HereAreI Acceptable Use Policy

Effective date: 2026-09-19
Last updated: 2026-09-21
Applies to: everyone who uses HereAreI (https://www.herearei.com), including site owners, people who connect, register or manage domains through us, people who use email mailboxes we provide, and visitors who interact with those services.

1. What this policy is #

1.1. HereAreI is a hosted website builder operated by QuaalCo ("HereAreI", "we", "us"), a sole proprietorship in British Columbia, Canada. We host websites. Once paid features launch (they are not offered during the beta), we will also register domain names as a reseller of an ICANN-accredited registrar and provide email mailboxes supplied by an email partner; we currently intend to use Openprovider for both.

1.2. This Acceptable Use Policy ("AUP") explains what you may not do with our services, the limits that apply to each plan, how we enforce the policy, how anyone can report abuse to us, and how you can appeal a decision.

1.3. This AUP is part of the HereAreI Terms of Service. If you register a domain through us, the registrar's registration agreement also applies, and if you use a mailbox, the email partner's terms of use and acceptable use policy also apply (see section 8). If those documents conflict with this AUP, the stricter rule applies to you.

1.4. You are responsible for everything published, sent or stored under your account, including anything done by your staff, contractors, collaborators, clients or site visitors (for example, through a form or comment feature). If you build sites for other people, you must make sure they follow this AUP too.

1.5. Our own providers have acceptable-use rules that we must obey, and yours must be at least as strict. In particular, our servers run on DigitalOcean, whose Acceptable Use Policy (updated 2026-03-20, read 2026-09-16) prohibits illegal activity, security violations, network abuse, unsolicited bulk email, unauthorized cryptomining, excessive shared-resource use and invalid domain registrant information. If a rule of DigitalOcean, our registrar, ICANN, a registry or our email partner is stricter than this AUP, we will apply the stricter rule.

2. Prohibited content #

You may not use HereAreI to host, publish, link to, distribute, or promote any of the following.

2.1. Illegal content #

2.1.1. Anything that is illegal in Canada, in the country where you are located, or in the country where your content is targeted. This includes content whose creation, possession or distribution is itself a crime, and content that facilitates a crime.

2.1.2. Content that violates a court order, an injunction, or a lawful demand from a competent authority that has been served on you or on us.

2.2. Child sexual abuse material (zero tolerance, mandatory reporting) #

2.2.1. Any sexual depiction of a minor, any content that sexualizes minors, any material that advertises or provides access to such content, and any grooming or solicitation of minors is absolutely prohibited. This includes drawings, animation and AI-generated material.

2.2.2. We do not warn, we do not offer an appeal, and we do not wait for a complaint. If we become aware of such material we will immediately remove it, terminate the account, preserve the evidence, and report it.

2.2.3. As a Canadian provider of an Internet service we are required by the Mandatory Reporting of Internet Child Pornography by Persons who Provide an Internet Service Act (S.C. 2011, c. 4) to report to the designated organization (Cybertip.ca, run by the Canadian Centre for Child Protection) any Internet address we are advised is making such material available, to notify police and preserve data when we have reasonable grounds to believe our service is being used to commit a child-pornography offence, and to keep that information confidential. Where the material or the people involved appear to be in the United States we may also report to NCMEC's CyberTipline.

2.2.4. If you find such material on a HereAreI-hosted site, do not download or forward it. Report the URL to support@quaal.co with the subject line starting "URGENT CSAM" and to Cybertip.ca (https://www.cybertip.ca).

2.3. Phishing, brand impersonation and deceptive sites #

2.3.1. You may not create pages that imitate a bank, payment processor, government body, courier, email provider, social network, software company, or any other organization or person in order to collect logins, payment details, personal information or money.

2.3.2. You may not use logos, brand names, page designs, domain names or email addresses that would lead a reasonable person to believe your site or message comes from someone it does not, including HereAreI, QuaalCo, our registrar, our email partner, DigitalOcean or Stripe.

2.3.3. Fake login forms, fake "your account is suspended" pages, fake invoices, fake package-tracking pages, fake customer-support numbers, and "verify your identity" pages that are not operated by the organization they name are all phishing, whether or not anyone has been harmed yet.

2.3.4. Phishing sites are removed on discovery without prior warning (see section 11). Because free-plan sites on custom domains are a common phishing vector, we apply extra checks to new free-plan sites and to bring-your-own domains.

2.4. Malware and harmful code #

2.4.1. You may not host, distribute, link to, or embed viruses, worms, trojans, ransomware, spyware, keyloggers, browser hijackers, cryptojacking scripts, exploit kits, malicious browser extensions, or any other code designed to damage, take control of, or covertly collect data from a device or account.

2.4.2. You may not host command-and-control endpoints, malware drop zones, exfiltration endpoints, or files that are part of a malware campaign, even if the file itself is not executable.

2.4.3. Only ordinary website file types can be uploaded (for example HTML, CSS, JavaScript, images, fonts, PDF, audio and video); executables and server-side scripts such as PHP are refused. Uploading malicious files, or repeatedly attempting to, will suspend the account.

2.5. Spam and anti-spam law violations #

2.5.1. You may not use HereAreI, any HereAreI mailbox, any domain registered through us, or any site hosted with us to send, relay, or advertise unsolicited bulk or commercial electronic messages of any kind (email, SMS, instant messages, social-media DMs, comment spam, forum spam).

2.5.2. You must comply with Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23) when sending commercial electronic messages to or from Canada, with the US CAN-SPAM Act when messaging US recipients, and with the equivalent laws (for example the EU ePrivacy rules and GDPR) wherever your recipients are. Under CASL that means, as of 2026-09-16 (Act text, CRTC regulations):

• you have the recipient's express consent (a positive opt-in — no pre-checked boxes) or a valid form of implied consent, and you can prove it;
• every message identifies you by name, gives a mailing address plus a phone number, email address or web address, and contains an unsubscribe mechanism that works by the same electronic means for at least 60 days;
• you honour unsubscribe requests within 10 business days;
• you do not send an email whose purpose is to ask for consent, because under CASL s. 1(3) that request is itself a commercial electronic message.

2.5.3. You may not host a site that advertises products or services promoted by spam sent from anywhere ("spamvertised" sites), sell or share email lists, or host harvested address lists, mass-mailing tools, or "bulletproof" mailing services.

2.5.4. Landing pages for legitimate opt-in newsletters are fine. Sending the newsletter itself must be done through a proper bulk-email provider, not through a HereAreI mailbox (see section 6).

2.6. Fraud, scams and financial abuse #

2.6.1. You may not run or promote advance-fee scams, fake stores, fake charities, fake job offers, fake investment or cryptocurrency schemes, pyramid or Ponzi schemes, "get rich quick" schemes, fake reviews or testimonials, counterfeit goods, forged documents, stolen payment cards or credentials, money-laundering services, or any other activity intended to deceive people out of money, property or personal information.

2.6.2. You may not publish false or misleading claims about a product, service, price or identity that would violate the Competition Act (Canada) or equivalent consumer-protection law.

2.7. Hate, violence and extremism #

2.7.1. You may not publish content that promotes hatred against, dehumanizes, or advocates violence or discrimination against people based on race, national or ethnic origin, colour, religion, age, sex, sexual orientation, gender identity or expression, marital status, family status, disability, or any other characteristic protected under Canadian law.

2.7.2. You may not glorify, promote, recruit for, fund, or provide material support to terrorism or violent extremism, or publish instructions for causing serious physical harm, including manuals for weapons or explosives intended to harm people.

2.7.3. You may not publish content that incites or threatens violence against any person or group.

2.8. Harassment, abuse and privacy violations #

2.8.1. You may not use our services to harass, bully, threaten, intimidate, stalk or defame any person.

2.8.2. You may not publish another person's private information without their consent ("doxxing"): home addresses, phone numbers, government identifiers, financial details, medical information, private photographs, or anything else obtained without authorization.

2.8.3. You may not publish intimate images of a person without their consent, or content that sexualizes a person without their consent, including AI-generated or manipulated images ("deepfakes").

2.8.4. You may not host sites whose purpose is to attack, expose, or coordinate harassment of an individual.

2.9. Intellectual-property infringement #

2.9.1. You may not publish or distribute content that infringes anyone's copyright, trademark, patent, trade secret, moral rights, or other intellectual-property rights. This includes pirated software, movies, music, books, games, fonts and templates; "cracked" or "nulled" software and licence keys; and content copied from other sites without permission.

2.9.2. HereAreI handles infringement complaints under two processes: the Canadian notice-and-notice regime and a voluntary process for notices in the format of the US DMCA (see section 10.5). Repeat infringers will have their accounts terminated (see section 11.6).

2.9.3. The templates, editor and platform code that HereAreI provides remain our property or that of our licensors; you receive a licence to use them for your sites on our service only, as set out in the Terms of Service.

2.10. Adult and sexually explicit content (our decision) #

2.10.1. Decision: HereAreI does not permit pornography or sexually explicit content. You may not host or link to sexually explicit images, video, audio, text or live streams, or sites whose primary purpose is sexual arousal, escort or sex-work advertising, sexually explicit "adult dating" or "cam" services, or the sale of sexual services.

2.10.2. Why: free-plan sites share a common subdomain and IP reputation with every other customer; our payment processor's restricted-business rules limit what we can bill for (Stripe's list of restricted businesses includes adult content and services: https://stripe.com/legal/restricted-businesses); and our email partner's Acceptable Use Policy applies to mail sent from every mailbox we provide. Rather than build age-verification and separate infrastructure, we have chosen not to serve this category.

2.10.3. What is allowed: non-explicit artistic nudity (for example a photographer's or painter's portfolio), medical, sexual-health and sex-education content, content about LGBTQ+ identities, and the sale of lawful products such as lingerie or wellness products presented in a non-explicit way. If your site includes any nudity, you must add a clear content notice on the landing page. If you are unsure whether your content is allowed, ask us at support@quaal.co before publishing; we would rather answer a question than suspend a site.

2.10.4. We may also decline to host content that is lawful but that, in our reasonable judgment, exposes HereAreI, other customers or our providers to reputational, legal or deliverability harm. If we decline your content on this ground we will tell you why, give you an export of your site, and refund any unused prepaid period as described in the Terms of Service.

2.11. Other prohibited content #

2.11.1. Content that promotes or facilitates self-harm or suicide, or eating disorders, except recognized support and prevention resources.

2.11.2. Sale or promotion of illegal drugs, controlled substances without a licence, drug paraphernalia where illegal, weapons or ammunition where illegal, or regulated goods (tobacco, vaping products, cannabis, alcohol, gambling, firearms, prescription medicines) in violation of the law of the seller's or buyer's jurisdiction. Lawful, licensed Canadian businesses in regulated categories must email support@quaal.co before publishing so we can confirm the site complies with our processor's and providers' rules.

2.11.3. Gambling, lotteries, sweepstakes or betting services unless licensed where they operate and approved by us in writing in advance.

2.11.4. Content that violates the privacy or publicity rights of others, including the unauthorized collection of personal information from visitors (see section 4.6).

3. Prohibited conduct #

3.1. Cryptocurrency mining #

3.1.1. You may not run mining, staking, proof-of-work, or "browser mining" code on our servers or inject it into visitors' browsers through your site. This applies to every plan and every amount, however small.

3.2. Proxies, VPNs, tunnels and file-sharing services #

3.2.1. HereAreI serves static websites. You may not use it to run or advertise open proxies, VPN endpoints, TOR relays or exit nodes, SOCKS or HTTP proxies, tunnelling services, port forwarders, IRC bouncers, or any service that relays traffic for third parties.

3.2.2. You may not host BitTorrent trackers, .torrent files or magnet links that point to infringing content, warez or "release" sites, file-locker or "cyberlocker" services, or any general-purpose file-sharing service. Offering your own lawful files (a PDF brochure, your own music demo, your own software) for download from your site is fine within your storage and bandwidth limits.

3.3. Network and security abuse #

3.3.1. You may not scan, probe, fingerprint or test the vulnerability of HereAreI's systems, other customers' sites, or any third-party system, or attempt to gain unauthorized access to any account, server, network or data. This includes port scanning, credential stuffing, brute-forcing passwords, directory enumeration, and "just checking" whether a security hole exists. If you want to report a vulnerability you found accidentally, email support@quaal.co with "Security" in the subject line and stop testing; we will not take action against good-faith reporters who follow this rule.

3.3.2. You may not interfere with, disrupt, or degrade the service for others: denial-of-service attacks, flooding, forging packets or headers, DNS or BGP abuse, or deliberately overloading our systems.

3.3.3. You may not circumvent, disable or tamper with any quota, rate limit, security feature, scanning system, "site paused" page, billing control, or access control on the platform, including by splitting one project across many free accounts, automating account creation, or using stolen or fabricated identities or payment methods.

3.3.4. You may not use our systems to attack, scrape abusively, or interfere with any third party's systems, and you may not use our platform as a launch point for any of the conduct in section 2.

3.3.5. You may not reverse-engineer, decompile, or attempt to extract the source code of the HereAreI platform, except where the law gives you a right we cannot exclude.

3.4. Account integrity #

3.4.1. You must give accurate account, billing and contact information and keep it current. You must not share access to your account or your email sign-in links, sell or transfer your account without our written consent, or let someone who has been suspended or terminated use your account to get back on the platform.

3.4.2. You may not register an account if you are under the age of majority in your province or country, or if we have previously terminated an account you controlled for violating this AUP.

3.5. Misuse of HereAreI's brand and infrastructure #

3.5.1. You may not present yourself as HereAreI, claim to be ICANN-accredited (we are not; we are a reseller of an accredited registrar), display the ICANN logo, or use our name, logo or subdomains to suggest an endorsement we have not given.

3.5.2. You may not use the free-plan subdomain (yourname.herearei.com) to redirect visitors to content that would violate this AUP if hosted here, or as a URL shortener, link farm, or cloaking layer.

4. Rules for hosted websites #

4.1. Every site you publish must be one you own or are authorized to operate, and must have a clear, lawful purpose. Empty placeholder sites, "parked" sites, doorway pages and pages that exist only to manipulate search engines may be removed from free plans after notice.

4.2. You may upload your own HTML, CSS and JavaScript, but no server-side code (such as PHP). You may only embed third-party scripts, iframes and widgets that you are permitted to use and that do not themselves violate this AUP. You are responsible for what those third parties load into your visitors' browsers.

4.3. Forms and comment features: you are responsible for how you use submitted data. Forms that ask for passwords, full payment-card numbers, government identification numbers, banking credentials, or health or financial information are not permitted unless you have told us in advance and we have confirmed in writing that the use is acceptable. Our form feature is not designed to hold that kind of data. The contact form is included in every plan, including the Free Plan; each message a visitor sends is emailed to you from our own address (with the visitor's address as the reply-to, where they gave a usable one) and kept in your dashboard, so every message you receive uses our shared sending reputation. You must not use the contact form to send bulk or unsolicited mail, to relay mail to anyone other than yourself, or to sign anyone up to a mailing list; form submissions are rate-limited per visitor and per site, and we may reduce or withdraw the feature for a site that generates spam complaints.

4.4. You may run lawful advertising on your site. You may not run deceptive ads, auto-redirecting ads, pop-unders, malvertising, or ad networks known to distribute malware, and you may not participate in click fraud or traffic-inflation schemes.

4.5. Automatic scanning: we check published sites for phishing patterns and check their web addresses against Google Safe Browsing's list of known phishing and malware sites. We do not read your private content for any other purpose except as described in the Privacy Policy.

4.6. Visitor privacy: if your site collects personal information from visitors (forms, analytics, cookies), you must comply with PIPEDA, Quebec's Law 25 where it applies, GDPR/UK GDPR for European visitors, and any other applicable privacy law, and you must publish your own privacy notice. HereAreI's Privacy Policy covers only what HereAreI collects.

4.7. Inactive free-plan sites: if a free-plan site has not been edited, and its owner has not signed in, for 6 months, the owner receives a warning email, and another at 11 months; after 12 months of inactivity the site may be taken offline. Nothing is deleted at that point: the site and all its files are kept for 30 days, and signing in and publishing within those 30 days restores it as it was. 30 days after the site is taken offline it may be deleted and its free subdomain released. Paid sites are never removed for inactivity while the subscription is paid.

5. Rules for domain names #

HereAreI does not register domain names during the beta. Sections 5.1 to 5.7 and 5.9 apply once domain registration is offered; section 5.8 (bring-your-own domains) applies now.

5.1. Accurate registrant information. When you register a domain through us you must provide true, current and complete contact information for the registrant and update it within 7 days of any change. Providing false registrant information, or failing to respond within 15 calendar days to an inquiry from us or the registrar about the accuracy of your information, is a material breach that can lead to suspension or cancellation of the domain (ICANN 2013 Registrar Accreditation Agreement ss. 3.7.7.1-3.7.7.2, read 2026-09-16). Because we resell domains through an ICANN-accredited registrar, the registrar's registration agreement, which you accept at checkout, also binds you.

5.2. Email verification. After you register a domain, or change the registrant's name, organization or email, ICANN rules require the registrar to verify the registrant's email address. You will receive a verification email and reminders; if the address is not verified within 15 days the domain is placed on hold and stops resolving until it is verified. This is not optional and we cannot waive it.

5.3. No cybersquatting or typosquatting. You may not register, use, or hold a domain name that:

• is identical or confusingly similar to someone else's trademark, trade name, personal name or brand, where you have no legitimate interest in it, including common misspellings and "typo" variants (for example paypa1.com, gooogle.site);
• was registered primarily to sell it to the rights holder or a competitor for more than your out-of-pocket costs, to block the rights holder from using it, to disrupt a competitor's business, or to attract visitors by confusion;
• impersonates a government body, financial institution, courier, or well-known service;
• is used for phishing, malware distribution, spam, or any other conduct prohibited by this AUP.

5.4. Dispute policies. gTLD domains (such as .com, .net, .org, .site, .online) are subject to ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP) and Uniform Rapid Suspension (URS) system; .ca domains, if we offer them, are subject to CIRA's Dispute Resolution Policy (CDRP) and the CIRA Registrant Agreement; other ccTLDs (.io, .me, .co) have their own registry policies. If a panel or court orders a domain transferred, suspended or cancelled, we and the registrar will comply, and you agree that we may lock the domain while a dispute is pending.

5.5. Canadian presence for .ca. If we offer .ca domains, to register one you must meet CIRA's Canadian Presence Requirements and select the correct category (for example Canadian citizen, permanent resident, or Canadian corporation). Choosing a category you do not qualify for is a violation of this AUP and of the CIRA Registrant Agreement, and CIRA can delete the domain after an audit.

5.6. Bulk and automated registration. You may not use our domain search or checkout to bulk-register, "taste" (register and cancel to test traffic), front-run, or warehouse domains, or to probe availability at high rates. Domain search is rate-limited.

5.7. DNS abuse. You may not point domains registered or managed through us at phishing, malware, botnet, or fast-flux infrastructure, use them for DNS tunnelling, or create DNS records that impersonate another organization's mail or web services.

5.8. Bring-your-own domains. You may connect a domain you already own on any plan, free of charge. If you connect a domain registered elsewhere, you confirm that you control it. Pointing a domain you do not control at HereAreI, or connecting a domain in order to violate this AUP, will result in the domain being detached and the account suspended. We may require verification (for example a DNS TXT record) before serving a connected domain.

5.9. Your rights as a registrant. Nothing in this AUP limits your rights under ICANN's Registrants' Benefits and Responsibilities and Registrant Educational Information, including your right to transfer your domain to another registrar (subject to the ICANN Transfer Policy as amended from time to time, including the lock that applies for a period after registration, transfer or change of registrant). We will give you the transfer authorization code and unlock the domain through your dashboard, and in any event within five calendar days of a request. We will name the sponsoring registrar for domains registered through HereAreI at checkout and on request.

6. Rules for email #

Mailboxes are not offered during the beta. Once they are offered as a paid add-on, mailboxes at your domain will be provided through our email partner (we currently intend to use Openprovider), and this section applies. By creating a mailbox you (and each person you give a mailbox to) will also agree to the email partner's terms of use and acceptable use policy presented when the mailbox is created. You will be responsible for your mailbox users, and the partner may suspend a domain without prior notice for abuse.

6.1. Mailboxes are for person-to-person business mail, not bulk mail. You may not use a HereAreI mailbox to send newsletters, marketing campaigns, cold outreach, "drip" sequences, transactional email from an application, or any other bulk or automated mail. Use a dedicated bulk-email or transactional-email service for that and connect it to your domain with its own SPF/DKIM records; we can help you add those records.

6.2. Sending limits. Each mailbox is limited to a number of outgoing messages per hour and per day, and to a maximum attachment size, set by the email partner; the limits will be shown in your dashboard. Messages beyond the limit are rejected, not queued. Repeatedly hitting the limit is treated as a bulk-mail violation.

6.3. No spam, ever. Sections 2.5 and 2.6 apply to every message. In addition you may not: send mail with forged headers or a "From" address you do not control; send to purchased, rented, scraped or harvested lists; send mail that lacks a working unsubscribe link when one is required by law; or continue to mail people who have asked you to stop.

6.4. No relaying or automation abuse. You may not connect a HereAreI mailbox to a mass-mailing tool, bot, or script that sends on your behalf at volume, or use IMAP/SMTP credentials in shared or public code.

6.5. Account security. You are responsible for choosing strong, unique passwords, for the mail sent from your mailboxes (including mail sent by an attacker who obtains your password), and for telling us promptly at support@quaal.co (with "Abuse" in the subject line) if you believe a mailbox has been compromised. A compromised mailbox that is sending spam will be suspended immediately and reinstated once the password has been reset and any malware removed.

6.6. Aliases, forwarding and catch-all. Alias, forwarding and catch-all limits depend on your plan and add-ons (see section 7). You may not use a catch-all or forwarding rule to relay mail to third parties for money or to build address lists, and you may not create aliases that impersonate another organization (for example paypal@yourdomain, support-google@yourdomain) for deceptive purposes.

6.7. Spam filtering. Inbound mail is filtered by the email partner (for example SPF, DKIM, DMARC, reputation lists and antivirus checks). Where the partner lets you set the domain-wide spam-filter level, it is set in the partner's control panel; we cannot disable filtering on your behalf and we do not deliver mail that the partner rejects as malicious.

6.8. Complaint handling. If we receive spam complaints, feedback-loop reports or blocklist notices about your domain, we may suspend sending from the domain until the cause is fixed. If you send lawful bulk mail from your domain using a third-party service, you must publish a complaints address (for example abuse@yourdomain) and respond to complaints promptly, as good practice and our email partner's rules may require.

7. Plan limits and fair use #

7.1. Plan limits. The limits below are current as of the date of this policy. They are also shown on our website and in your dashboard; if they differ, the numbers there prevail. During the beta only the Free Plan is available.

7.2. How limits are enforced. Storage limits are enforced at upload time: an upload that would exceed your quota is refused, and nothing already published is deleted. Bandwidth is measured daily; when a site exceeds its monthly allowance, visitors see a "site paused" page until the next calendar month begins (or, once paid plans are available, the plan is upgraded); nothing is deleted. We do not silently throttle or return errors, and we do not charge overage fees without your agreement.

7.3. Fair use. Even within the published numbers, our service is designed for ordinary websites — portfolios, small businesses, clubs, personal sites, small shops. It is not designed for, and you may not use it as: a content-delivery network or general file host for other sites; a backup or archive service; a video or audio streaming host; a host for very large files (uploads are capped at 5 MB per file on the Free Plan and 10 MB on Premium) or many thousands of files (a site may hold at most 2,000 files); a target for load testing; or a storage layer for an application running elsewhere. If a site consistently uses resources far beyond what a typical site on its plan uses, we will contact you to discuss a suitable plan before taking any action, except where the use is causing immediate harm to other customers.

7.4. Shared resources. Free-plan subdomains share a domain, IP addresses and reputation with other customers. Conduct on one free site that harms that shared reputation (blocklisting, browser warnings, deliverability problems) is treated as a violation even if the content itself would otherwise be tolerated.

7.5. Rate limits. Sign-ups, sign-ins, uploads, domain searches, publishes, form submissions and API calls are rate-limited. Attempting to work around a rate limit is a violation of section 3.3.3.

7.6. Downgrades and cancellation. If you downgrade or cancel, sites, mailboxes, aliases and storage above the new plan's limits will be disabled after a grace period of 14 days with warnings sent to your account email; mailbox data deleted by the email partner cannot be recovered.

8. Third-party policies that also apply #

8.1. Domains (once offered): the registrar's registration agreement, ICANN consensus policies (UDRP, URS, Transfer Policy, Expired Registration Recovery Policy, Whois Accuracy Program Specification, Registration Data Policy), and the registry agreements and policies for the domain you choose.

8.2. Email (once offered): the email partner's terms of use and acceptable use policy (section 6).

8.3. Infrastructure: the DigitalOcean Acceptable Use Policy (section 1.5).

8.4. Payments (once paid features launch): Stripe's Services Agreement and Restricted Businesses list, which limit what we can sell and what you can sell through any HereAreI-hosted checkout.

8.5. Where a third-party policy is updated, the updated version applies. We will link to the current versions from our legal pages at https://www.herearei.com/legal/.

9. Monitoring and our rights #

9.1. We do not pre-screen content and are not obliged to monitor it, but we may review any site, domain, mailbox metadata or account when we receive a report, when automated systems flag it, when a provider, court or authority requires it, or when we reasonably suspect a violation.

9.2. We may remove or disable access to any content, suspend or terminate any account, site, domain or mailbox, and refuse service to anyone, where we reasonably believe this AUP, the Terms of Service, a third-party policy in section 8, or the law has been violated, or where continued service would expose HereAreI, our customers or our providers to harm or liability. Section 11 describes how we normally do this.

9.3. We may preserve and disclose content and account information where required by law, a court order, or a lawful request from a competent authority, or where necessary to protect the rights, property or safety of HereAreI, our customers or the public, as described in the Privacy Policy.

9.4. We may report illegal activity to law enforcement, to our providers, to registries and registrars, and to anti-abuse organizations (for example Cybertip.ca, the Canadian Anti-Fraud Centre, the Canadian Centre for Cyber Security, blocklist operators and brand-protection services).

10. Reporting abuse #

10.1. Where. Send abuse reports to support@quaal.co with "Abuse" at the start of the subject line (use "Copyright notice" for copyright notices, "Legal notice" for other legal notices and "Privacy" for privacy complaints). This mailbox is monitored every business day and checked for urgent reports (phishing, malware, CSAM, imminent harm) on weekends and holidays. We do not publish a postal address.

10.2. What to include. So that we can act quickly, please include:

• the exact URL(s), domain name(s) or email address(es) involved (a screenshot alone is not enough);
• the type of abuse (phishing, malware, spam, copyright, trademark, harassment, fraud, CSAM, other);
• for spam: the full message including all headers, as an attachment or pasted as text;
• for phishing or impersonation: the brand or person being impersonated, and whether you represent them;
• for copyright: the information required by section 10.5;
• your name, organization (if any), and an email address we can reply to;
• anything else that helps us understand the problem, such as dates, times and what happened.

Reports from automated feeds (blocklists, feedback loops, brand-protection vendors, CERTs) are accepted in their native format.

10.3. Response targets. These are our operational targets, not guarantees:

10.4. What we will tell you. We will confirm receipt, tell you what we did (removed, forwarded, suspended, no action) and, where we took no action, why. We do not disclose a customer's identity or account details to a complainant unless the law requires it or the customer consents; in Canada, subscriber identity is normally obtained through a court order (a "Norwich" order), not from us directly.

10.5. Copyright notices — two processes.

10.5.1. Canada (notice and notice). Under sections 41.25-41.26 of the Copyright Act (read 2026-09-16), a rights holder may send us a notice of claimed infringement that states the claimant's name and address, identifies the work and the claimant's interest, specifies the location (URL) of the allegedly infringing material, describes the infringement, and gives the date and time. We will forward a compliant notice electronically to the site owner as soon as feasible, tell the claimant whether we did so, and keep the records that identify the site owner for six months (one year if the claimant tells us they have started proceedings). Canadian law does not require us to remove content on a notice, and we will not forward notices that contain settlement offers, demands for payment or personal information, or links to them (these are non-compliant under s. 41.25(3)). We do not charge for processing notices.

10.5.2. United States (DMCA format). HereAreI has not registered a designated agent with the US Copyright Office and does not claim the DMCA safe harbour. We nevertheless accept notices in the DMCA format at support@quaal.co (with "Copyright notice" in the subject line) and handle them voluntarily under this AUP. Such a notice must include: identification of the copyrighted work; the URL of the infringing material; your contact information; a statement that you have a good-faith belief the use is not authorized; a statement, under penalty of perjury, that the information is accurate and that you are the owner or authorized to act for the owner; and your physical or electronic signature. On a compliant notice we will normally remove or disable access to the material promptly and notify the site owner, who may send a counter-notice; if a counter-notice is received we will normally restore the material no less than 10 and no more than 14 business days later unless the claimant tells us they have filed a court action (US Copyright Office s. 512 page, read 2026-09-16). Knowingly false notices and counter-notices can make you liable for damages.

10.5.3. We do not judge the merits of copyright disputes. Under the Canadian process we forward notices and may remove content only as described in section 2.9 and in section 2.4 of the Copyright, Trademark and Abuse Policy. Under the DMCA-format process we normally remove the identified material and follow the counter-notice process. Disputes about who owns what are between the claimant and the site owner.

10.6. Trademark and domain-name complaints. For a claim that a domain registered through us infringes your trademark, you may file a UDRP or URS complaint (gTLDs) or a CDRP complaint (.ca) with an approved provider, or send us a report at support@quaal.co. We will lock a domain when a dispute is filed and will act on the panel's decision. We will not transfer or cancel a domain on a trademark complaint alone without a decision or order, except in clear cases of phishing or fraud, which we handle under section 10.3.

10.7. No retaliation, no abuse of the process. Filing false or bad-faith abuse reports, or using the abuse process to harass a site owner, is itself a violation of this AUP, and we may ignore further reports from a sender who repeatedly does so.

11. Enforcement ladder #

11.1. Our approach. We prefer to fix problems with the least disruption possible, and most issues are resolved with an email. But some violations are serious enough that we act first and explain afterwards. The steps below describe what normally happens; we may skip steps, repeat them, or combine them depending on the seriousness of the violation, whether it is a repeat, whether it is ongoing, and whether other people are being harmed.

11.2. Step 1 — Notice and request to fix. For minor or first-time issues (for example a form collecting data it should not, a fair-use concern, a missing content notice, an unclear inactive site), we email the account owner describing the problem and give a deadline, normally 3 to 7 days, to fix it. Nothing is taken offline at this step.

11.3. Step 2 — Partial suspension. If the problem is not fixed by the deadline, or the issue is more serious (for example a spam complaint, a copyright notice that is not resolved, a site causing deliverability problems), we disable the specific feature, page, mailbox or domain involved while leaving the rest of the account working, and tell you what needs to happen to restore it.

11.4. Step 3 — Account suspension. For serious, repeated, or ongoing violations, or where a partial suspension is not technically possible, we suspend the whole account: sites show a suspension page, mailboxes stop sending and receiving, and the dashboard becomes read-only. Domains remain registered in your name and continue to renew or expire on their normal schedule unless the domain itself is the subject of the violation. We tell you why, what evidence we have, and how to appeal.

11.5. Step 4 — Termination. We terminate accounts for: any violation of section 2.2 (CSAM); phishing, malware distribution, fraud or credential theft; repeated or unresolved violations after suspension; using the platform to attack others; fraudulent payment or identity; or where a provider or authority requires it. On termination we delete site content after a retention period of 30 days (during which you may request an export unless the content itself is illegal), delete mailboxes (mailbox data is then purged by the email partner), and, for domains, either transfer them to you at another registrar on request or allow them to expire, subject to the ICANN Transfer Policy and any dispute lock. Termination for a violation is not refundable; see the Terms of Service.

11.6. Repeat infringers. An account that receives three substantiated intellectual-property complaints (Canadian notices that the owner does not answer or that are followed by proceedings, DMCA notices without a valid counter-notice, or dispute-panel decisions) within any 12-month period will be terminated as a repeat infringer. We keep a record of each complaint.

11.7. Immediate action. We act without prior notice, going directly to step 2, 3 or 4, where a violation involves CSAM, phishing, malware, active fraud, attacks on our systems or others, a compromised account that is sending spam, a legal order, or a demand from a provider whose rules we must follow (DigitalOcean, our registrar, the email partner, Stripe). We will still notify you afterwards, unless the law or the request forbids it.

11.8. Referral to authorities. We report to police and other authorities where the law requires it (section 2.2), where we believe a serious crime is being committed, or where a person's safety is at risk, and we cooperate with lawful investigations. We may also share indicators (URLs, hashes, email headers) with anti-abuse organizations and our providers.

11.9. Domains and the registrar. For domain-related violations the registrar and the registry may act independently of us under their own policies, including placing a domain on hold. Where they do, we will tell you what we know and how to contact them.

11.10. Records. We keep records of abuse reports, our actions and related communications for at least three years after the relevant domain expires or the account closes, and for as long as needed for any legal proceeding.

12. Appeals #

12.1. If we have suspended, removed or terminated something and you believe we got it wrong, reply to the notice we sent, email support@quaal.co with "Appeal" in the subject line, or use the appeal form in your dashboard where it is offered, within 30 days. Tell us which decision you are appealing, why you believe it was wrong, and what you have changed, if anything.

12.2. Appeals are reviewed by a person who was not the one who made the original decision where our size allows; while HereAreI is operated by a single person, the founder will re-review the case with fresh eyes and, for content decisions under sections 2.7, 2.8 and 2.10, may seek an outside opinion. We aim to reply within 5 business days with a decision and reasons.

12.3. Possible outcomes are: the decision is reversed and service restored; the decision is upheld; or service is restored on conditions (for example removing specific content or changing how a feature is used). A suspension stays in place while an appeal is under review unless we decide the risk of harm is low.

12.4. There is no appeal from a decision under section 2.2 (CSAM), from an action we are required to take by law, a court order, a dispute-panel decision, or a provider's mandatory demand, or from a termination for fraud. Material removed on a DMCA-format notice is normally challenged with a counter-notice (section 10.5.2) rather than through this process; copyright strikes and any other copyright decision are appealed under this section, on the same 30-day deadline, as section 4.3 of the Copyright, Trademark and Abuse Policy explains.

12.5. An appeal does not stop the clock on any legal deadline (for example a counter-notice or a UDRP response), and it does not replace your right to take the matter to court under the Terms of Service.

13. Changes to this policy #

13.1. We may change this AUP as our services, our providers' rules, or the law change. Minor changes (clarifications, corrections, new examples, contact details) take effect when posted. Material changes — anything that prohibits conduct that was previously allowed, reduces a plan limit, or changes the enforcement or appeal process against your interest — will be announced by email to the account address and by a notice in the dashboard at least 30 days before they take effect, except where a change is required by law or by a provider on shorter notice.

13.2. The current version, its effective date and a summary of changes are always available at https://www.herearei.com/legal/acceptable-use/. Continuing to use HereAreI after a change takes effect means you accept it; if you do not, you may cancel as described in the Terms of Service.

13.3. This AUP is written in English. If we provide a translation, the English version governs.

14. Contact #

Email support@quaal.co for everything: abuse reports and appeals, legal notices (copyright, trademark, court orders), privacy requests, and general questions, including "is this content allowed?". Put "Abuse", "Appeal", "Copyright notice", "Legal notice", "Privacy" or "Security" in the subject line so your message reaches the right queue (for child sexual abuse material, start the subject with "URGENT CSAM"; see section 2.2.4). HereAreI is operated by QuaalCo, a sole proprietorship in British Columbia, Canada; we do not publish a postal address, so if you need to send us something on paper, email us first.