class-wc-privacy.php — WooCommerce 10.0.5

woocommerce / includes / class-wc-privacy.php

woocommerce / includes Last commit date

class-wc-privacy.php

442 lines

1	<?php
2	/**
3	* Privacy/GDPR related functionality which ties into WordPress functionality.
4	*
5	* @since 3.4.0
6	* @package WooCommerce\Classes
7	*/
8
9	use Automattic\WooCommerce\Enums\OrderInternalStatus;
10
11	defined( 'ABSPATH' ) \|\| exit;
12
13	if ( ! class_exists( 'WC_Privacy_Background_Process', false ) ) {
14	include_once __DIR__ . '/class-wc-privacy-background-process.php';
15	}
16
17	/**
18	* WC_Privacy Class.
19	*/
20	class WC_Privacy extends WC_Abstract_Privacy {
21
22	/**
23	* Background process to clean up orders.
24	*
25	* @var WC_Privacy_Background_Process
26	*/
27	protected static $background_process;
28
29	/**
30	* Init - hook into events.
31	*/
32	public function __construct() {
33	parent::__construct();
34
35	// Initialize data exporters and erasers.
36	add_action( 'init', array( $this, 'register_erasers_exporters' ) );
37
38	// Cleanup orders daily - this is a callback on a daily cron event.
39	add_action( 'woocommerce_cleanup_personal_data', array( $this, 'queue_cleanup_personal_data' ) );
40
41	// Handles custom anonymization types not included in core.
42	add_filter( 'wp_privacy_anonymize_data', array( $this, 'anonymize_custom_data_types' ), 10, 3 );
43
44	// When this is fired, data is removed in a given order. Called from bulk actions.
45	add_action( 'woocommerce_remove_order_personal_data', array( 'WC_Privacy_Erasers', 'remove_order_personal_data' ) );
46	}
47
48	/**
49	* Initial registration of privacy erasers and exporters.
50	*
51	* Due to the use of translation functions, this should run only after plugins loaded.
52	*/
53	public function register_erasers_exporters() {
54	$this->name = __( 'WooCommerce', 'woocommerce' );
55
56	if ( ! self::$background_process ) {
57	self::$background_process = new WC_Privacy_Background_Process();
58	}
59
60	// Include supporting classes.
61	include_once __DIR__ . '/class-wc-privacy-erasers.php';
62	include_once __DIR__ . '/class-wc-privacy-exporters.php';
63
64	// This hook registers WooCommerce data exporters.
65	$this->add_exporter( 'woocommerce-customer-data', __( 'WooCommerce Customer Data', 'woocommerce' ), array( 'WC_Privacy_Exporters', 'customer_data_exporter' ) );
66	$this->add_exporter( 'woocommerce-customer-orders', __( 'WooCommerce Customer Orders', 'woocommerce' ), array( 'WC_Privacy_Exporters', 'order_data_exporter' ) );
67	$this->add_exporter( 'woocommerce-customer-downloads', __( 'WooCommerce Customer Downloads', 'woocommerce' ), array( 'WC_Privacy_Exporters', 'download_data_exporter' ) );
68	$this->add_exporter( 'woocommerce-customer-tokens', __( 'WooCommerce Customer Payment Tokens', 'woocommerce' ), array( 'WC_Privacy_Exporters', 'customer_tokens_exporter' ) );
69
70	// This hook registers WooCommerce data erasers.
71	$this->add_eraser( 'woocommerce-customer-data', __( 'WooCommerce Customer Data', 'woocommerce' ), array( 'WC_Privacy_Erasers', 'customer_data_eraser' ) );
72	$this->add_eraser( 'woocommerce-customer-orders', __( 'WooCommerce Customer Orders', 'woocommerce' ), array( 'WC_Privacy_Erasers', 'order_data_eraser' ) );
73	$this->add_eraser( 'woocommerce-customer-downloads', __( 'WooCommerce Customer Downloads', 'woocommerce' ), array( 'WC_Privacy_Erasers', 'download_data_eraser' ) );
74	$this->add_eraser( 'woocommerce-customer-tokens', __( 'WooCommerce Customer Payment Tokens', 'woocommerce' ), array( 'WC_Privacy_Erasers', 'customer_tokens_eraser' ) );
75	}
76
77	/**
78	* Add privacy policy content for the privacy policy page.
79	*
80	* @since 3.4.0
81	*/
82	public function get_privacy_message() {
83	$content = '<div class="wp-suggested-text">' .
84	'<p class="privacy-policy-tutorial">' .
85	__( 'This sample language includes the basics around what personal data your store may be collecting, storing and sharing, as well as who may have access to that data. Depending on what settings are enabled and which additional plugins are used, the specific information shared by your store will vary. We recommend consulting with a lawyer when deciding what information to disclose on your privacy policy.', 'woocommerce' ) .
86	'</p>' .
87	'<p>' . __( 'We collect information about you during the checkout process on our store.', 'woocommerce' ) . '</p>' .
88	'<h2>' . __( 'What we collect and store', 'woocommerce' ) . '</h2>' .
89	'<p>' . __( 'While you visit our site, we’ll track:', 'woocommerce' ) . '</p>' .
90	'<ul>' .
91	'<li>' . __( 'Products you’ve viewed: we’ll use this to, for example, show you products you’ve recently viewed', 'woocommerce' ) . '</li>' .
92	'<li>' . __( 'Location, IP address and browser type: we’ll use this for purposes like estimating taxes and shipping', 'woocommerce' ) . '</li>' .
93	'<li>' . __( 'Shipping address: we’ll ask you to enter this so we can, for instance, estimate shipping before you place an order, and send you the order!', 'woocommerce' ) . '</li>' .
94	'</ul>' .
95	'<p>' . __( 'We’ll also use cookies to keep track of cart contents while you’re browsing our site.', 'woocommerce' ) . '</p>' .
96	'<p class="privacy-policy-tutorial">' .
97	__( 'Note: you may want to further detail your cookie policy, and link to that section from here.', 'woocommerce' ) .
98	'</p>' .
99	'<p>' . __( 'When you purchase from us, we’ll ask you to provide information including your name, billing address, shipping address, email address, phone number, credit card/payment details and optional account information like username and password. We’ll use this information for purposes, such as, to:', 'woocommerce' ) . '</p>' .
100	'<ul>' .
101	'<li>' . __( 'Send you information about your account and order', 'woocommerce' ) . '</li>' .
102	'<li>' . __( 'Respond to your requests, including refunds and complaints', 'woocommerce' ) . '</li>' .
103	'<li>' . __( 'Process payments and prevent fraud', 'woocommerce' ) . '</li>' .
104	'<li>' . __( 'Set up your account for our store', 'woocommerce' ) . '</li>' .
105	'<li>' . __( 'Comply with any legal obligations we have, such as calculating taxes', 'woocommerce' ) . '</li>' .
106	'<li>' . __( 'Improve our store offerings', 'woocommerce' ) . '</li>' .
107	'<li>' . __( 'Send you marketing messages, if you choose to receive them', 'woocommerce' ) . '</li>' .
108	'</ul>' .
109	'<p>' . __( 'If you create an account, we will store your name, address, email and phone number, which will be used to populate the checkout for future orders.', 'woocommerce' ) . '</p>' .
110	'<p>' . __( 'We generally store information about you for as long as we need the information for the purposes for which we collect and use it, and we are not legally required to continue to keep it. For example, we will store order information for XXX years for tax and accounting purposes. This includes your name, email address and billing and shipping addresses.', 'woocommerce' ) . '</p>' .
111	'<p>' . __( 'We will also store comments or reviews, if you choose to leave them.', 'woocommerce' ) . '</p>' .
112	'<h2>' . __( 'Who on our team has access', 'woocommerce' ) . '</h2>' .
113	'<p>' . __( 'Members of our team have access to the information you provide us. For example, both Administrators and Shop Managers can access:', 'woocommerce' ) . '</p>' .
114	'<ul>' .
115	'<li>' . __( 'Order information like what was purchased, when it was purchased and where it should be sent, and', 'woocommerce' ) . '</li>' .
116	'<li>' . __( 'Customer information like your name, email address, and billing and shipping information.', 'woocommerce' ) . '</li>' .
117	'</ul>' .
118	'<p>' . __( 'Our team members have access to this information to help fulfill orders, process refunds and support you.', 'woocommerce' ) . '</p>' .
119	'<h2>' . __( 'What we share with others', 'woocommerce' ) . '</h2>' .
120	'<p class="privacy-policy-tutorial">' .
121	__( 'In this section you should list who you’re sharing data with, and for what purpose. This could include, but may not be limited to, analytics, marketing, payment gateways, shipping providers, and third party embeds.', 'woocommerce' ) .
122	'</p>' .
123	'<p>' . __( 'We share information with third parties who help us provide our orders and store services to you; for example --', 'woocommerce' ) . '</p>' .
124	'<h3>' . __( 'Payments', 'woocommerce' ) . '</h3>' .
125	'<p class="privacy-policy-tutorial">' .
126	__( 'In this subsection you should list which third party payment processors you’re using to take payments on your store since these may handle customer data. We’ve included PayPal as an example, but you should remove this if you’re not using PayPal.', 'woocommerce' ) .
127	'</p>' .
128	'<p>' . __( 'We accept payments through PayPal. When processing payments, some of your data will be passed to PayPal, including information required to process or support the payment, such as the purchase total and billing information.', 'woocommerce' ) . '</p>' .
129	'<p>' . __( 'Please see the <a href="https://www.paypal.com/us/webapps/mpp/ua/privacy-full">PayPal Privacy Policy</a> for more details.', 'woocommerce' ) . '</p>' .
130	'</div>';
131
132	return apply_filters( 'wc_privacy_policy_content', $content );
133	}
134
135	/**
136	* Spawn events for order cleanup.
137	*/
138	public function queue_cleanup_personal_data() {
139	self::$background_process->push_to_queue( array( 'task' => 'trash_pending_orders' ) );
140	self::$background_process->push_to_queue( array( 'task' => 'trash_failed_orders' ) );
141	self::$background_process->push_to_queue( array( 'task' => 'trash_cancelled_orders' ) );
142	self::$background_process->push_to_queue( array( 'task' => 'anonymize_refunded_orders' ) );
143	self::$background_process->push_to_queue( array( 'task' => 'anonymize_completed_orders' ) );
144	self::$background_process->push_to_queue( array( 'task' => 'delete_inactive_accounts' ) );
145	self::$background_process->save()->dispatch();
146	}
147
148	/**
149	* Handle some custom types of data and anonymize them.
150	*
151	* @param string $anonymous Anonymized string.
152	* @param string $type Type of data.
153	* @param string $data The data being anonymized.
154	* @return string Anonymized string.
155	*/
156	public function anonymize_custom_data_types( $anonymous, $type, $data ) {
157	switch ( $type ) {
158	case 'address_state':
159	case 'address_country':
160	$anonymous = ''; // Empty string - we don't want to store anything after removal.
161	break;
162	case 'phone':
163	$anonymous = preg_replace( '/\d/u', '0', $data );
164	break;
165	case 'numeric_id':
166	$anonymous = 0;
167	break;
168	}
169	return $anonymous;
170	}
171
172	/**
173	* Find and trash old orders.
174	*
175	* @since 3.4.0
176	* @param int $limit Limit orders to process per batch.
177	* @return int Number of orders processed.
178	*/
179	public static function trash_pending_orders( $limit = 20 ) {
180	$option = wc_parse_relative_date_option( get_option( 'woocommerce_trash_pending_orders' ) );
181
182	if ( empty( $option['number'] ) ) {
183	return 0;
184	}
185
186	return self::trash_orders_query(
187	apply_filters(
188	'woocommerce_trash_pending_orders_query_args',
189	array(
190	'date_created' => '<' . strtotime( '-' . $option['number'] . ' ' . $option['unit'] ),
191	'limit' => $limit, // Batches of 20.
192	'status' => OrderInternalStatus::PENDING,
193	'type' => 'shop_order',
194	)
195	)
196	);
197	}
198
199	/**
200	* Find and trash old orders.
201	*
202	* @since 3.4.0
203	* @param int $limit Limit orders to process per batch.
204	* @return int Number of orders processed.
205	*/
206	public static function trash_failed_orders( $limit = 20 ) {
207	$option = wc_parse_relative_date_option( get_option( 'woocommerce_trash_failed_orders' ) );
208
209	if ( empty( $option['number'] ) ) {
210	return 0;
211	}
212
213	return self::trash_orders_query(
214	apply_filters(
215	'woocommerce_trash_failed_orders_query_args',
216	array(
217	'date_created' => '<' . strtotime( '-' . $option['number'] . ' ' . $option['unit'] ),
218	'limit' => $limit, // Batches of 20.
219	'status' => OrderInternalStatus::FAILED,
220	'type' => 'shop_order',
221	)
222	)
223	);
224	}
225
226	/**
227	* Find and trash old orders.
228	*
229	* @since 3.4.0
230	* @param int $limit Limit orders to process per batch.
231	* @return int Number of orders processed.
232	*/
233	public static function trash_cancelled_orders( $limit = 20 ) {
234	$option = wc_parse_relative_date_option( get_option( 'woocommerce_trash_cancelled_orders' ) );
235
236	if ( empty( $option['number'] ) ) {
237	return 0;
238	}
239
240	return self::trash_orders_query(
241	apply_filters(
242	'woocommerce_trash_cancelled_orders_query_args',
243	array(
244	'date_created' => '<' . strtotime( '-' . $option['number'] . ' ' . $option['unit'] ),
245	'limit' => $limit, // Batches of 20.
246	'status' => OrderInternalStatus::CANCELLED,
247	'type' => 'shop_order',
248	)
249	)
250	);
251	}
252
253	/**
254	* Find and Anonymize refunded orders.
255	*
256	* @since 9.8.0
257	* @param int $limit Limit orders to process per batch.
258	* @return int Number of orders processed.
259	*/
260	public static function anonymize_refunded_orders( $limit = 20 ) {
261	$option = wc_parse_relative_date_option( get_option( 'woocommerce_anonymize_refunded_orders' ) );
262
263	if ( empty( $option['number'] ) ) {
264	return 0;
265	}
266
267	return self::anonymize_orders_query(
268	/**
269	* Filter to modify the query arguments for anonymizing refunded orders.
270	*
271	* @since 9.8.0
272	*
273	* @param string $date_created The date before which orders should be anonymized.
274	* @param int $limit The maximum number of orders to process in each batch.
275	* @param string $status The status of the orders to be anonymized.
276	* @param string $type The type of orders to be anonymized.
277	*/
278	apply_filters(
279	'woocommerce_anonymize_refunded_orders_query_args',
280	array(
281	'date_created' => '<' . strtotime( '-' . $option['number'] . ' ' . $option['unit'] ),
282	'limit' => $limit, // Batches of 20.
283	'status' => OrderInternalStatus::REFUNDED,
284	'type' => 'shop_order',
285	'anonymized' => false,
286	)
287	)
288	);
289	}
290
291	/**
292	* For a given query trash all matches.
293	*
294	* @since 3.4.0
295	* @param array $query Query array to pass to wc_get_orders().
296	* @return int Count of orders that were trashed.
297	*/
298	protected static function trash_orders_query( $query ) {
299	$orders = wc_get_orders( $query );
300	$count = 0;
301
302	if ( $orders ) {
303	foreach ( $orders as $order ) {
304	$order->delete( false );
305	++$count;
306	}
307	}
308
309	return $count;
310	}
311
312	/**
313	* Anonymize old completed orders.
314	*
315	* @since 3.4.0
316	* @param int $limit Limit orders to process per batch.
317	* @return int Number of orders processed.
318	*/
319	public static function anonymize_completed_orders( $limit = 20 ) {
320	$option = wc_parse_relative_date_option( get_option( 'woocommerce_anonymize_completed_orders' ) );
321
322	if ( empty( $option['number'] ) ) {
323	return 0;
324	}
325
326	return self::anonymize_orders_query(
327	apply_filters(
328	'woocommerce_anonymize_completed_orders_query_args',
329	array(
330	'date_created' => '<' . strtotime( '-' . $option['number'] . ' ' . $option['unit'] ),
331	'limit' => $limit, // Batches of 20.
332	'status' => OrderInternalStatus::COMPLETED,
333	'anonymized' => false,
334	'type' => 'shop_order',
335	)
336	)
337	);
338	}
339
340	/**
341	* For a given query, anonymize all matches.
342	*
343	* @since 3.4.0
344	* @param array $query Query array to pass to wc_get_orders().
345	* @return int Count of orders that were anonymized.
346	*/
347	protected static function anonymize_orders_query( $query ) {
348	$orders = wc_get_orders( $query );
349	$count = 0;
350
351	if ( $orders ) {
352	foreach ( $orders as $order ) {
353	WC_Privacy_Erasers::remove_order_personal_data( $order );
354	++$count;
355	}
356	}
357
358	return $count;
359	}
360
361	/**
362	* Delete inactive accounts.
363	*
364	* @since 3.4.0
365	* @param int $limit Limit users to process per batch.
366	* @return int Number of users processed.
367	*/
368	public static function delete_inactive_accounts( $limit = 20 ) {
369	$option = wc_parse_relative_date_option( get_option( 'woocommerce_delete_inactive_accounts' ) );
370
371	if ( empty( $option['number'] ) ) {
372	return 0;
373	}
374
375	return self::delete_inactive_accounts_query( strtotime( '-' . $option['number'] . ' ' . $option['unit'] ), $limit );
376	}
377
378	/**
379	* Delete inactive accounts.
380	*
381	* @since 3.4.0
382	* @param int $timestamp Timestamp to delete customers before.
383	* @param int $limit Limit number of users to delete per run.
384	* @return int Count of customers that were deleted.
385	*/
386	protected static function delete_inactive_accounts_query( $timestamp, $limit = 20 ) {
387	$count = 0;
388	$user_query = new WP_User_Query(
389	array(
390	'fields' => 'ID',
391	'number' => $limit,
392	'role__in' => apply_filters(
393	'woocommerce_delete_inactive_account_roles',
394	array(
395	'Customer',
396	'Subscriber',
397	)
398	),
399	'meta_query' => array( // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query
400	'relation' => 'AND',
401	array(
402	'key' => 'wc_last_active',
403	'value' => (string) $timestamp,
404	'compare' => '<',
405	'type' => 'NUMERIC',
406	),
407	array(
408	'key' => 'wc_last_active',
409	'value' => '0',
410	'compare' => '>',
411	'type' => 'NUMERIC',
412	),
413	),
414	)
415	);
416
417	$user_ids = $user_query->get_results();
418
419	if ( $user_ids ) {
420	if ( ! function_exists( 'wp_delete_user' ) ) {
421	require_once ABSPATH . 'wp-admin/includes/user.php';
422	}
423
424	foreach ( $user_ids as $user_id ) {
425	wp_delete_user( $user_id, 0 );
426	wc_get_logger()->info(
427	sprintf(
428	/* translators: %d user ID. */
429	__( "User #%d was deleted by WooCommerce in accordance with the site's personal data retention settings. Any content belonging to that user has been retained but unassigned.", 'woocommerce' ),
430	$user_id
431	)
432	);
433	++$count;
434	}
435	}
436
437	return $count;
438	}
439	}
440
441	new WC_Privacy();
442