Privacy Policy

Privacy Policy for hidia.net

Last updated: 23/10/2026

1. Introduction

Welcome to hidia.net (https://www.hidia.net). We care about your personal data and your right to privacy. This policy explains what we collect, why, who can see it, how long we keep it and what your rights are.

For the purposes of the General Data Protection Regulation (GDPR), the Data Controller is Slide SRL, Italy. Questions about this policy: info@slide24.com. Privacy requests: privacy@hidia.net.

2. Information we collect

Account data: username, display name, email address and password (stored only in encrypted, hashed form). First and last name are optional.
Order data: billing and shipping address, phone number if you give it at checkout, the products you order and your order history. We never see or store your card details: payments are handled by the payment provider (for example PayPal).
Commission data: what you write and the files you upload in our commission forms.
Profile and community data: profile picture, short bio, links to your other profiles, comments, messages on the Silly Board, reviews, badges you earn, and artworks you commissioned (when we credit you).
Notification data: your notification choices, the notifications you receive and the emails we send you.
Security data: collected by our security system XANDR Watchdog, described in detail in section 4.
Technical data: cookies and similar storage, described in the Cookie Policy below.

3. How we use your information

To create and run your account and let you log in.
To process, ship and manage your orders and commissions.
To show your public member page and your community activity (section 5).
To send you the notifications and emails you chose (section 6), and the emails needed for your orders and account (order confirmations, password resets).
To keep the site and your account safe (section 4).
To understand how the site is used and improve it, only if you accept analytics cookies.
To meet our legal obligations, for example keeping invoices and order records.

We do not sell your data and we do not send you marketing from third parties.

4. Security of your account (XANDR Watchdog)

XANDR Watchdog is the security system we built for hidia.net. It runs on our own server. Its only job is to protect the site and your account from break-in attempts, fake accounts and abuse. It does not show ads, does not track you across other sites and does not set cookies.

4.1 What it records

Logins: successful and failed logins, log-outs, the username or email typed in the login form, your IP address, the date and time, and the type of browser your device reports.
Account events: account creation, password reset requests, and changes to your account such as a new email, a new password (we record only that it changed, never the password), a new profile picture or a role change.
Suspicious activity: attempts to guess usernames, automated scans, requests that look like attacks, and forms filled in by bots.

4.2 Blocking

After several failed logins in a short time (by default 5 within 15 minutes), the IP address that made them is blocked from logging in for a while (by default 30 minutes, longer if it happens again). Addresses known to attack the site can be blocked permanently. A blocked visitor sees a page explaining the block, which shows their IP address and how long it lasts. Blocks end on their own. If you were blocked by mistake, write to us.

4.3 Checks when you create an account

To stop fake and spam accounts, when you sign up we check:

whether your email address belongs to a known throw-away or scam email service. The lists are downloaded to our server, so this check happens here and your email is not sent anywhere;
whether the domain of your email (the part after the @) can receive email, and whether it is listed on the Spamhaus Domain Block List. Only the domain is looked up, never the full address;
whether your email address or IP address is listed in the StopForumSpam database of known spammers;
whether the form was filled in by a real browser and not by a bot (a hidden field that only bots fill in, and a Google reCAPTCHA check).

If a check fails, the account may not be created and a short message is shown. No other decision is made about you automatically. If you think you were refused by mistake, write to us and a person will look at it.

4.4 Password checks

When you choose a new password, we may check whether it appears in public lists of passwords leaked from other websites. Your password is never sent: only the first few characters of a coded (hashed) version leave our server, which is not enough to recover the password. A password found in those lists is refused so your account is not easy to break into.

4.5 Who can see it

The security data can be seen only by the site administrators, inside the site’s admin area. When something serious happens (for example many failed logins on one account), an alert email is sent to the administrators. It is stored on our server at our hosting provider Aruba (Italy) and is not shared with anyone else, except where the law requires it (for example a request from the police after an attack).

4.6 How long we keep it

Security log entries: 90 days, then deleted automatically.
Pages viewed by logged-in members: 30 days.
IP blocks: until they expire, or until an administrator removes them.
Technical debug and speed logs (used to fix problems): kept only for a short time and deleted automatically.

4.7 Legal basis

We process this data because of our legitimate interest in keeping the site, the shop and our members’ accounts secure (Art. 6(1)(f) GDPR; recital 49 GDPR names network and information security as a legitimate interest). You can object to this processing by writing to us; we will weigh your request, but some security records must be kept for the site to remain safe.

5. Your public member page

Every member has a public page at https://www.hidia.net/user/<your display name>/. Your name can link to it wherever it appears on the site (gallery, Silly Board, reviews, comments, notifications). The page can show your display name, profile picture, badges, bio, links, the date you joined, your public comments and messages, and the artworks you commissioned if you are credited on them.

It never shows your username, email, real name, address or orders. Member pages are not offered to search engines. You can change or remove your display name, picture, bio and links at any time in your Account details. If you do not want to be credited on an artwork, tell us and we will remove the credit.

6. Notifications and emails

Notification emails are off until you switch them on. You choose which kinds you want and whether you get them on the site, by email, or both.
Every notification email has an unsubscribe link, and you can change your choices on your account page at any time.
You can delete your notifications. Deleted notifications are no longer shown to you or included in later emails.
Emails are sent from our own address through Aruba’s mail servers. We keep a short technical record of sent emails (recipient, time, success or error) to fix delivery problems.
Emails about your orders and your account (confirmations, password resets) are sent whatever your notification choices are, because they are needed for the service.

7. Legal basis for processing (GDPR)

Contract: your account, orders, commissions and the emails they need.
Consent: notification emails, analytics cookies. You can withdraw consent at any time; this does not affect what happened before.
Legitimate interest: site and account security (section 4), member pages and community features (section 5).
Legal obligation: keeping invoices and order records as required by Italian law.

8. Who we share your information with

Aruba S.p.A. (Italy): hosting of the website and our email service.
Payment providers (e.g. PayPal): to process payments. Please read their own privacy policy.
Couriers: your name, address and phone number, to deliver physical orders.
Google reCAPTCHA: on the login, sign-up and password forms, to tell people from bots. Google receives technical data from your browser.
Spamhaus and StopForumSpam: during sign-up only, as described in section 4.3.
Google Analytics: only if you accept analytics cookies.
Gravatar (Automattic): if you have not uploaded a profile picture, a default picture may be requested from Gravatar using a coded (hashed) version of your email.

Some of these providers may process data outside the European Union. Where they do, they rely on safeguards approved by the European Commission.

9. How long we keep your data

Account and profile data: while your account exists. When you ask us to delete your account, we delete it, except what the law requires us to keep.
Orders and invoices: 10 years, as required by Italian tax law.
Security data: see section 4.6.
Notifications: up to 90 days, or until you delete them.
Commission files: as long as needed to complete the commission and handle any follow-up.

10. Your rights (GDPR)

Access: ask for a copy of the data we hold about you.
Rectification: correct data that is wrong or incomplete.
Erasure: ask us to delete your data, where the law allows.
Restriction: ask us to limit how we use your data.
Portability: receive your data in a common format.
Objection: object to processing based on legitimate interest (including section 4).
Withdraw consent at any time.
Complain to the Italian data protection authority, the Garante per la protezione dei dati personali.

To use any of these rights, write to privacy@hidia.net.

11. Children

The site is not meant for children under 16. We do not knowingly collect their data. If we learn that a child under 16 has created an account, we will close it and delete the data.

12. Changes and contact

We update this policy when the site changes. The date at the top shows the latest version. Questions: info@slide24.com or privacy@hidia.net.

Cookie Policy

Last updated: 23/10/2026

1. What are cookies?

Cookies are small text files a website stores on your device. Similar browser storage (“local storage”) works in the same way. They help the site work and remember your choices.

2. Cookies we use

Strictly necessary: keep you logged in, keep your shopping cart, protect forms, and remember your cookie choice. These do not need your consent.
Preferences (local storage): small choices made on the site, for example that you closed a site announcement. They stay in your browser and are not sent to us.
Analytics: used only if you click Accept in the cookie banner. They tell us, in aggregate, which pages are visited.
Third-party: PayPal (when you pay with it) and Google reCAPTCHA (on login and sign-up forms) may set their own cookies. We do not control them.

Our security system XANDR Watchdog does not use cookies.

3. Managing your choices

Cookie banner: on your first visit you can choose Accept or Deny. You can change your choice at any time with the “Manage consent” link on the site.

Browser settings: you can also block or delete cookies in your browser. If you block necessary cookies, logging in and the cart will not work.

4. Updates

We update this Cookie Policy when the cookies we use change. The date at the top shows the latest version.