Rox Rental Booking – Rental booking and inventory management

Source layout:

• src/resources/ — React/JSX admin UI, frontend booking runtime, customer panel, and Gutenberg block editor scripts
• webpack.config.js — build configuration ( @wordpress/scripts )

Privacy Policy

Met Rental Booking stores booking and customer data in your WordPress database. No booking content is sent to Met servers by default. Optional payment and integration services, listed under External services, run only after a site administrator enables them and saves credentials. Optional file logs may record operational events on your server. Admin typography uses the system font stack — no Google Fonts are loaded. Activation does not contact any external server.

External services

This plugin does not contact an external service when it is installed or activated. Each service below is used only for the feature named, and only after that feature is turned on. Dashboard links in the settings screens (Stripe, PayPal, Google Cloud Console, Mailchimp) open in the administrator’s browser so they can create their own API credentials. Opening those links does not send booking data.

Stripe

Stripe processes card payments when a site administrator enables Stripe under Payments and saves API keys. Pay later does not use Stripe.

The customer panel loads Stripe.js from https://js.stripe.com/v3/ when a customer opens Pay now and Stripe is enabled with a publishable key. Checkout can load the same script when a payment gateway registers it. Card numbers are entered in Stripe’s field and sent to Stripe. They are not stored by this plugin. This plugin then sends Stripe the payment method ID returned by Stripe.js, the amount due, the currency, and booking and payment identifiers, so Stripe can create the charge. Stripe may later call this site’s webhook URL with the payment status. The Payments screen links to https://dashboard.stripe.com/apikeys so the administrator can copy API keys.

• What is sent: card data entered in Stripe.js (sent to Stripe, not to this plugin), then the payment method ID, amount, currency, and booking identifiers.
• When: only while Stripe is enabled and a customer starts an online card payment. Not on activation, and not for pay later.
• Service: Stripe (https://js.stripe.com/v3/)
• Terms of service: https://stripe.com/legal/ssa
• Privacy policy: https://stripe.com/privacy

PayPal

PayPal Checkout is optional. It runs only after an administrator enables PayPal and saves API credentials.

When PayPal is enabled, checkout can load the PayPal JavaScript SDK from https://www.paypal.com/sdk/js. Paying sends PayPal the order amount, currency, and the payer details the customer submits on PayPal’s form. The Payments screen links to the PayPal Developer Dashboard at https://developer.paypal.com/dashboard/ so the administrator can create those credentials. Opening that page does not send booking data.

• What is sent: order amount, currency, and payer details the customer enters in PayPal, only when they pay with PayPal.
• When: only while PayPal is enabled and a customer starts a PayPal payment. Not on activation.
• Service: PayPal (https://www.paypal.com/sdk/js)
• Terms of service: https://www.paypal.com/us/legalhub/useragreement-full
• Privacy policy: https://www.paypal.com/us/legalhub/privacy-full

Google

Google Calendar and Sign in with Google are optional. The settings screens link to Google Cloud Console so an administrator can create OAuth credentials:

• Credentials: https://console.cloud.google.com/apis/credentials
• Calendar API: https://console.cloud.google.com/apis/library/calendar-json.googleapis.com

Opening those pages does not send booking data.

When an administrator connects Google Calendar, the browser is sent to Google’s OAuth consent screen. Google receives the site’s OAuth client ID. After the account is connected, calendar sync sends the booking title, start and end time, and the customer name on that booking to the Google Calendar API. When a customer uses Sign in with Google, Google receives the sign-in request, and this site receives the account email and Google user ID. Neither step runs unless that integration is enabled.

• What is sent: OAuth client ID during connect; booking title, times, and customer name when a connected calendar is updated; email and Google user ID when a customer signs in with Google.
• When: only after an administrator enables and connects the integration. Not on activation.
• Service: Google Cloud, Google Calendar API, and Google Sign-In
• Terms of service: https://policies.google.com/terms
• Privacy policy: https://policies.google.com/privacy
• Google APIs terms of service: https://developers.google.com/terms

Mailchimp

Mailchimp is optional. The integrations screen links to https://admin.mailchimp.com/account/api/ so an administrator can create an API key. Opening that page does not send customer data.

When Mailchimp is enabled and a customer checks the consent box during booking, this plugin sends that customer’s name and email address, plus the audience ID saved in settings, to the Mailchimp API so they can be added to that audience. No data is sent when the customer does not consent, or when Mailchimp is disabled.

• What is sent: customer name, email address, and the selected Mailchimp audience ID.
• When: only after Mailchimp is enabled and the customer opts in. Not on activation.
• Service: Mailchimp (Intuit)
• Terms of service: https://mailchimp.com/legal/terms/
• Privacy policy: https://www.intuit.com/privacy/statement/

OpenStreetMap map tiles

Used on admin location fields when the map picker is shown. Map tiles are loaded from https://tile.openstreetmap.org.

• What is sent: map tile coordinates (zoom level and x/y tile indices) when an administrator views or edits a location map.
• When: only when the map picker is displayed in wp-admin.
• Service: OpenStreetMap Foundation
• Terms of service: https://wiki.openstreetmap.org/wiki/Tile_usage_policy
• Privacy policy: https://wiki.openstreetmap.org/wiki/Privacy_Policy

OpenStreetMap Nominatim geocoding

Used when an administrator searches for or selects a location on the map picker. Requests go to https://nominatim.openstreetmap.org.

• What is sent: latitude and longitude for reverse lookups, or the search text for forward lookups.
• When: only when an administrator uses the map search or selects a point on the map.
• Service: OpenStreetMap Foundation (Nominatim)
• Terms of service: https://operations.osmfoundation.org/policies/nominatim/
• Privacy policy: https://wiki.openstreetmap.org/wiki/Privacy_Policy