=== Inboxxit Lite ===
Contributors: axeleratebiz
Tags: chatbot, ai chatbot, openai, lead capture, faq
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.13.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

An AI chat widget that answers visitors from your business info and FAQs, with your own OpenAI key or the WordPress AI Client.

== Description ==

Inboxxit Lite adds an AI chat widget to your site that answers visitors from the business info and FAQs you enter. Replies are written with your own OpenAI API key, or on WordPress 7.0 and later with the WordPress AI Client and the provider your site is set up with. Nothing runs on our servers: your key is stored encrypted on your own site, and you pay your AI provider directly for usage.

Features:

* AI chat widget with your branding (name, color, avatar, left or right position, welcome message, teaser bubble)
* Your own OpenAI key (GPT-4o mini), or the WordPress AI Client on WordPress 7.0 and later
* Business info and as many FAQs as you like; the bot answers from these
* Lead capture: ask visitors for name, email and optionally a phone number, get each new lead by email, and see them all on the Leads screen (one lead per email, however many times they chat)
* Read each lead's chats, with the questions the bot could not answer marked
* A monthly summary on the Dashboard: conversations, new leads, and how many questions the bot could not answer from your info
* Replies in Spanish or English, matching the visitor
* Conversations are restored when a visitor reloads the page

Inboxxit Lite Pro is a separate paid add-on, sold and installed separately. It adds model choice (GPT-4o and Anthropic Claude), a lead webhook, monthly insights (what visitors asked about, and a list of the questions the bot could not answer), and a searchable log of every conversation with CSV export. Everything listed above works without it.

Need WhatsApp, a shared team inbox, a document knowledge base, and a sales pipeline? See Inboxxit at https://inboxxit.com.

== Installation ==

1. Install and activate the plugin from Plugins > Add New.
2. Open the Inboxxit Lite menu in your dashboard.
3. Paste your OpenAI API key (create one at https://platform.openai.com/api-keys), or on WordPress 7.0 and later choose the WordPress AI Client.
4. Add your business info and a few FAQs, tick "Show the chat widget on my site", and save.

== External services ==

This plugin connects to the following services.

= OpenAI API =

Used to write the chat replies when the AI provider is your OpenAI key. Each time a visitor sends a message, the plugin sends that message, the last 6 messages of the same conversation, the bot name, your site name, and the business info and FAQs you entered to the OpenAI API (https://api.openai.com/v1/chat/completions), authenticated with the API key you provide. Nothing is sent until you add a key and enable the widget. Visitors' names and emails are not sent.

* Terms of use: https://openai.com/policies/terms-of-use
* Privacy policy: https://openai.com/policies/privacy-policy

= WordPress AI Client (optional) =

When you choose the WordPress AI Client as the AI provider (WordPress 7.0 and later), the plugin makes no connection of its own: it passes the same information as above to WordPress, which sends it to the AI provider your site is set up with under Settings > Connectors. That provider's terms and privacy policy apply.

= Inboxxit (optional) =

The plugin's admin screens have links to Inboxxit, the hosted version: the "Inboxxit" menu item, the "Try Inboxxit: AI included" button in the header bar, and the "Upgrade to Inboxxit" button on the Dashboard and Settings cards. Only when you click one of them, your browser opens the Inboxxit signup page (https://app.inboxxit.com/signup/), set to the Web Chatbot plan billed monthly. The link carries your site domain, site name, site language, brand color, business info and FAQs, to pre-fill a new account, plus campaign tags saying which button was clicked. Nothing is sent to Inboxxit otherwise.

The optional "Powered by Inboxxit" credit link under the chat is off by default. When you turn it on, it is a plain link to https://inboxxit.com with campaign tags (ref and utm parameters); no request is made unless a visitor clicks it.

* Terms of service: https://inboxxit.com/terms/
* Privacy policy: https://inboxxit.com/privacy/

= Freemius (Lite Pro checkout) =

The "Upgrade to Pro" and "Get Lite Pro" links open the Freemius checkout for the Inboxxit Lite Pro add-on (https://checkout.freemius.com/) in a new tab. No data is sent with the link.

* Terms of service: https://freemius.com/terms/
* Privacy policy: https://freemius.com/privacy/

== Privacy ==

Conversations, and any name and email a visitor leaves, are stored in your own WordPress database. They are kept when the plugin is removed, unless you tick "Also delete all conversations, leads, settings, and keys when this plugin is deleted" on the settings screen.

In the visitor's browser, the widget keeps a random chat session id, the name and email they left (so the form is not shown again), and whether the chat was opened before, in local storage, plus two session-only flags (teaser dismissed, contact form skipped).

The plugin adds suggested text to your site's privacy policy guide, and visitors' chats are included in WordPress's Export Personal Data and Erase Personal Data tools (found by the email they left).

== Frequently Asked Questions ==

= Do I need an Inboxxit account? =

No. This plugin runs entirely on your own site, with your own OpenAI key or the WordPress AI Client.

= Where is my API key stored? =

Encrypted in your site's database with libsodium, using a key derived from your site's secret salts. It is never exposed to visitors and never sent to Inboxxit.

= Can visitors run up my OpenAI bill? =

Each visitor can send up to 30 messages an hour and at most a tenth of the daily limit a day (at least 10), and the whole site stops answering after a daily message limit you set (300 by default). The per-visitor share means one person cannot use up the whole day's limit and switch the chat off for everyone else. You get an email when the limit is reached. Change it under "Daily message limit" on the settings screen.

= Why does the bot only know some things? =

By design. The bot answers only from the business info and FAQs you enter, so it will not make things up. For a knowledge base built from your documents and website, see Inboxxit.

== Screenshots ==

1. A visitor asks a question and the bot answers from your business info and FAQs, then asks for their name and email in case the connection drops. They can skip it.
2. A teaser bubble invites visitors to start a chat.
3. The chat on a phone.
4. The Dashboard: whether your assistant is live, this month's conversations, new leads and unanswered questions, today's messages against your daily limit, and your newest leads.
5. Settings: your OpenAI key, the bot's name, greeting, teaser, color, avatar, position and business info.
6. The FAQs the bot answers from.
7. Leads: everyone who left their name and email in the chat.

== Changelog ==

= 1.13.0 =
* No limits on business info or FAQs: the bot is given everything you enter.
* Ask visitors for a phone number in the contact form (off, optional or required), under "Phone number" on the settings screen.
* Read each lead's chats: "View chat" on the Leads screen and the Dashboard shows every message, with the questions the bot could not answer marked.
* Choose the AI provider: your own OpenAI key, or on WordPress 7.0 and later the WordPress AI Client (the provider set up under Settings > Connectors).

= 1.12.1 =
* Clearer replies: the bot asks visitors to clarify unclear messages, answers greetings briefly, and answers rude, harmful or off-limits messages with one polite line.
* The bot never shares its instructions, anything about other visitors or leads (including how many there are), or business information you have not written in.
* Contact details are only ever collected with the form, never in the chat. When the bot cannot fully answer, it says the team will get in touch, and the chat asks the visitor to leave their details in the form (with the phone field when Lite Pro asks for one). The bot no longer ends replies with yes/no offers.
* The contact form's button says "Send" (was "Start").
* Dashboard lead rows no longer have an Email button. With Lite Pro, "View chat" opens the conversation.

= 1.12.0 =
* One lead per email: a visitor who chats again with the same email stays one lead, with a chat count, and you are emailed only the first time.
* The Dashboard shows this month's conversations, new leads, and how many questions the bot could not answer from your info. When the bot does not know, it says so plainly.
* After a visitor leaves their details, the chat confirms them.
* Hooks for Lite Pro's phone number field and Dashboard insights.

= 1.11.0 =
* The bot is given up to 1,000 characters of business info and up to 7 FAQs (Lite Pro: 4,000 characters and unlimited FAQs). A counter shows how much business info you have used, and an "Add FAQ" button adds rows. Nothing you saved is deleted: text and FAQs over the limit are kept and marked as not used.

= 1.10.2 =
* The message asking visitors for their name and email is no longer partly hidden behind the contact form.

= 1.10.1 =
* One visitor can use at most a tenth of the daily message limit (at least 10 messages), so a single person cannot use it all up and switch the chat off for everyone.
* Quieter promotion: the Upgrade to Pro and Inboxxit menu items use the standard menu colors, and lead rows no longer show a Pro button when Lite Pro is not installed.

= 1.10.0 =
* A Dashboard is now the plugin's home screen: whether your assistant is live, what is left to set up, chats and leads from the last 7 days, today's messages against your daily limit, and your newest leads. The first activation opens it once.
* Security: the per-visitor rate limit and the daily message limit can no longer be exceeded by sending many messages at the same moment. The contact form now counts against the rate limit, malformed session ids and over-long names are refused, and chat history responses are never cached.
* Inboxxit links now build the pre-filled signup link only when you click them.
* Visitors' chats are included in WordPress's personal data export and erase tools, and the plugin suggests privacy policy text.
* Uninstalling removes temporary counters, and the default bot name and greetings are translatable.

= 1.9.0 =
* A header bar on the plugin's pages, and Conversations (Pro), Upgrade to Pro and Inboxxit links in the plugin's menu, so the next steps are easy to find. Shown only on the plugin's own screens; the Pro links disappear once Lite Pro is installed.

= 1.8.0 =
* The plugin's folder and text domain are now inboxxit-lite, matching its name. If you installed an earlier zip, deactivate and delete the old "Inboxxit Lite" before activating this one; your settings, FAQs, leads and conversations are kept.

= 1.7.1 =
* The comparison table no longer lists Lite Pro as part of the hosted Inboxxit plans.

= 1.7.0 =
* The bot is stricter about answering only from your business info and FAQs. When something is not covered it says so and offers to take the visitor's details, instead of guessing (for example, it no longer answers "we don't offer that" for services you never mentioned). Off-topic questions are politely declined.
* Choose the header avatar from your Media Library instead of pasting an image link.

= 1.6.0 =
* The settings page offers Inboxxit Lite Pro (chat history, CSV export, lead webhook, Claude) beside the hosted Inboxxit plans.

= 1.5.0 =
* Renamed to Inboxxit Lite (the Pro add-on is now Inboxxit Lite Pro). Settings, data and the plugin folder are unchanged.
* A visitor's name and email are saved, and the new-lead email sent, as soon as they press Start. Before, they were only sent with the visitor's next message, so a visitor who left straight after the form was lost.
* New Leads screen (Inboxxit Lite > Leads): every visitor who left their name and email, with a link to email them.

= 1.4.2 =
* The chat now says why it asks for name and email ("in case we lose connection") instead of swapping in the form unexplained.
* Visitors can skip the form and keep chatting. Untick "Let visitors skip the form" in settings to require it.

= 1.4.1 =
* The upgrade card now compares Chat Lite with Inboxxit Web Chatbot (AI included, website training, shared inbox, lead scoring, reminders, monthly report) and opens the monthly Web Chatbot signup.

= 1.4.0 =
* New daily message limit (300 by default) caps how many messages the chat answers per day, so visitors cannot run up your AI bill. You get an email when it is reached.
* The per-visitor limit now counts an IPv6 visitor's whole /64 network, so changing address no longer resets it.
* API keys are now stored with authenticated libsodium encryption. Saved keys are converted automatically the next time you open the admin.

= 1.3.0 =
* The upgrade card now compares Chat Lite with Inboxxit Plus (website training, booking, reminders, follow-ups, WhatsApp inbox, lead scoring, monthly report) and opens the yearly Plus signup.

= 1.2.0 =
* Pro features now live in a separate add-on, Inboxxit Chat Lite Pro. This plugin contains no paid code. Saved Pro settings are kept and work again once the add-on is active.
* The "Powered by Inboxxit" credit link is off by default and can be turned on in settings.
* Visitor messages are sanitized before they are stored; settings save checks its own nonce.
* Tested up to WordPress 7.1.

= 1.1.8 =
* The message box now wraps and grows as you type (up to five lines), so the whole message stays visible. Enter sends, Shift+Enter adds a new line.

= 1.1.7 =
* Redesigned chat widget: header status line, avatar-initial fallback, animated typing indicator, teaser bubble.
* Neutral default branding and English default copy.
* Localize the site language when connecting to Inboxxit.
* Tested up to WordPress 6.8.

= 1.0.0 =
* Initial release: AI chat widget, BYOK (OpenAI), capped knowledge, lead capture.

== Upgrade Notice ==

= 1.13.0 =
No limits on business info or FAQs, a phone number field, each lead's chats on the Leads screen, and the WordPress AI Client as an AI provider.

= 1.12.1 =
Clearer, safer bot replies to unclear and inappropriate messages.

= 1.12.0 =
One lead per email, monthly figures on the Dashboard, and a confirmation after the contact form.

= 1.7.0 =
Stricter answers from your own info, and a Media Library avatar picker.

= 1.6.0 =
The settings page offers Inboxxit Lite Pro.

= 1.5.0 =
Renamed to Inboxxit Lite; leads are saved the moment the form is sent.

= 1.4.2 =
The contact form is explained and can be skipped (optional).

= 1.4.1 =
The upgrade card now points to Inboxxit Web Chatbot, billed monthly.

= 1.4.0 =
Security update: a daily message limit protects your AI bill, and saved API keys move to stronger encryption automatically.

= 1.2.0 =
Pro features moved to the separate Inboxxit Chat Lite Pro add-on. If you used Pro, install the add-on; your settings are kept.
