Privacy Policy
This Privacy Policy describes how personal information is collected, used, disclosed, and protected in connection with the websites, free educational email courses, publications, and commercial services operated under the names BWGhostwriting and Letter of Challenge (together, the "Services"). Letter of Challenge is part of the BWGhostwriting business. The Services are operated by Bachtiar Widyantoro ("Operator," "we," "us," or "our"), based in Jakarta, Indonesia.
By accessing or using the Services, you acknowledge that you have read this Privacy Policy. If you do not agree, please do not use the Services or submit personal information to us.
1. Controller and contact
The data controller for personal information processed under this Policy is Bachtiar Widyantoro, operating as BWGhostwriting, including the Letter of Challenge brand and the website letterofchallenge.com (and related pages used to deliver the Services).
Privacy requests, access requests, and questions may be sent to:
We will use commercially reasonable efforts to respond within a reasonable period, subject to applicable law and verification of your identity where required.
2. Scope
This Policy applies to personal information collected through:
- letterofchallenge.com and related landing, thank-you, and legal pages;
- BWGhostwriting service materials, client intake, and commercial communications;
- free educational email sequences (including The Challenge Newsletter System);
- email platforms used to deliver content (currently Kit and, after the free course path, Substack, as described below);
- optional analytics tooling; and
- payment processing when you purchase paid products or services.
This Policy does not govern third-party websites or services that we do not control, even if linked from our materials (for example, public Notion pages, social networks, or payment processors' own portals), except to the extent we receive data from them as described herein.
3. Categories of personal information we collect
Depending on how you interact with the Services, we may collect:
3.1 Identity and contact data
- Name (including first name or full name when provided);
- Email address;
- Other contact details you voluntarily provide (for example, in a reply email or client form).
3.2 Course and list data
- Subscription and confirmation status;
- Tags, segments, or list membership related to free courses, practice challenges, or publications;
- Email engagement signals processed by our email providers (for example, delivery, opens, clicks, unsubscribes), where enabled.
3.3 Commercial and payment data
- Billing name, business name, and invoice details when you engage paid services;
- Payment transaction metadata necessary to complete a purchase (card or account numbers are typically processed by the payment provider, not stored in full by us).
3.4 Technical, usage, and analytics data
- Device and browser information, approximate location derived from IP address, referrer, pages viewed, and similar diagnostics;
- Cookies, local storage, or similar technologies used for site function, preferences (for example, theme), security, or analytics, where implemented.
3.5 Content you submit
- Messages, form free-text, course homework or issue submissions you send by email or form;
- Client project materials you provide under a separate engagement (subject also to any contract between us).
4. How we collect information
- Directly from you, when you subscribe, purchase, email us, complete forms, or submit course work;
- Automatically, through cookies, server logs, and analytics tools when you visit our sites;
- From service providers, such as Kit, Substack, hosting, analytics, and payment processors, in connection with delivering the Services.
5. Purposes and legal bases of processing
We process personal information for the following purposes:
- Provide the Services: deliver free courses (including Day 0 / confirmation and Days 1-5 sequences), weekly practice challenges after the course where applicable, publications, and paid ghostwriting or related services;
- Communications: send transactional messages, course emails, service updates, and, where permitted, marketing or educational content;
- Operations: administer lists, prevent abuse, troubleshoot, secure systems, and maintain records;
- Analytics and improvement: understand aggregate use of sites and emails to improve content and conversion paths;
- Payments and accounting: process transactions, issue invoices, and meet bookkeeping or tax obligations;
- Legal compliance: comply with applicable law, enforce terms, and protect rights, safety, and property.
Where Indonesian personal data protection law or other applicable law requires a legal basis, we rely on one or more of: performance of a contract or pre-contractual steps; your consent (for example, optional marketing or non-essential cookies where required); legitimate interests that are not overridden by your rights (for example, securing the Services and improving free educational materials); and legal obligation.
6. Email platforms: Kit and Substack
Free educational sequences associated with letterofchallenge.com are delivered primarily through Kit (formerly ConvertKit). After completion of the applicable free course path, subscribers may be moved to Substack for ongoing publication-related email, which may occur on a manual or scheduled operational basis.
Kit and Substack act as processors or independent controllers depending on their product terms. Their processing is also governed by their own privacy policies and terms. We encourage you to review those documents. We configure those tools to support delivery of the Services described above and do not sell your email address as a standalone commodity.
7. Disclosure of personal information
We may disclose personal information to:
- Service providers that host sites, send email, process payments, provide analytics, security, or infrastructure (including Kit, Substack, and payment processors);
- Professional advisers (legal, accounting) under confidentiality obligations when needed;
- Authorities when required by law, legal process, or to protect rights and safety;
- Business transfer recipients, in connection with a merger, acquisition, or asset sale, subject to appropriate safeguards.
We do not sell personal information for money in the ordinary course of the BWGhostwriting business. If a specific product ever involves a different sharing model, we will describe it clearly before you opt in.
8. International transfers
We operate from Indonesia. Service providers may process data in other countries (for example, the United States or other locations where Kit, Substack, hosting, or payment vendors maintain infrastructure). Where required, we take steps consistent with applicable law to protect transferred information.
9. Retention
We retain personal information for as long as needed to provide the Services, maintain business and tax records, resolve disputes, and comply with legal obligations. Course list data is retained until you unsubscribe or request deletion, subject to residual backup and legal retention needs. Payment and invoice records may be retained for longer periods as required by law.
10. Security
We implement administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, or alteration. No method of transmission or storage is completely secure. You use the Services at your own risk to that extent.
11. Your choices and rights
Subject to applicable law, you may:
- Unsubscribe from marketing or course emails using the link in those emails, or by contacting us;
- Request access, correction, or deletion of personal information we hold about you;
- Withdraw consent where processing is based on consent, without affecting prior lawful processing;
- Object to or restrict certain processing where the law provides that right;
- Control cookies through browser settings and, where offered, on-site preference tools.
Unsubscribing from one sequence may not remove you from all lists if you have separate subscriptions (for example, a free course list and a later Substack publication). Contact us if you need a full removal request.
12. Children
The Services are directed to adults operating professional or business activities (including coaches and similar practitioners). We do not knowingly collect personal information from children under 16. If you believe we have done so, contact us and we will take appropriate steps.
13. Third-party links and embeds
Our materials may link to third-party resources (including Notion-hosted assets, social platforms, or payment pages). Those parties' privacy practices are their own. We are not responsible for their content or processing.
14. Changes to this Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Material changes may be communicated by posting on this page and, where appropriate, by email or site notice. Continued use of the Services after an update constitutes acceptance of the revised Policy to the extent permitted by law.
15. Governing law
This Privacy Policy is governed by the laws of the Republic of Indonesia, without regard to conflict-of-law principles, except where mandatory consumer or data-protection rules of another jurisdiction apply to you.
16. Contact
For privacy inquiries: hello@letterofchallenge.com or bach@bwghostwriting.com.