Privacy Policy

Last updated 26 August 2026

We Went First is made by WebCentury, a small team based in Romania. This page explains, in plain language, what we collect when you buy The Bali Map, why we collect it, and what you can do about it.

What we collect

• Your email address — to send your access link and any order-related messages.
• A record of your order — the product, the price you paid, the date, and the country you paid VAT in.
• Your IP address, briefly — used only to rate-limit how often the same address can start a checkout or request a new access link.

That is the whole list. We do not collect your name, your postal address, or anything about how you use the map once it is yours. There is no analytics on this site — see our Cookie Policy.

Why we're allowed to process it

• Delivering what you paid for — creating your order, sending your access link, handling support — relies on our contract with you (GDPR Article 6(1)(b)).
• Limiting how often one address can start a checkout or request a new access link relies on our legitimate interest in stopping one address from locking everyone else out (Article 6(1)(f)).

How long we keep it

• Order records: 10 years. Romanian tax law requires us to keep accounting records for that long, whether or not we would otherwise want to.
• Session and access-link data: up to 1 year, matching how long a signed-in session itself lasts.

Who else sees it

We do not sell your data. The companies that process it on our behalf, and why:

• Stripe — processes your payment. We never see or store your card details.
• Resend — sends your access-link and order emails on our behalf.
• Cloudflare — hosts the site and stores your order record (D1) and the map files (R2).

Your rights

Under GDPR you can ask us to show you the data we hold on you, correct it, delete it, hand you a copy of it, or object to how we use it. Write to us and we will respond within a month, at hello@wewentfirst.com.

If you are unhappy with how we handle a request, you can also complain to Romania's data protection authority, ANSPDCP, at dataprotection.ro.