/\nKitsuly terms: https:\/\/kitsuly.com\/terms\/\nKitsuly privacy: https:\/\/kitsuly.com\/privacy\/<\/p>\n\n If Google Analytics or Google Search Console integrations are configured, Kitsuly sends the merchant-configured credentials, property\/site identifiers and report\/query parameters to the applicable Google APIs so aggregate analytics or search-performance information can be retrieved. Google OAuth endpoints are contacted only when the merchant explicitly connects or refreshes a Google integration.<\/p>\n\n When a merchant explicitly runs the Site SEO performance analyser, Kitsuly sends the tested public page URL and selected mobile\/desktop strategy to Google's PageSpeed Insights API so Google can return performance diagnostics.<\/p>\n\n Google privacy: https:\/\/policies.google.com\/privacy\nGoogle API terms: https:\/\/developers.google.com\/terms\nGoogle PageSpeed Insights documentation: https:\/\/developers.google.com\/speed\/docs\/insights\/v5\/get-started<\/p>\n\n Kitsuly can optionally connect to OpenAI, Google Gemini and Anthropic Claude for merchant-invoked content generation, marketing automation and the Kit dashboard assistant. For ordinary content\/marketing actions, the selected provider receives the merchant's API credential plus the prompt and relevant source copy or product\/content context required for that request. When Kit AI is connected, Kit sends only the merchant's question, the current Kitsuly screen, the installed Kitsuly version and the most relevant built-in Kitsuly help snippets needed to answer the question. Kit's local navigation\/component help works without sending a request to an external AI provider.<\/p>\n\n OpenAI privacy: https:\/\/openai.com\/policies\/privacy-policy\/\nOpenAI terms: https:\/\/openai.com\/policies\/terms-of-use\/\nGoogle privacy: https:\/\/policies.google.com\/privacy\nGemini API terms: https:\/\/ai.google.dev\/gemini-api\/terms\nAnthropic privacy: https:\/\/www.anthropic.com\/legal\/privacy\nAnthropic commercial terms: https:\/\/www.anthropic.com\/legal\/commercial-terms<\/p>\n\n When Shopify transfer tools are enabled, Kitsuly sends the configured Shopify store domain and Admin API token together with catalogue\/import query data to Shopify's Admin API so merchant-authorised store content can be read for transfer.<\/p>\n\n Shopify privacy: https:\/\/www.shopify.com\/legal\/privacy\nShopify API terms: https:\/\/www.shopify.com\/legal\/api-terms<\/p>\n\n When Australia Post live shipping is enabled, Kitsuly sends the configured API\/account credentials and the origin\/destination and parcel data required for the selected quote request, such as postcode, weight and dimensions, to Australia Post.<\/p>\n\n Australia Post developer information: https:\/\/auspost.com.au\/developers\/\nAustralia Post terms: https:\/\/auspost.com.au\/terms-conditions\nAustralia Post privacy: https:\/\/auspost.com.au\/privacy<\/p>\n\n When DHL Express live shipping is enabled, Kitsuly sends the merchant's DHL API credentials plus the origin, destination and parcel details needed to request shipping rates from the DHL MyDHL API. This occurs only when a customer or merchant requests a live shipping quote.<\/p>\n\n DHL developer information: https:\/\/developer.dhl.com\/\nDHL terms: https:\/\/www.dhl.com\/global-en\/home\/footer\/terms-of-use.html\nDHL privacy: https:\/\/www.dhl.com\/global-en\/home\/footer\/privacy-notice.html<\/p>\n\n When Sendle live shipping is enabled, Kitsuly sends the merchant's Sendle credentials and the origin, destination and parcel details required for a shipping quote to the Sendle API. This occurs only when a live Sendle quote is requested.<\/p>\n\n Sendle developer information: https:\/\/developers.sendle.com\/\nSendle terms: https:\/\/support.sendle.com\/hc\/en-au\/articles\/205800148-Terms-and-Conditions\nSendle privacy: https:\/\/support.sendle.com\/hc\/en-au\/articles\/206525557-Privacy-Policy<\/p>\n\n When FedEx live shipping is enabled, Kitsuly sends the merchant's FedEx OAuth credentials\/account number and the origin, destination and parcel details required to authenticate and request shipping rates from FedEx. This occurs only when a live FedEx quote is requested.<\/p>\n\n FedEx developer information: https:\/\/developer.fedex.com\/\nFedEx terms: https:\/\/www.fedex.com\/en-us\/terms-of-use.html\nFedEx privacy: https:\/\/www.fedex.com\/en-us\/trust-center\/privacy.html<\/p>\n\n When UPS live shipping is enabled, Kitsuly sends the merchant's UPS OAuth credentials and the origin, destination and parcel details required to authenticate and request shipping rates from UPS. This occurs only when a live UPS quote is requested.<\/p>\n\n UPS developer information: https:\/\/developer.ups.com\/\nUPS terms: https:\/\/www.ups.com\/us\/en\/support\/shipping-support\/legal-terms-conditions.page\nUPS privacy: https:\/\/www.ups.com\/us\/en\/support\/shipping-support\/legal-terms-conditions\/privacy-notice.page<\/p>\n\n When the optional BigCommerce transfer connection is configured, Kitsuly stores the merchant-provided store hash, client ID and access token so the merchant can stage a migration of catalogue, customer and order information. When transfer requests are performed, the credential and the requested resource\/query information are sent to the merchant's BigCommerce store API. The connection is not used unless the merchant configures and starts the transfer feature.<\/p>\n\n BigCommerce developer information: https:\/\/developer.bigcommerce.com\/docs\/start\/authentication\/api-accounts\nBigCommerce terms: https:\/\/www.bigcommerce.com\/terms\/\nBigCommerce privacy: https:\/\/www.bigcommerce.com\/privacy\/<\/p>\n\n When a merchant connects a supported social account and deliberately publishes from Kitsuly Marketing, the applicable provider receives the account identifiers\/authorisation held for that connection plus the post content required by the selected network, such as title or message text, public destination link, public media URL and network-specific publishing choices. Facebook, Instagram, Pinterest, X, LinkedIn and TikTok can use the Kitsuly Platform Controller broker described above where the connected merchant account and provider permissions allow it. GitHub publishing uses the merchant-provided GitHub access token and repository directly from the WordPress installation. Dribbble and DeviantArt currently use connection\/setup or manual-handoff states when their required publishing\/upload flow is unavailable rather than reporting an external post as successful.<\/p>\n\n Meta privacy: https:\/\/www.facebook.com\/privacy\/policy\/\nMeta Platform terms: https:\/\/developers.facebook.com\/terms\/\nPinterest privacy: https:\/\/policy.pinterest.com\/privacy-policy\nPinterest developer terms: https:\/\/developers.pinterest.com\/terms\/\nX privacy: https:\/\/x.com\/en\/privacy\nX developer agreement: https:\/\/developer.x.com\/en\/developer-terms\/agreement-and-policy\nLinkedIn privacy: https:\/\/www.linkedin.com\/legal\/privacy-policy\nLinkedIn API terms: https:\/\/www.linkedin.com\/legal\/l\/api-terms-of-use\nTikTok privacy: https:\/\/www.tiktok.com\/legal\/page\/row\/privacy-policy\/en\nTikTok developer terms: https:\/\/www.tiktok.com\/legal\/page\/global\/tik-tok-developer-terms-of-service\/en\nGitHub privacy: https:\/\/docs.github.com\/en\/site-policy\/privacy-policies\/github-general-privacy-statement\nGitHub terms for developer features: https:\/\/docs.github.com\/en\/site-policy\/github-terms\/github-terms-for-additional-products-and-features<\/p>\n\n For a digital product, a merchant can optionally configure a remote source URL instead of storing the downloadable file in the local WordPress uploads directory. When an authorised customer uses a valid Kitsuly download token, the WordPress server requests that merchant-configured URL, temporarily streams the returned file through the store and then removes the temporary copy. Kitsuly does not choose or operate that remote host; the merchant is responsible for the terms, privacy policy and permission to use whichever remote storage\/provider URL they configure.<\/p>\n\n Kitsuly Builder can render merchant-selected YouTube or Vimeo video embeds and Google Maps embeds. When a merchant places one of these elements on a public page, the visitor's browser connects to the selected provider to load that media or map; the provider may receive normal web-request information such as the visitor's IP address, browser headers and the requested embed URL. Kitsuly uses YouTube's privacy-enhanced youtube-nocookie.com embed domain where supported. Kitsuly can also load Google Fonts selected by the merchant, which causes the visitor's browser to request the chosen font resources from Google.<\/p>\n\n YouTube terms: https:\/\/www.youtube.com\/static?template=terms\nGoogle privacy: https:\/\/policies.google.com\/privacy\nGoogle Maps terms: https:\/\/maps.google.com\/help\/terms_maps\/\nVimeo terms: https:\/\/vimeo.com\/terms\nVimeo privacy: https:\/\/vimeo.com\/privacy\nGoogle Fonts information: https:\/\/developers.google.com\/fonts\/faq\/privacy<\/p>\n\n Kitsuly Lightning Cache works locally without a third-party cache service. If the merchant enables Local Google Fonts, the WordPress server requests the merchant-selected Google Fonts stylesheet\/font files and stores local cached copies so public visitors can load those fonts from the merchant site. If the merchant supplies a Cloudflare Zone ID and API token, an intentional Lightning Cache purge also sends a purge request to the Cloudflare API for that merchant-configured zone. A merchant-configured generic CDN hostname is used only to rewrite eligible public static-asset URLs; Kitsuly does not create or control that CDN account.<\/p>\n\n Cloudflare privacy: https:\/\/www.cloudflare.com\/privacypolicy\/\nCloudflare terms: https:\/\/www.cloudflare.com\/website-terms\/\nGoogle privacy: https:\/\/policies.google.com\/privacy\nGoogle Fonts information: https:\/\/developers.google.com\/fonts\/faq\/privacy<\/p>\n\n The merchant-only QR discount ticket maker requests a QR-code PNG from QRServer (api.qrserver.com) when a store administrator opens or generates a coupon ticket. The request contains the public store promotion URL and selected coupon code so the QR image can be created. No customer, order, payment or account data is sent by this feature. If the QR service is unavailable, the ticket image cannot be generated until it becomes available again.<\/p>\n\n QRServer \/ goQR.me API information: https:\/\/goqr.me\/api\/\nQRServer API privacy statement: https:\/\/goqr.me\/de\/rechtliches\/datenschutz-api.html\nQRServer API terms of service: https:\/\/goqr.me\/legal\/tos-api.html<\/p>\n\n When the plugin is running on kitsuly.com itself, it can render Kitsuly's own documentation library from cover images and PDF files already stored in that site's local WordPress uploads folders. This compatibility component is disabled on third-party\/customer sites and does not contact kitsuly.com from those installations.<\/p>\n\n This plugin ZIP is the source distribution. The PHP under Kitsuly Commerce does not use npm, webpack, Rollup, Vite, Babel, Sass or another compilation\/minification pipeline for the distributed first-party assets. There is no separate unpublished source tree or build command needed to recreate the JavaScript\/CSS included in this ZIP. The distributed files are intentionally readable and are edited directly.<\/p>\n\n A concise source-layout note is also included as When the Auction House feature is enabled, Kitsuly uses the private T1K1\/Kitsuly Platform Controller for Stripe Connect seller onboarding, auction payment orchestration, seller\/auction-house settlement, installation status and the owner-side auction safety monitor. Authenticated requests include the Kitsuly installation identifier, site URL\/context already registered with the controller, core\/Master version metadata and whether Auction House is enabled.<\/p>\n\n A visitor may deliberately press the permanent \u201cReport abuse\u201d control on an auction storefront. Only after the visitor submits that form, Kitsuly sends the supplied name, phone number, email address, message, reported store domain, source store domain\/page URL and optional screenshot to the private T1K1\/Kitsuly Platform Controller so the Kitsuly owner can review the report in the private Master console. The report control cannot be disabled from normal merchant settings while Auction House is enabled.<\/p>\n\n Customer auction sellers who choose to sell are sent through Stripe-hosted Connect onboarding. Kitsuly does not collect their bank credentials. Auction payments use Stripe-hosted Elements\/Stripe.js and the controller instructs Stripe how to allocate seller proceeds, auction-house commission and the Kitsuly platform fee.<\/p>\n\n Kitsuly terms: https:\/\/kitsuly.com\/terms\/\nKitsuly privacy: https:\/\/kitsuly.com\/privacy\/\nStripe terms: https:\/\/stripe.com\/legal\nStripe privacy: https:\/\/stripe.com\/privacy<\/p>\n\n\nwhsec_...<\/code>), and the controller sends signed Kitsuly callbacks to the registered store for payment\/refund reconciliation.<\/p>\n\nKitsuly Licensing API<\/h4>\n\n
Kitsuly Signature Theme Catalogue<\/h4>\n\n
Google services<\/h4>\n\n
AI providers<\/h4>\n\n
Shopify<\/h4>\n\n
Australia Post<\/h4>\n\n
DHL Express<\/h4>\n\n
Sendle<\/h4>\n\n
FedEx<\/h4>\n\n
UPS<\/h4>\n\n
BigCommerce<\/h4>\n\n
Social publishing services<\/h4>\n\n
Merchant-configured remote digital files<\/h4>\n\n
Optional media, map and font resources<\/h4>\n\n
Optional Lightning Cache edge\/font services<\/h4>\n\n
QR discount tickets<\/h4>\n\n
Kitsuly.com owner-site documentation compatibility<\/h4>\n\n
Source Code<\/h3>\n\n
src\/<\/code> and includes\/<\/code>, the JavaScript under assets\/js\/<\/code> and assets\/seo\/<\/code>, and the CSS under assets\/css\/<\/code> and assets\/seo\/<\/code> are the human-readable maintained source files loaded by WordPress.<\/p>\n\nSOURCE-CODE.txt<\/code>. Third-party components and their licences are documented in THIRD-PARTY-LICENSES.txt<\/code>.<\/p>\n\nKitsuly Auction House monitoring and abuse reporting<\/h4>\n\n
1.45.0<\/h4>\n\n
\n
1.44.50<\/h4>\n\n
\n
1.44.49<\/h4>\n\n
\n
1.44.48<\/h4>\n\n
\n
1.44.47<\/h4>\n\n
\n
1.44.46<\/h4>\n\n
\n
1.44.45<\/h4>\n\n
\n
1.44.44<\/h4>\n\n
\n
1.44.43<\/h4>\n\n
\n
1.44.42<\/h4>\n\n
\n
1.44.41<\/h4>\n\n
\n
1.44.40<\/h4>\n\n
\n
Earlier versions<\/h4>\n\n
\n