Privacy Policy
This Privacy Policy describes how personal information is collected, used, disclosed, and protected in connection with the websites, free educational email courses, publications, and commercial services operated under the names BWGhostwriting and Letter of Challenge (together, the "Services"). Letter of Challenge is part of the BWGhostwriting business. The Services are operated by Bachtiar Widyantoro ("Operator," "we," "us," or "our"), based in Jakarta, Indonesia.
By accessing or using the Services, you acknowledge that you have read this Privacy Policy. If you do not agree, please do not use the Services or submit personal information to us.
1. Controller and contact
The data controller for personal information processed under this Policy is Bachtiar Widyantoro, operating as BWGhostwriting, including the Letter of Challenge brand and the website letterofchallenge.com (and related pages used to deliver the Services).
Privacy requests, access requests, and questions may be sent to:
We will use commercially reasonable efforts to respond within a reasonable period, subject to applicable law and verification of your identity where required.
2. Scope
This Policy applies to personal information collected through:
- letterofchallenge.com and related landing, thank-you, and legal pages;
- BWGhostwriting service materials, client intake, and commercial communications;
- free educational email sequences (including The Challenge Newsletter System);
- email platforms used to deliver content (currently EmailOctopus for free course automation and, after the free course path, Substack, as described below);
- Acceptrics consent management, Google Analytics, and related site-measurement tooling; and
- payment processing when you purchase paid products or services.
This Policy does not govern third-party websites or services that we do not control, even if linked from our materials (for example, public Notion pages, social networks, or payment processors' own portals), except to the extent we receive data from them as described herein.
3. Categories of personal information we collect
Depending on how you interact with the Services, we may collect:
3.1 Identity and contact data
- Name (including first name or full name when provided);
- Email address;
- Other contact details you voluntarily provide (for example, in a reply email or client form).
3.2 Course and list data
- Subscription and confirmation status;
- Tags, segments, or list membership related to free courses, practice challenges, or publications;
- Email engagement signals processed by our email providers (for example, delivery, opens, clicks, unsubscribes), where enabled.
3.3 Commercial and payment data
- Billing name, business name, and invoice details when you engage paid services;
- Payment transaction metadata necessary to complete a purchase (card or account numbers are typically processed by the payment provider, not stored in full by us).
3.4 Technical, usage, and analytics data
- Device and browser information, IP address, approximate location derived from IP address, referrer, page URL, pages viewed, interaction events, and similar diagnostics;
- Online identifiers generated by Google Analytics and first-party cookies used to distinguish visits and understand how visitors use the site;
- Your cookie-consent choices, stored locally in your browser by Acceptrics so the site can remember and apply them;
- Local storage or similar technologies used for site functions and preferences, such as the selected theme.
3.5 Content you submit
- Messages, form free-text, course homework or issue submissions you send by email or form;
- Client project materials you provide under a separate engagement (subject also to any contract between us).
4. How we collect information
- Directly from you, when you subscribe, purchase, email us, complete forms, or submit course work;
- Automatically, through cookies, server logs, and analytics tools when you visit our sites;
- From service providers, such as EmailOctopus, Substack, hosting, analytics, and payment processors, in connection with delivering the Services.
5. Purposes and legal bases of processing
We process personal information for the following purposes:
- Provide the Services: deliver free courses (including Day 0 / confirmation and Days 1-5 sequences), weekly practice challenges after the course where applicable, publications, and paid ghostwriting or related services;
- Communications: send transactional messages, course emails, service updates, and, where permitted, marketing or educational content;
- Operations: administer lists, prevent abuse, troubleshoot, secure systems, and maintain records;
- Analytics and improvement: measure visits, traffic sources, page use, and conversion paths so we can improve the site and educational content;
- Payments and accounting: process transactions, issue invoices, and meet bookkeeping or tax obligations;
- Legal compliance: comply with applicable law, enforce terms, and protect rights, safety, and property.
Where Indonesian personal data protection law or other applicable law requires a legal basis, we rely on one or more of: performance of a contract or pre-contractual steps; your consent (for example, optional marketing or non-essential cookies where required); legitimate interests that are not overridden by your rights (for example, securing the Services and improving free educational materials); and legal obligation.
6. Cookie consent and Google Analytics
We use Acceptrics as our consent-management provider. Its banner records your analytics and advertising choices in local storage in your browser and communicates those choices to supported tags through Google Consent Mode. Acceptrics loads from its service domain and may receive technical request information needed to deliver the banner and its current configuration. You can reopen the banner settings where available to change your choice.
We use Google Analytics 4, provided by Google, to understand how visitors find and use letterofchallenge.com. The Google tag uses cookies and similar identifiers and may send Google information such as the page URL, referrer, browser and device information, interaction events, IP address, and approximate location derived from the IP address. We use measurement ID G-03X3HZ8034 for this site.
We use this information to produce usage reports, measure sign-up paths, diagnose site performance, and improve our content. Google processes information under its own terms and privacy practices. Learn more about how Google uses information from sites that use its services and review the Google Privacy Policy.
Google Analytics retention depends on the controls configured for our Analytics property and Google's applicable retention practices. You can limit collection by blocking or deleting cookies in your browser or by installing the Google Analytics Opt-out Browser Add-on. For visitors in the European Economic Area, United Kingdom, and Switzerland, the Google tag loads with analytics and advertising consent denied by default. Before consent in those regions, it does not set Analytics cookies, although Google may receive cookieless signals used for aggregated measurement. If you grant analytics consent through the banner, Acceptrics updates the consent state and Google Analytics can begin full measurement. For visitors outside those listed regions, analytics and advertising consent signals default to granted and Google Analytics begins full measurement when the page loads. Applicable law may provide additional choices or require different controls depending on your location.
7. Email platforms: EmailOctopus and Substack
Free educational sequences associated with letterofchallenge.com are delivered primarily through EmailOctopus. We use EmailOctopus to collect and deliver the applicable free course emails. After completion of the applicable free course path, subscribers may be moved to Substack for ongoing publication-related email, which may occur on a manual or scheduled operational basis.
EmailOctopus and Substack act as processors or independent controllers depending on their product terms. Their processing is also governed by their own privacy policies and terms. We encourage you to review those documents. We configure those tools to support delivery of the Services described above and do not sell your email address as a standalone commodity.
8. Disclosure of personal information
We may disclose personal information to:
- Service providers that host sites, manage consent, send email, process payments, provide analytics, security, or infrastructure (including Acceptrics, Google Analytics, EmailOctopus, Substack, and payment processors);
- Professional advisers (legal, accounting) under confidentiality obligations when needed;
- Authorities when required by law, legal process, or to protect rights and safety;
- Business transfer recipients, in connection with a merger, acquisition, or asset sale, subject to appropriate safeguards.
We do not sell personal information for money in the ordinary course of the BWGhostwriting business. If a specific product ever involves a different sharing model, we will describe it clearly before you opt in.
9. International transfers
We operate from Indonesia. Service providers may process data in other countries (for example, the United States or other locations where Acceptrics, Google, EmailOctopus, Substack, hosting, or payment vendors maintain infrastructure). Where required, we take steps consistent with applicable law to protect transferred information.
10. Retention
We retain personal information for as long as needed to provide the Services, maintain business and tax records, resolve disputes, and comply with legal obligations. Course list data is retained until you unsubscribe or request deletion, subject to residual backup and legal retention needs. Payment and invoice records may be retained for longer periods as required by law. Google Analytics event-level and user-level data is retained according to the setting configured in our Analytics property and Google's applicable retention practices; aggregated reports may remain available longer.
11. Security
We implement administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, or alteration. No method of transmission or storage is completely secure. You use the Services at your own risk to that extent.
12. Your choices and rights
Subject to applicable law, you may:
- Unsubscribe from marketing or course emails using the link in those emails, or by contacting us;
- Request access, correction, or deletion of personal information we hold about you;
- Withdraw consent where processing is based on consent, without affecting prior lawful processing;
- Object to or restrict certain processing where the law provides that right;
- Control analytics and cookies through the Acceptrics banner settings where available, browser settings, deleting stored cookies and local storage, or using the Google Analytics Opt-out Browser Add-on linked above.
Unsubscribing from one sequence may not remove you from all lists if you have separate subscriptions (for example, a free course list and a later Substack publication). Contact us if you need a full removal request.
13. Children
The Services are directed to adults operating professional or business activities (including coaches and similar practitioners). We do not knowingly collect personal information from children under 16. If you believe we have done so, contact us and we will take appropriate steps.
14. Third-party links and embeds
Our materials may link to third-party resources (including Notion-hosted assets, social platforms, or payment pages). Those parties' privacy practices are their own. We are not responsible for their content or processing.
15. Changes to this Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Material changes may be communicated by posting on this page and, where appropriate, by email or site notice. Continued use of the Services after an update constitutes acceptance of the revised Policy to the extent permitted by law.
16. Governing law
This Privacy Policy is governed by the laws of the Republic of Indonesia, without regard to conflict-of-law principles, except where mandatory consumer or data-protection rules of another jurisdiction apply to you.
17. Contact
For privacy inquiries: [email protected] or [email protected].