Skip to content
LandlordsLog in

Privacy Policy

Last updated: 10 October 2026

Shace AB ("Shace", "we", "us", "our") values your privacy and processes your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish legislation.

This privacy policy describes how we collect, use, store, and protect personal data when you use Shace: an office matchmaking service where tenants describe the office they are looking for and Shace finds, presents, and connects them with matching offices and landlords.

1. Data controller and contact details

Shace AB

Shace AB is the data controller for the processing of personal data described in this policy.

If you have questions about how we handle your personal data, or wish to exercise your rights under the GDPR, you are welcome to contact us at support@shace.se.

2. What data we collect

Account and profile data: name, email address, language preference, and the organisation you belong to on Shace. If you contact us through a form, for example as a landlord, a phone number may also be collected if you provide it.

Office requests: when you submit an office request we collect your name, email address, phone number if you provide one, your company's organisation number, a short description of the company if you provide one, and your requirements, such as location, size, budget, and move-in date. Based on the organisation number, we retrieve company information (such as the registered company name) from public registers, for example Bolagsverket.

Landlord and listing data: information landlords provide about themselves and their premises, such as listing content, images, and contact details. For offices marketed publicly outside Shace, we collect listing information and contact details of the landlord or its agent from publicly available sources, in order to match office requests and inform them about tenant interest (see section 4).

Communication: messages you send through the built-in chat, viewing bookings, email correspondence with Shace, and support requests.

Contract data: lease agreements uploaded to the service may contain personal data such as names, contact details, and signatures. When an agreement is signed electronically, we and our e-signing provider process the data needed to complete and evidence the signature.

Billing data: contact and invoicing details for landlords, used for invoicing Shace's matching fee.

Technical data: IP address, browser and device information, and information about how you use the service. If you come to Shace through one of our ads or campaign links, we also note which campaign it was. Where available, we also note which website linked you to us. See our cookie policy for how cookies are used.

3. How we use your data

We process personal data to:

  • Provide and administer the service: create and manage accounts and organisations, and operate the platform.
  • Match office requests with offices: analyse your office request and match it against available offices, and present the matches to you. Matching is AI-assisted (see section 5).
  • Contact landlords: inform landlords, or their agents, that a tenant is interested in their premises, and offer them to join Shace. At the first contact, the landlord receives limited information about the tenant, plus your phone number if you gave one; full contact details are shared once the landlord has accepted and the dialogue continues on Shace. Some landlords instead receive expressions of interest by email, in which case your contact details are shared with them already at the first contact, see section 7.
  • Enable contact between tenant and landlord: provide chat and viewing booking between the parties.
  • Handle contracts: process uploaded lease agreements, extract and summarise key terms (AI-assisted, see section 5), and facilitate electronic signing.
  • Invoice landlords: administer Shace's matching fee.
  • Communicate with you: send service emails and notifications, for example about matches, messages, viewings, and contracts, and provide support.
  • Develop and improve the service: analyse usage, detect errors, and improve features. Analytics cookies are only used with your consent. Without that consent we still collect anonymous visit statistics without cookies, based on our legitimate interest in understanding how the service is used: PostHog derives a temporary identifier from your IP address and browser that changes every day, and no identifier is stored on your device (see our cookie policy). We also log certain events server-side when you use the service, for example when a listing is published, based on our legitimate interest in understanding and improving the service; this logging uses no cookies.
  • Marketing: send newsletters or similar only with your consent.
  • Measure our advertising: see which campaigns lead to office requests. We note which campaign a request came from (the campaign name in the link you followed) and, where available, which website linked you to us and which page you arrived on, and log the request in PostHog without your contact details, based on our legitimate interest in understanding which channels work; this uses no cookies. If you allow analytics cookies, we also link the request to your analytics history in PostHog, so that we can see what led to it. With your consent to marketing cookies, we also measure our ads together with Meta, Google, and OpenAI (see section 7).
  • Review content and prevent abuse: review listings, chat messages, and other content in the service to detect fraud, spam, and attempts to circumvent our terms. The review is partly AI-assisted (see section 5); decisions on measures, such as suspension, are always made by a person.
  • Security and legal obligations: prevent fraud and abuse, and fulfil legal requirements such as accounting legislation.

4. Data from sources other than you

In addition to the data you provide, we collect personal data from:

  • Public registers: company information from, for example, Bolagsverket, based on the organisation number you provide.
  • Publicly available sources: contact details of landlords and their agents from public listing channels and websites (see below).
  • Other users: for example when a landlord uploads a lease agreement that contains information about the tenant's representatives, or when a counterparty mentions you in the chat.

How we process data from public sources. To match office requests against the full publicly available supply, we continuously collect information about office premises marketed in public listing channels and on websites. This information may contain personal data in the form of the name, email address, and phone number of the landlord's contact person or agent, as stated in the public listing. The data is used to match office requests against the premises and to contact the landlord or its agent when a tenant is interested, with an offer to join Shace. It is not shared with any recipients other than the service providers listed in section 7 and is never used for marketing otherwise. This processing is based on our and the tenants' legitimate interest in presenting and establishing contact about premises the landlord is actively marketing. In the first message to a landlord, we state where the data comes from and refer to this policy. The data is deleted or anonymised when it is no longer needed for these purposes. You can object to this processing at any time by contacting support@shace.se; we will then end the contact and remove your contact details, unless we have a legal obligation to retain them.

5. AI-assisted processing

Parts of the service are AI-assisted. This is how we use AI, and what is sent to each provider:

  • Matching and presenting offices: the data in your office request (such as location, size, budget, and move-in date) and information about available offices (text as well as listing images and floor plans) are processed by Google (Vertex AI) to produce, rank, and present matches.
  • Extracting contract terms: when a lease agreement is uploaded to the service, the document is sent to Google (Vertex AI) to extract and summarise key terms, such as rent and contract length. The whole document is processed, and it may contain more data than what is extracted, such as names and contact details.
  • Translation: listing texts are translated by OpenAI.
  • Chat review: chat messages may be reviewed with AI assistance by OpenAI to detect spam, fraud, and attempts to circumvent our terms.

Our AI providers, Google and OpenAI, process the data on our behalf as data processors, under data processing agreements. They may not use the data for their own purposes, including training their models, and they store the data only temporarily to the extent required to deliver the service to us. The processing may involve transfers outside the EU/EEA, see section 8.

The matching constitutes profiling within the meaning of the GDPR: the data in your office request is used to produce suggestions for offices that may suit you. The logic is that the criteria in your request, such as location, size, and budget, are compared with the corresponding data about available offices. The result consists of suggestions that you decide on yourself.

Decisions that matter to you, such as whether a landlord accepts a match, what measures are taken after a review, or which agreement is signed, are always made by people. We do not make decisions based solely on automated processing that have legal or similarly significant effects for you. You can always object to AI-assisted processing based on legitimate interest, or ask for a person to review a result, by contacting support@shace.se.

6. Legal bases

We process personal data on the following legal bases under the GDPR:

  • Contract: to provide the service to you, for example handling your account, your office request, matching, chat, viewings, and contract signing.
  • Legitimate interest: for example to contact landlords about tenant interest, share relevant information between tenant and landlord as part of a match, improve the service, and prevent abuse. We always balance our interest against your rights before such processing.
  • Consent: for example for analytics cookies, marketing cookies, and newsletters. You can withdraw your consent at any time.
  • Legal obligation: for example accounting legislation.

7. Who we share data with

Between tenants and landlords: sharing data between the parties is the core of the service. When you as a tenant mark interest in an office, data is shared in steps:

  • At the first contact, the landlord only learns that a company is looking for an office in the area in question, and the approximate desired size. No names, email addresses, or budget information are shared at this stage (the exceptions for your phone number and for landlords that receive expressions of interest by email are described below).
  • Once the landlord has accepted, the landlord sees your company's name and organisation number and the requirements in your request, such as team size, desired size, budget, move-in date, and contract length, and the parties can communicate through the chat in the service.
  • Contact details of individuals, such as your name and email address as a representative, are shared through the continued dialogue and contract process in the service.
  • Your phone number, if you entered one in your request, is an exception: it can be shared from the first contact with a landlord whose office you have shown interest in, so the landlord can call you directly.
  • Landlords that receive expressions of interest by email handle them in their own leasing organisation instead of in Shace. When you mark interest in an office of such a landlord, Shace immediately sends an email to the landlord's leasing addresses. The email contains your name, your email address and your phone number if you gave one, your company's name and organisation number, a short description of the company if you provided one, the requirements in your request (such as area, office type, size or team size, budget, move-in date, contract length, desired amenities, and your own description of your needs), and which of the landlord's premises the interest concerns. The data is shared so the landlord can contact you directly; the continued dialogue then takes place outside Shace.

Landlords correspondingly share listing and contact information with tenants.

Service providers (data processors): we use carefully selected providers for hosting and infrastructure, database and file storage, email delivery, electronic signing (Scrive), AI processing (see section 5), and product analytics (PostHog, EU-hosted). They process data on our behalf and under our instructions.

Advertising partners (only with your consent): if you consent to marketing cookies, we share data with Meta (Facebook and Instagram), Google (Google Ads), and OpenAI (ads in ChatGPT) to measure how our ads perform. They receive information about your visit, such as pages viewed, the id of the ad you clicked, your IP address, and browser information, and whether you started or submitted an office request. When you submit a request, your email address is also shared in hashed form, so that the request can be matched to the ad. These companies process the data under their own privacy policies. Without your consent, nothing is shared with them for this purpose, and you can withdraw your consent at any time through "Cookie settings" in the footer.

Authorities: only when we are legally obliged to disclose information.

We never sell personal data.

Shace and the landlord are each data controllers for their own processing. Shace is the data controller for the processing in the service, including up to the point where data is shared with a landlord. When Shace shares a tenant's personal data with a landlord, the landlord becomes the data controller for its subsequent processing of that data, for example in its own customer dialogue and contract handling.

8. Transfers outside the EU/EEA

Our primary processing and storage of personal data takes place within the EU/EEA. Some of our providers are, however, companies in third countries, primarily the United States, or may process data outside the EU/EEA. This includes our AI providers Google and OpenAI (see section 5) and, if you consent to marketing cookies, our advertising partners Meta, Google, and OpenAI (see section 7).

When personal data is transferred to a country outside the EU/EEA, this only occurs if:

  • the European Commission has determined that the country or the receiving organisation has an adequate level of protection, for example under the EU-U.S. Data Privacy Framework, or
  • we use the EU's standard contractual clauses (SCCs), where needed supplemented with additional safeguards such as encryption and access restrictions.

Contact us at support@shace.se if you want to know more about which providers process data outside the EU/EEA and which safeguards are used.

9. Retention

We store personal data only as long as necessary for the purposes described in this policy, or as long as required by law:

  • Account data is stored while your account is active. You can request deletion of your account and the personal data connected to it at any time by contacting us at support@shace.se.
  • Office requests and matches are deleted or anonymised once the request has ended, that is, when it has led to an agreement or is no longer active, and the data is no longer needed to follow up on it or handle a legal claim.
  • Chat messages and viewings are deleted once the parties' dialogue has ended and they no longer need to be kept due to an ongoing agreement or a legal claim.
  • Contact details from public sources (see section 4) are deleted if the landlord does not join Shace and the contact has ended.
  • Signed lease agreements are kept as long as needed to evidence the agreement and handle legal claims, taking applicable limitation periods into account.
  • Invoices and accounting records are kept for seven (7) years under the Swedish Accounting Act.

When data is no longer needed, we delete or anonymise it. Some data may need to be kept even after an account has been deleted, for example accounting records, signed agreements, and data needed to handle a legal claim.

10. Security

We use appropriate technical and organisational security measures, including encryption and access controls, to protect personal data against unauthorised access, loss, or alteration. Only authorised Shace staff have access to personal data, to the extent required to perform their work.

11. Your rights

Under the GDPR you have the right to:

  • Access: receive confirmation of whether we process personal data about you, and a copy of that data.
  • Rectification: have incorrect or incomplete data corrected.
  • Erasure ("right to be forgotten"): have your personal data deleted when it is no longer needed or the processing lacks legal basis.
  • Restriction: have the processing of your data temporarily restricted.
  • Data portability: receive data you have provided in a structured, machine-readable format.
  • Objection: object to processing based on legitimate interest.
  • Withdraw consent: withdraw any consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, contact us at support@shace.se.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY, www.imy.se) if you believe your data is being processed incorrectly.

12. Cookies

We use cookies and similar technologies to make the service work and, with your consent, to analyse how it is used and to measure our advertising. Read more in our cookie policy.

13. Changes to this policy

We may update this privacy policy, for example when laws or our services change. The latest version is always available at shace.se. For significant changes, we notify users by email or in the service.

We accept no responsibility for typographical errors. If anything in this policy seems unclear or incorrect, contact us and we will clarify and correct it where needed.

14. Contact

If you have questions about this privacy policy or our processing of your personal data:

Shace AB