Data

Lovable and the GDPR: AI training, data location and DPA

Business: Trains on your data unless you switch it off. EU hosting available · DPA on request.

Vendor: Lovable (Lovable Labs Inc.)Code and app buildersChecked on How we check

Verdict

Is Lovable GDPR compliant?

Business

Business

Trains on your data unless you switch it off

EU hosting available · DPA on request

Price: €50 / mo

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does Lovable train on your data?

Trains on your data by default?

Checked

Trains on your data unless you switch it off.

Yes: the Terms allow Lovable to use customer data to train its AI models unless the customer asks it not to, on any plan. The DPA bars training on personal data inside customer data.

Vendor's wording: “We may use your Customer Data to develop and train artificial intelligence and machine learning models. You may tell us at any time that you do not want your Customer Data used for model training”

Source: lovable.devYour Content and Data > Rights in Customer DataChecked on

Switch-off

How do you turn off AI training in Lovable?

How to switch training off

Checked

You can switch the training off.

Tell Lovable you do not want your customer data used for model training; the Terms allow this at any time. No in-product setting is described.

Vendor's wording: “We may use your Customer Data to develop and train artificial intelligence and machine learning models. You may tell us at any time that you do not want your Customer Data used for model training”

Source: lovable.devYour Content and Data > Rights in Customer DataChecked on

Location

Where does Lovable store your data?

Where data is stored by default

Checked

Region chosen per project: Lovable Cloud hosts customer data in the EU, US or Asia Pacific and does not move it across regions by default; core platform on Google Cloud in the Netherlands

Source: lovable.devSections on regional data hostingSecond source: trust.lovable.devChecked on

Contract

Does Lovable sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA on request.

Yes. Lovable's DPA (last updated 6 Nov 2025) forms part of the Terms of Service ordered under an Order Form; the contracting entity is Lovable Labs Incorporated, Boston

Source: lovable.devPreamble and definition of 'Lovable'Checked on

Processors

Who else handles Lovable data?

Sub-processors (companies that handle the data for them)

Checked

44 listed.

Public. 44 entries including 7 add-on providers; locations mixed between the EU, UK, US and global; AI from Anthropic, OpenAI, Google Vertex, Azure AI Foundry, AWS Bedrock, OpenRouter, Fireworks, Baseten, ElevenLabs and Perplexity

Source: trust.lovable.devSubprocessors list ('44 results')Checked on

EU–US Data Privacy Framework

Checked

Not listed.

No listing found for search term 'Lovable'

Source: dataprivacyframework.govSearch 'Lovable' returned 'Query returned no results'Checked on

Security

Which certifications and admin controls does Lovable have?

Security certifications

Checked

SOC 2 Type II, SOC 2 Type I (2026) and ISO 27001:2022

Source: trust.lovable.devCompliance section and documentsChecked on

Admin controls for AI

Checked

Partly. Business adds a team workspace, role-based access, SSO, internal publishing, a security center and per-member credit limits; no switch to turn AI off is described

Source: lovable.devPlan card 'Business' and FAQ on credit limitsSecond source: lovable.devChecked on

Price

What does Lovable cost?

Price, as shown in Germany

Checked

€50 / mo.

EUR 50 per month (monthly billing) for the workspace, with 100 credits and unlimited users; yearly billing gives 2 months free; VAT basis not stated

Source: lovable.devPlan card 'Business' with Monthly toggleChecked on

The vendor doesn't say: retention.

Alternatives

Lovable alternatives that don't train on your data

Other code and app builders tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • Amazon Q Developer

    Pro tier · $19 / user / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓?✓

  • GitHub Copilot

    Business · $19 / user / mo

    Doesn't train on your dataEU hosting not documented · DPA in the terms

    ✓?✓✓✓

  • JetBrains AI Pro

    organisation licence · See details

    Doesn't train on your dataEU hosting not documented · DPA in the terms

    ✓?✓✓✓

  • Webflow Premium

    site plan · $25 / mo

    Doesn't train on your dataEU hosting not documented · DPA on request

    ✓?✓✓✓

  • v0

    Business · $100 / user / mo

    Doesn't train on your dataEU hosting not documented · DPA on request

    ✓?✓?✓

If no plan gives you the training default or data location you need, the tool may not be the right fit. We design and build what your team is missing around your own rules, and keep it running after launch.

See what we build

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices