Skip to content
LandlordsLog in

Privacy Policy

Last updated: 18 August 2026

Shace AB ("Shace", "we", "us", "our") values your privacy and processes your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish legislation.

This privacy policy describes how we collect, use, store, and protect personal data when you use Shace: an office matchmaking service where tenants describe the office they are looking for and Shace finds, presents, and connects them with matching offices and landlords.

1. Data controller and contact details

Shace AB

Shace AB is the data controller for the processing of personal data described in this policy.

If you have questions about how we handle your personal data, or wish to exercise your rights under the GDPR, you are welcome to contact us at [email protected].

2. What data we collect

Account and profile data: name, email address, language preference, and the organisation you belong to on Shace. If you contact us through a form, for example as a landlord, a phone number may also be collected if you provide it.

Office requests: when you submit an office request we collect your name, email address, your company's organisation number, and your requirements, such as location, size, budget, and move-in date. Based on the organisation number, we retrieve company information (such as the registered company name) from public registers, for example Bolagsverket.

Landlord and listing data: information landlords provide about themselves and their premises, such as listing content, images, and contact details. For offices marketed publicly outside Shace, we collect listing information and contact details of the landlord or its agent from publicly available sources, in order to match office requests and inform them about tenant interest (see section 4).

Communication: messages you send through the built-in chat, viewing bookings, email correspondence with Shace, and support requests.

Contract data: lease agreements uploaded to the service may contain personal data such as names, contact details, and signatures. When an agreement is signed electronically, we and our e-signing provider process the data needed to complete and evidence the signature.

Billing data: contact and invoicing details for landlords, used for invoicing Shace's mediation fee.

Technical data: IP address, browser and device information, and information about how you use the service. See our cookie policy for how cookies are used.

3. How we use your data

We process personal data to:

  • Provide and administer the service: create and manage accounts and organisations, and operate the platform.
  • Match office requests with offices: analyse your office request and match it against available offices, and present the matches to you. Matching is AI-assisted (see section 5).
  • Contact landlords: inform landlords, or their agents, that a tenant is interested in their premises, and offer them to join Shace. At the first contact, the landlord receives limited information about the tenant; full contact details are shared once the landlord has accepted and the dialogue continues on Shace.
  • Enable contact between tenant and landlord: provide chat and viewing booking between the parties.
  • Handle contracts: process uploaded lease agreements, extract and summarise key terms (AI-assisted, see section 5), and facilitate electronic signing.
  • Invoice landlords: administer Shace's mediation fee.
  • Communicate with you: send service emails and notifications, for example about matches, messages, viewings, and contracts, and provide support.
  • Develop and improve the service: analyse usage, detect errors, and improve features. Analytics cookies are only used with your consent. We also log certain events server-side when you use the service, for example when a listing is published, based on our legitimate interest in understanding and improving the service; this logging uses no cookies.
  • Marketing: send newsletters or similar only with your consent.
  • Review content and prevent abuse: review listings, chat messages, and other content in the service to detect fraud, spam, and attempts to circumvent our terms. The review is partly AI-assisted (see section 5); decisions on measures, such as suspension, are always made by a person.
  • Security and legal obligations: prevent fraud and abuse, and fulfil legal requirements such as accounting legislation.

4. Data from sources other than you

In addition to the data you provide, we collect personal data from:

  • Public registers: company information from, for example, Bolagsverket, based on the organisation number you provide.
  • Publicly available sources: contact details of landlords and their agents from public listing channels and websites (see below).
  • Other users: for example when a landlord uploads a lease agreement that contains information about the tenant's representatives, or when a counterparty mentions you in the chat.

How we process data from public sources. To match office requests against the full publicly available supply, we continuously collect information about office premises marketed in public listing channels and on websites. This information may contain personal data in the form of the name, email address, and phone number of the landlord's contact person or agent, as stated in the public listing. The data is used to match office requests against the premises and to contact the landlord or its agent when a tenant is interested, with an offer to join Shace. It is not shared with any recipients other than the service providers listed in section 7 and is never used for marketing otherwise. This processing is based on our and the tenants' legitimate interest in presenting and establishing contact about premises the landlord is actively marketing. In the first message to a landlord, we state where the data comes from and refer to this policy. The data is deleted or anonymised when it is no longer needed for these purposes. You can object to this processing at any time by contacting [email protected]; we will then end the contact and remove your contact details, unless we have a legal obligation to retain them.

5. AI-assisted processing

Parts of the service are AI-assisted. This is how we use AI, and what is sent to each provider:

  • Matching and presenting offices: the data in your office request (such as location, size, budget, and move-in date) and information about available offices (text as well as listing images and floor plans) are processed by Google (Vertex AI) to produce, rank, and present matches.
  • Extracting contract terms: when a lease agreement is uploaded to the service, the document is sent to Google (Vertex AI) to extract and summarise key terms, such as rent and contract length. The whole document is processed, and it may contain more data than what is extracted, such as names and contact details.
  • Translation: listing texts are translated by OpenAI.
  • Chat review: chat messages may be reviewed with AI assistance by OpenAI to detect spam, fraud, and attempts to circumvent our terms.

Our AI providers, Google and OpenAI, process the data on our behalf as data processors, under data processing agreements. They may not use the data for their own purposes, including training their models, and they store the data only temporarily to the extent required to deliver the service to us. The processing may involve transfers outside the EU/EEA, see section 8.

The matching constitutes profiling within the meaning of the GDPR: the data in your office request is used to produce suggestions for offices that may suit you. The logic is that the criteria in your request, such as location, size, and budget, are compared with the corresponding data about available offices. The result consists of suggestions that you decide on yourself.

Decisions that matter to you, such as whether a landlord accepts an introduction, what measures are taken after a review, or which agreement is signed, are always made by people. We do not make decisions based solely on automated processing that have legal or similarly significant effects for you. You can always object to AI-assisted processing based on legitimate interest, or ask for a person to review a result, by contacting [email protected].

6. Legal bases

We process personal data on the following legal bases under the GDPR:

  • Contract: to provide the service to you, for example handling your account, your office request, matching, chat, viewings, and contract signing.
  • Legitimate interest: for example to contact landlords about tenant interest, share relevant information between tenant and landlord as part of an introduction, improve the service, and prevent abuse. We always balance our interest against your rights before such processing.
  • Consent: for example for analytics cookies and marketing. You can withdraw your consent at any time.
  • Legal obligation: for example accounting legislation.

7. Who we share data with

Between tenants and landlords: sharing data between the parties is the core of the service. When you as a tenant mark interest in an office, data is shared in steps:

  • At the first contact, the landlord only learns that a company is looking for an office in the area in question, and the approximate desired size. No names, contact details, or budget information are shared at this stage.
  • Once the landlord has accepted, the landlord sees your company's name and organisation number and the requirements in your request, such as team size, desired size, budget, move-in date, and contract length, and the parties can communicate through the chat in the service.
  • Contact details of individuals, such as your name and email address as a representative, are shared through the continued dialogue and contract process in the service.

Landlords correspondingly share listing and contact information with tenants.

Service providers (data processors): we use carefully selected providers for hosting and infrastructure, database and file storage, email delivery, electronic signing (Scrive), AI processing (see section 5), and product analytics (PostHog, EU-hosted). They process data on our behalf and under our instructions.

Authorities: only when we are legally obliged to disclose information.

We never sell personal data.

Shace and the landlord are each data controllers for their own processing. Shace is the data controller for the processing in the service, including up to the point where data is shared with a landlord. When Shace shares a tenant's personal data with a landlord, the landlord becomes the data controller for its subsequent processing of that data, for example in its own customer dialogue and contract handling.

8. Transfers outside the EU/EEA

Our primary processing and storage of personal data takes place within the EU/EEA. Some of our providers are, however, companies in third countries, primarily the United States, or may process data outside the EU/EEA. This includes our AI providers Google and OpenAI (see section 5).

When personal data is transferred to a country outside the EU/EEA, this only occurs if:

  • the European Commission has determined that the country or the receiving organisation has an adequate level of protection, for example under the EU-U.S. Data Privacy Framework, or
  • we use the EU's standard contractual clauses (SCCs), where needed supplemented with additional safeguards such as encryption and access restrictions.

Contact us at [email protected] if you want to know more about which providers process data outside the EU/EEA and which safeguards are used.

9. Retention

We store personal data only as long as necessary for the purposes described in this policy, or as long as required by law:

  • Account data is stored while your account is active. You can request deletion of your account and the personal data connected to it at any time by contacting us at [email protected].
  • Office requests and matches are deleted or anonymised once the request has ended, that is, when it has led to an agreement or is no longer active, and the data is no longer needed to follow up on it or handle a legal claim.
  • Chat messages and viewings are deleted once the parties' dialogue has ended and they no longer need to be kept due to an ongoing agreement or a legal claim.
  • Contact details from public sources (see section 4) are deleted if the landlord does not join Shace and the contact has ended.
  • Signed lease agreements are kept as long as needed to evidence the agreement and handle legal claims, taking applicable limitation periods into account.
  • Invoices and accounting records are kept for seven (7) years under the Swedish Accounting Act.

When data is no longer needed, we delete or anonymise it. Some data may need to be kept even after an account has been deleted, for example accounting records, signed agreements, and data needed to handle a legal claim.

10. Security

We use appropriate technical and organisational security measures, including encryption and access controls, to protect personal data against unauthorised access, loss, or alteration. Only authorised Shace staff have access to personal data, to the extent required to perform their work.

11. Your rights

Under the GDPR you have the right to:

  • Access: receive confirmation of whether we process personal data about you, and a copy of that data.
  • Rectification: have incorrect or incomplete data corrected.
  • Erasure ("right to be forgotten"): have your personal data deleted when it is no longer needed or the processing lacks legal basis.
  • Restriction: have the processing of your data temporarily restricted.
  • Data portability: receive data you have provided in a structured, machine-readable format.
  • Objection: object to processing based on legitimate interest.
  • Withdraw consent: withdraw any consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, contact us at [email protected].

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY, www.imy.se) if you believe your data is being processed incorrectly.

12. Cookies

We use cookies and similar technologies to make the service work and, with your consent, to analyse how it is used. Read more in our cookie policy.

13. Changes to this policy

We may update this privacy policy, for example when laws or our services change. The latest version is always available at www.shace.se. For significant changes, we notify users by email or in the service.

We accept no responsibility for typographical errors. If anything in this policy seems unclear or incorrect, contact us and we will clarify and correct it where needed.

14. Contact

If you have questions about this privacy policy or our processing of your personal data:

Shace AB