=== MevvPos — Turkish Bank Virtual POS for WooCommerce ===
Contributors: mevvsoft
Tags: woocommerce, payment gateway, virtual pos, installments, turkey
Requires at least: 6.0
Tested up to: 6.9
Requires PHP: 8.1
Stable tag: 2.0.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect Turkish bank virtual POS accounts to WooCommerce, route each card to
the right bank by its BIN, and offer installments with per-bank rates.

== Description ==

Turkish banks do not speak a common payment protocol. Each one hands its
merchants a virtual POS account and a document describing its own signature
scheme, its own 3-D Secure return format and its own installment rules. That
is why a Turkish store cannot simply switch on a WooCommerce payment gateway
and start taking cards.

MevvPos is that layer. You enter the merchant ID, terminal ID and store key
from the agreement you signed with your bank, and your store starts taking
cards through your own POS — with 3-D Secure, with installments, and with the
bank's own decline reasons written into the order instead of a generic
failure.

= What it does =

* **Your bank's virtual POS, configured from WooCommerce.** Merchant
  credentials, endpoints, currency and test mode in one screen. The bank's
  test environment is a switch, not a second installation.
* **3-D Secure.** The customer verifies on the bank's own page. The return
  leg is checked against the signature before the order is marked paid — an
  unsigned or altered return never completes an order.
* **Installments with real rates.** Set a commission per installment count.
  What the customer sees at checkout is what reaches the bank, and the limit
  is enforced again on the server, so a modified form cannot buy more
  installments than you offer.
* **A record of every attempt.** Successes, failures and the bank's own
  decline codes, kept per order. "The card was declined" stops being a guess.
* **Turkish card recognition.** A bundled table of Turkish BIN ranges,
  rebuilt from bank sources, identifies the issuer of the card being typed
  in.

= Institutions supported today =

İş Bankası, Akbank, Halkbank, QNB, Şekerbank, TEB and Ziraat Bankası through
the NestPay protocol; Garanti BBVA and VakıfBank through their own protocols;
and iyzico, PayTR, Craftgate and Sipay as payment institutions.

Other banks appear in the settings screen marked as not yet available. There
is a request form next to them: tell us which one you need, and if you can
send the integration document your bank gave you, that shortens the work
considerably — several Turkish banks do not publish theirs.

= Card data =

The card number is never written to the database. CVV is never stored
anywhere, in any form, including logs. Where the provider takes the card on
its own servers (PayTR), it does not reach your site at all.

= Free and Pro =

This free plugin connects **one** virtual POS, with every bank and
institution above available to it, no cap on transactions, and installments
up to three.

Stores that hold more than one merchant agreement — the common case in
Turkey, because a bank gives its best rate on its own cards — need the paid
add-on. It adds unlimited POS accounts and routes each card to the right one
by its BIN, raises installments to twelve, breaks the attempt log down by
bank, installment and decline code with CSV export, and refreshes the BIN
table weekly so banks that merge, rename or take on new ranges keep working.

The paid add-on is a separate plugin and is not distributed here.

== External services ==

This plugin talks to two kinds of outside services.

**1. Your bank or payment institution.**

Payments are sent to the virtual POS you configured yourself: the bank
endpoints you enter in the plugin's settings. Nothing is sent until you add a
POS and a customer pays. What is sent is the payment itself — order number,
amount, currency, installment count, the return addresses, and the card
details the customer typed. This is the plugin's purpose and it cannot be
turned off while a gateway is enabled. Each bank's terms and privacy policy
are the ones in the merchant agreement you signed with them.

**2. mevvsoft.com — only when you submit a form.**

Two admin screens send a message to us: the bank request form, and the
support form. Both are sent only when you press the button; nothing is sent
in the background, and no payment or card data is ever included.

* Bank request sends: the bank or integrator name, your site address, the
  contact name, e-mail and phone you type in, your note, and whether you have
  the integration document.
* Support sends: your site address, the subject, the bank concerned, your
  message, the error text you paste in, and the contact details you type in.

Endpoint: `https://mevvsoft.com/api/v1/license/pos-request` and
`https://mevvsoft.com/api/v1/license/support`
Terms: https://mevvsoft.com/mesafeli-satis
Privacy: https://mevvsoft.com/kvkk

The free plugin never contacts us for licensing and sends nothing on a
schedule. Licence checks and the BIN refresh belong to the paid add-on, which
is a separate plugin.

== Installation ==

1. Install and activate. WooCommerce 9.0 or later must be active.
2. Go to WooCommerce → MevvPos and add your virtual POS: choose the bank,
   enter the merchant ID, terminal ID and store key from your merchant
   agreement.
3. Start in the bank's test environment. Run one payment through, confirm it
   reaches the bank's own panel, then switch to production.
4. Enter your installment rates per POS. They are what the customer sees.

== Frequently Asked Questions ==

= Do I need a merchant agreement with a bank? =

Yes. This plugin connects a virtual POS you already hold; it is not a payment
service and does not process money itself. Your bank or payment institution
gives you the credentials.

= My bank is not in the list. =

Open the settings screen and use the request form beside it. If you can send
the integration document your bank gave you, that is what decides how quickly
it can be added — several Turkish banks do not publish their documentation.

= I hold POS accounts at two banks. Can I use both? =

Not with the free plugin, which connects one. Routing a card to the right
bank by its BIN is what the paid add-on does. Extra POS accounts you have
already entered are never deleted — they are just not used until the licence
covers them, and your default POS keeps taking payments either way.

= Is the card number stored? =

No. It is passed to the bank for the payment and not written to the database.
CVV is never stored under any circumstance.

= Can a customer force more installments than I allow? =

No. The limit is applied again on the server when the order is placed, not
only in the browser.

== Screenshots ==

1. Virtual POS list.
2. Adding a POS: credentials, endpoints and test mode.
3. Installment rates.
4. Checkout with installments and 3-D Secure.
5. Attempt log with the bank's decline codes.

== Changelog ==

= 2.0.4 =
* The free plan's limits now say what they are and where to go: adding a
  second virtual POS explains the Pro routing instead of a dead warning,
  and the installment grid marks the rates the free plan does not show yet.
* Rates you enter above the free installment cap are kept, not cleared.

= 2.0.3 =
* Garanti BBVA, VakıfBank, iyzico, PayTR, Craftgate and Sipay added.
* Card BIN table rebuilt from bank sources; earlier ranges were wrong for
  several banks and could route a card to the wrong POS.
* Installment limit enforced on the server as well as in the browser.
* Bank request and support forms added to the settings screen.
* Licensing and the BIN refresh moved out into a separate paid plugin.

= 1.0.0 =
* First release: NestPay banks, BIN routing, installments, 3-D Secure.

== Upgrade Notice ==

= 2.0.3 =
Corrects card BIN ranges that could send a card to the wrong POS. Check your
bank-to-POS mapping after updating.
