Program policies

Effective 14 September 2026 · version 2 · applies to every address on uae.co and the other domains we host

How UAE.com Email may be used, what its limits are, how names are sold and booked, what happens with payments, how accounts are protected, and what we do when a rule is broken - in plain words, with the real figures.

1. Purpose and scope

These policies apply to every account on the domains we host and to every way of using it - the web app, the mail programs that connect over IMAP, SMTP and POP3, the calendar, contacts and Drive protocols, and the services an organisation or a partner uses to sell and manage addresses through us. They are part of the Terms & conditions: they say in detail what the terms say in short, and where the two differ the terms decide. An organisation that manages addresses on its own domain may add rules of its own for those addresses; it may not relax these.

2. Acceptable use

Use the service for your own lawful correspondence and work. You may not:

• Send unsolicited bulk mail. No spam, no mail-bombing, no sending to lists whose members did not ask for your mail. A message to many people is fine when each of them agreed to receive it and can tell you to stop.
• Harvest addresses. No collecting addresses from web pages, directories or other people's mail for sending, and no selling or passing on lists gathered that way.
• Impersonate anyone. No pretending to be another person or organisation - in the sender name, the address, the message or a sign-in page - and no phishing or fraud.
• Spread malware. No sending, storing or sharing of anything meant to damage, take over or spy on a computer or an account. Every message is scanned at the door by the platform and checked against outside threat-intelligence services - an attachment by its fingerprint, a file nobody has seen before by the file itself, a link by its address - before the mail servers accept it; a message carrying malware, a known-bad attachment or a link to a known malicious site is refused at the door.
• Keep illegal material. Nothing that is illegal in the United Arab Emirates or where you are, and nothing that infringes another person's rights.
• Abuse others or the platform. No harassment, threats or fraud against anyone; no probing or attacking the platform or other users, no getting round the limits below, no use of an account that is not yours.
• Automate what a person would do. A mail program signed in with an app password is yours to use as a person does; sending or polling at a machine's pace against the limits below is not. Keys and tokens issued to an organisation or a partner are that organisation's, are used only for what they were issued for, are kept secret, and are rotated the moment they may have leaked; a key or a password found in the open is revoked.

3. Sending and receiving limits

The limits protect the reputation of the domains, so that mail from every address on them keeps arriving. The figures that apply today:

• Recipients per day: up to 500 recipients a day from one address, across every message it sends - a message to five people counts five. Your plan may list a figure of its own; until the platform enforces limits per plan, the platform-wide figure is the one that applies.
• Repeated mail to one address: the mail servers accept up to 25 messages an hour from all the senders of one domain together to the same recipient. A message over that is refused with a temporary code and marked Not delivered in Sent, with the reason; it is not queued for later.
• Bursts: sixty messages in ten minutes from one address, or three hundred from one region, raise an alert to our operators, who look at the sender and may suspend the mailbox and reset its password when it looks taken over.
• Message size: a message with its attachments may be as large as the mail servers allow; the app reads that figure when you sign in (25 MB when the servers announce none) and, for a bigger file, sends a Drive link instead of the file.
• Storage: your mailbox and your Drive hold what your plan allows; the storage line in the app shows the figures and how much you use, and the yearly plan has no storage limit. A Drive upload that would take you past the limit is refused, with the reason; a mailbox at 90 % of its limit or above is flagged to our operators by the nightly storage report. Free space by emptying Trash and Spam, or by deleting large attachments.
• Trash and Spam: messages that have been in Trash or Spam for more than 30 days are deleted automatically.
• Receiving: every incoming message is scanned for malware at the door by the platform, its attachments and links checked against outside threat-intelligence services, and its sender checked against the platform's and your organisation's blocked-sender lists before the mail servers accept it. A blocked sender is refused with a plain reply, so the sender learns, or - where the organisation chose so - accepted and discarded.
• Aliases and app passwords: as many as your plan allows, shown in the app.

4. Names, addresses and bookings

• The form of a name: 1 to 64 characters - the letters a to z, digits, dots, underscores and hyphens - starting and ending with a letter or a digit, never two dots in a row. Capital letters and accented forms are folded to the plain lower-case name before any rule is applied.
• Reserved names - countries, cities, brands, public figures, royal names, landmarks and the role addresses (postmaster, abuse and the like) - are never sold openly. The single letters and digits, a to z and 0 to 9, are held for auction: never sold and never reserved on request.
• Restricted names are banned words: never released to anyone, in any organisation, with no override, and a search does not say which word matched.
• Every name is sold on approval, premium names included: you ask for it, the platform sets its value - per name, when it approves - and the offer reaches you by mail: the value, the yearly plan, the booking fee and the link to pay. No search, no answer and no listing names a price before then, and there is no price list by class. Premium names are shown with a tier - one and two characters, three characters and royal names, the premium words, the patterned names, cities and dictionary words - as a signal of how rare a name is, not as a price: a premium name is sold like any other, on approval, at the value set for it. The single letters and digits stay held for auction, above, whatever their tier.
• A search is not a reservation. A name shown as available can be taken by anyone until a booking fee is paid or a purchase completed.
• The booking fee is 10 % of the value of the name - never less than AED 500, never more than the value itself, with no maximum unless the seller sets one - on the value alone, never on the plan. It is not refundable, and it is deducted from the purchase.
• The hold: from the moment the fee is paid the name is held for 72 hours and shows as reserved to everyone else. Within that time you receive the link to pay the balance (the value minus the fee). The mailbox is created when the balance is paid; nothing is created on the fee alone.
• The yearly plan comes with every name sold on approval: AED 500 a year, or AED 50 a month for ten months of each plan year (two months free). It starts three months after the purchase, through the payment provider; the mail we send seven days before the start carries the choice between the two prices. A plan not chosen by its start date puts the account into grace, then suspension, as under Payments below.
• A booking that lapses: a booking not paid in full within its 72 hours runs out. The name is free again at once - to anyone, the same buyer by a new request included - the fee is kept, and you receive a mail saying so.
• Cool-offs: a name whose account was deleted enters a 90-day cool-off before it can be sold again; a name refunded within 14 days of its first payment is held for 30 days.

5. Payments, renewals and refunds

• Paying: payments are taken by the payment provider on its own pages, and card details never reach us (see Privacy & data protection). Prices are shown in UAE dirhams; the price at checkout is the price you pay. Every payment brings a receipt by email with a reference - quote it when you write to us about a payment.
• Renewals: a plan renews automatically at the end of each period - monthly, quarterly or yearly, as the plan says - at the price in force, until you cancel. We send a reminder seven days before a renewal.
• A failed renewal: you keep signing in and receiving mail during the plan's grace period (seven days on the standard packages) while the provider retries and the app shows a link to put the payment right; any successful payment restores the plan.
• Suspension: when the grace period ends unpaid, the account is suspended - sign-in is blocked on every protocol, mail is still received and kept, nothing is deleted. After 30 days a suspended account is closed and its name enters the 90-day cool-off; where the organisation offers a free package the account fits, it is moved there instead.
• Cancelling: you can cancel at any time in the app. The current period runs to its end, then the grace and suspension steps above follow; no part of a period already started is refunded.
• The booking fee is never refunded: it is deducted from the purchase, or kept when the booking runs out.
• Refunded in full, automatically: any payment we cannot honour - a name that turned out to be taken, a mailbox we could not create, a payment arriving after a booking had run out for a name no longer free - goes back to the payment method used.
• Other refunds: address purchases and plan payments are otherwise not refundable once the mailbox has been created, except where the law requires it. A full refund within 14 days of the first payment ends the service on that address - the account is suspended and its name held for 30 days; a disputed payment puts the account into grace until the dispute is settled, and a dispute lost is treated as a full refund.

6. Security

• Your password is never stored in clear. A new password is at least 12 characters. Changing it ends every session of the account, on every device: a web session is valid only under the password it was opened with, so a browser or a phone app signed in before the change is refused at its next request and has to sign in again with the new password, and a mail program signed in with the account password asks for the new one at its next connection. A mail program on an app password is not affected by the change - revoke the app password in the Security panel to cut it off. We never ask for your password by email or phone.
• Two-step sign-in with a 6-digit code from an authenticator app is switched on in the app's Security panel. An organisation may require it for every account on its domain; the app then asks for a second step at sign-in until one is set up.
• Passkeys: a passkey can be registered in the Security panel and used to sign in from the sign-in screen, instead of the password.
• Mail programs sign in with an app password made in the Security panel - one per program, each removable on its own - never with your account password; the number your plan allows is shown there, with the servers to enter.
• Recovery: the recovery options you set (see Privacy & data protection) are the only way to reset a lost password yourself; keep them current.
• In transit and at rest: mail travels encrypted between you and the platform and, wherever the other side allows it, to other providers; mail, files and backups are stored encrypted.
• A compromise: outgoing mail is watched around the clock, so a mailbox that starts sending spam is noticed within ten minutes; our operators may suspend it and reset its password to stop the damage, then tell the address holder how to get it back. If you think someone else has used your account, change your password at once - that ends every session opened with the old one, theirs included, as under Your password above - revoke any app password you do not recognise (the program using it can no longer sign in), check your recovery options and aliases, and write to technical@uae.co; we acknowledge within one working day.

7. Privacy and data

What we keep, why, and who can see it is in Privacy & data protection. The points that bear on these policies:

• We do not read your mail, sell data or show advertising. Support opens a mailbox only when you ask for help with it, and every such access is recorded.
• Retention: items you delete leave Trash after 30 days and backups within 35 days. A closed account's mailbox and files are kept for 30 days in case it was a mistake, then erased; receipts and the record of a purchase are kept for as long as the law requires.
• Export: you can take everything with you at any time - Download your data on the account's Data page builds the files on your device, and the standard protocols (IMAP, CalDAV, CardDAV) work with any program.
• Deletion: there is no delete button in the app, so that no account is lost by a slip. To close yours, ask your organisation's administrator - the account's Data page names the address to write to, the postmaster of your domain - or write to us at technical@uae.co; an organisation's administrator closes the accounts it manages from the console. Closing removes mail, contacts, calendar, tasks and the Drive for good once the 30 days above have passed.
• Legal hold: an account placed under legal hold on a lawful request is not deleted - not on your request, not by an administrator and not by the platform's own clean-up - until the hold is lifted; its mail and files are preserved as they are.
• Organisations: an address on an organisation's domain is managed by that organisation's administrators, who can suspend it, reset its password, require two-step sign-in and block senders for it.

8. Enforcement

When a rule is broken we act in proportion, and we say what we did and why, except where the law forbids it. The steps, in the order we normally take them:

• A warning by email, naming the rule and what to change.
• Refusal at the door: a sender's mail refused with a plain reply, so the sender learns, or discarded, through the blocked-sender lists; a message over a limit refused with a temporary code and marked Not delivered.
• Suspension: sign-in blocked on every protocol, mail still received and kept, nothing deleted. A mailbox that is sending spam or looks taken over may be suspended first and asked about afterwards, with its password reset.
• Closure: for a serious or repeated breach, or for unlawful activity. The mailbox and files are kept for 30 days as after any closure, the name enters the 90-day cool-off, and no part of a period already started is refunded. Unlawful activity is reported to the authorities.

What we never do: we never read your mail to look for breaches - we act on reports, on delivery reports and on the mail servers' own signals; we never alter or delete your mail as a penalty; and we never suspend or close an account without telling the address holder, or the organisation's administrator, what was found, except where the law forbids it.

To appeal, write to technical@uae.co from the address concerned or from its recovery email, naming the address and the date of the notice you received. A person reads every appeal, and a suspension found to be a mistake is lifted at once.

9. Reporting abuse

To report spam, phishing, impersonation, malware or another breach coming from, or aimed at, an address we host, write to technical@uae.co with Abuse in the subject. Include:

• the message itself - in the app, Forward as attachment sends it whole, or Show original gives its full headers to copy;
• the date and time, the addresses involved, and what happened;
• for a security matter, what you saw and when.

We acknowledge within one working day. A message that reached you from another provider is that provider's to act on as well; Report spam and Report phishing in the app keep such mail out of your inbox. For anything about a purchase or a booking, write to support@uae.com and quote the reference printed in the mail you received.

10. Changes to these policies

When this page changes in a way that matters, we say so in the app before it applies. The version and date at the top tell you which edition you are reading; an earlier edition can be asked for at the address below.

11. Contact

Questions about these policies, security concerns and appeals: technical@uae.co. Purchases and bookings: support@uae.com, with your reference. UAE law applies, as the terms say.

Related: Terms & conditions · Privacy & data protection