Vendor record · lovable.dev
What Lovable promises about your data.
Where Lovable publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
Lovable lists its sub-processors at trust.lovable.dev/subprocessors. We last read it on October 14, 2026.
- What has changed
We've recorded no change to its sub-processor list or data processing agreement between August 31, 2026 and September 15, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
When it adds a sub-processor, its clause at lovable.dev/data-processing-agreement (read October 14, 2026) gives you 20 business days to object.
- Window
- 20
- Sub-processors
- 44
- Pages
- 7
- Copies
- 50
business days to object when it adds a sub-processor
sub-processors named
pages we watch
dated copies of all its pages, since August 31, 2026
Lovable DPA
Lovable's data processing agreement gives 20 business days to object to a new sub-processor. Here is the clause, from our October 14, 2026 copy:
20
business days to object
“In the event that the Customer does not wish to consent to the use of a new Sub-processor, the Customer may notify Lovable within twenty (20) business days of Lovable notifying the Customer, that the Customer does not consent on reasonable grounds relating to the protection of Personal Data by contacting [email address on the vendor's page].”
Found automatically and not yet checked by a person. The quote is exact, and the link goes to the source. Nothing here says whether the term is good or bad, only that Lovable published it.
lovable.dev/data-processing-agreement · read 2026-10-14 · fingerprint f969da5cd19b857b…
Lovable sub-processors
Lovable publishes a sub-processor list at trust.lovable.dev/subprocessors; we last read it on October 14, 2026. It names 44 entries. The first 15, as the list prints them: Altinity; Amazon Web Services; Anthropic (Claude); Baseten; Braintrust; Browserbase; Castle.io; ClickHouse; Cloudflare; Customer.io; ElevenLabs; Entri; Firecrawl; Fireworks; GitHub; and 29 more in the full table below. The public record holds no change to the list read before September 15, 2026. A change we read after September 15, 2026 is published 30 days after we read it.
44 named · full table
Every public change we have recorded · Where vendors publish their lists
How long Lovable keeps your data
We hold no statement about data retention from Lovable's watched pages. The pages we watch: changelog lovable.dev/changelog; data processing agreement lovable.dev/data-processing-agreement; pricing page lovable.dev/pricing; privacy policy lovable.dev/privacy; sub-processor list trust.lovable.dev/subprocessors; terms of service lovable.dev/terms; trust and security page lovable.dev/security. On training with customer data, Lovable's privacy policy (lovable.dev/privacy, in the copy read September 20, 2026) says: “AI Model Training and Your Opt-Out What we use. We use Customer Content and Usage Data — which may include Personal Data — to train, develop, fine-tune, and improve our AI models and AI-powered features, including models we operate within the Services and models we may make available to customers through Lovable products such as the AI Gateway.”
Training on customer data
“We're transparent about our infrastructure and subprocessors, so you always know where your data lives and how it's handled. ## Enterprise and Business plan data is not used to train models Free and Pro plan subscribers can opt out of model training in their account settings.”
lovable.dev/security · read 2026-09-20
Training on customer data
“Lovable shall not use any Customer Personal Data for the purpose of training, retraining, fine-tuning, or otherwise developing any Artificial Intelligence (AI) or Machine Learning (ML) models.”
lovable.dev/data-processing-agreement · read 2026-10-14
Training on customer data
“Data made available to us by a messaging or collaboration platform you connect is used only to operate the integration and generate responses; we do not use it to train AI models. Device features and local processing. Some of our applications — for example, Lovable Desktop — can use your device's files, microphone, camera, or screen, only where you enable the feature.”
lovable.dev/privacy · read 2026-09-20
Training on customer data
“Data residency is region-specific and does not move across regions by default. ### Is customer data used to train AI? On Business and Enterprise plans: No. Customer prompts, code, and workspace data are not used to train Lovable models.”
lovable.dev/security · read 2026-09-20
Training on customer data
“You may tell us at any time that you do not want your Customer Data used for model training or the other business purposes described above, and we will honor that request for prospective use, free of charge and regardless of your plan.”
lovable.dev/terms · read 2026-09-20
Training on customer data
“The Customer acknowledges and agrees that Lovable may collect, use and disclose Service Data for its own business purposes, such as but not limited to: accounting, tax, billing, audit, and compliance purposes; - to provide, improve, develop, optimize and maintain the Services; to investigate fraud, spam, wrongful or unlawful use of the Services; - training or tuning proprietary machine-learning m…”
lovable.dev/data-processing-agreement · read 2026-10-14
Training on customer data
“We also produce De-identified Data from it (Section 2), which we use to improve the Services and to give you comparative insights.”
lovable.dev/privacy · read 2026-09-20
Training on customer data
“Resources - Community - Enterprise - Pricing - Security Log inGet started # Secure by design Choose where your data lives, enforce SSO and role-based access, control publishing with approvals, and keep your code and prompts out of model training. Trust center…”
lovable.dev/security · read 2026-09-20
Training on customer data
“Credits are consumed by each AI action based on the effort and resources used, regardless of the outcome, and are non-refundable and non-restorable even where the AI Output is erroneous, incomplete, or must be regenerated, except where applicable law requires otherwise. ## Your Content and Data ### Rights in Customer Data You grant us a worldwide, perpetual, royalty-free license to use, copy,…”
lovable.dev/terms · read 2026-09-20
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Sub-processors named · 44 · 6 name an AI provider we list
Altinity
Operates the production ClickHouse cluster.
EU
Amazon Web Services
Customer applications, databases, file storage and AI model inference. Services: S3, SES, Bedrock
Anthropic (Claude)AI · Anthropic
Customer prompts, generated code, AI interactions
US
BasetenAI · Baseten
AI model inference for the Lovable agent.
Global
Braintrust
LLM evaluation and tracing. Stores prompts and responses.
EU
Browserbase
Customer projects
US
Castle.io
Data analytics and fraud detection
US
ClickHouse
Analytics database. Holds platform usage data and end-user analytics from customers’ published apps.
EU
Cloudflare
Edge routing, DNS & Workers
Global
Customer.io
Customer engagement
US
ElevenLabsAI · ElevenLabs
Speech-to-text, text-to-speech, and music generation for voice and audio features
US
Entri
Custom domain connection and DNS records.
US
Firecrawl
Web crawling on customer-supplied URLs.
US
FireworksAI · Fireworks AI
AI model inference for the Lovable agent.
Global
GitHub
Code Repository
US
Google Cloud Platform
Customer applications, databases and platform infrastructure. Services: Google Kubernetes Engine, Cloud Run, Spanner, Cloud KMS, Vertex AI
EU (Netherlands, europe-west4)
Google Cloud Vertex
AI model inference (Gemini models) for customer prompts and responses.
US
Google Maps Platform
Processes customer data only for workspaces where the customer’s administrator has enabled this Add-on Service. Maps and places data for customer apps.
Grafana
Log/trace/metrics storage
US
Hex
Customer & Platform analytics
EU
HubSpot
Marketing & CRM
US
Intercom
Customer support communications
US
Lightspeed
Processes customer data only for workspaces where the customer’s administrator has enabled this Add-on Service. Retail and transaction data for customer apps.
LlamaIndex (LlamaParse)
Processes customer data only for workspaces where the customer’s administrator has enabled this Add-on Service. Parses user-uploaded documents and audio.
Mailgun
Transactional email, email domain management
US
Meta Platforms (WhatsApp Business)
Processes customer data only for workspaces where the customer’s administrator has enabled this Add-on Service. Messaging from published customer apps.
Microsoft (Azure AI Foundry)
ai.azure.com
Modal
Executes customer project code
Global
OpenAIAI · OpenAI
Customer prompts, generated code, AI interactions
US
OpenRouter
LLM inference routing
US
Ouraring Inc.
Processes customer data only for workspaces where the customer’s administrator has enabled this Add-on Service. Health and activity data for customer apps.
Parallel
Processes customer data only for workspaces where the customer’s administrator has enabled this Add-on Service. Index, search and research for customer apps.
PerplexityAI · Perplexity
Web search for customer apps and the agent.
US
Pierre
Customer Code Repository
EU
Pipedrive
Processes customer data only for workspaces where the customer’s administrator has enabled this Add-on Service. CRM records for customer apps.
Posthog
Data analytics
US
Rudderstack
Customer analytics and usage data
US
Sentry
Performance monitoring
US
Stripe
Payment processing
US
Supabase
Customer databases, user authentication data
EU (by default)
TanStack
Application stack for customer apps
Temporal Technologies Inc.
Workflow orchestration. Workflow payloads are retained in event history
UK (London, AWS eu-west-2)
Turbopuffer
Indexing customer data to power search
EU
Whitecircle.ai
Safety and Security
EU
Certifications the trust page names · ISO 27001 · SOC 2
Laws the trust page names · GDPR
Retirements announced · every vendor's retirements
2026-03-24
As of March 24, 2026, this feature is no longer available for new Cloud projects.Existing Cloud projects that already use this feature will…
undated
](gemini-3-6-flash-is-deprecated-for-your-app’s-ai-features) Gemini 3.6 Flash is deprecated for your app’s AI features
undated
](gemini-3-7-flash-is-deprecated-for-your-app’s-ai-features) Gemini 3.7 Flash is deprecated for your app’s AI features
2026-11-19
Google is retiring Gemini 3.6 Flash (google/gemini-3.6-flash), so it is now marked deprecated for your app’s AI features and stops working …
2027-01-28
Google is retiring Gemini 3.7 Flash (google/gemini-3.7-flash), so it is now marked deprecated for your app’s AI features and stops working …
undated
Lovable will no longer introduce refactors automatically.
The pages' own stamps: Effective Date 2026-09-15 · Last updated 2025-11-06 · Last Updated 2026-09-15 · Last Updated 2026-08-28 · Version 2026-09-15 · Version 2026-08-28
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
What this page doesn’t tell you
No score.
Nothing here rates Lovable. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at Lovable? With an email at lovable.dev you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is Lovable in your product? Hear the morning we read a change.
You get the lines that moved, in Lovable’s own words, and the date any window closes. No card. Nothing to cancel.