Lovable

Lovable uses Customer Data for AI model training by default on free/standard tiers, but offers opt-out via Business plan or direct contact. The DPA explicitly prohibits AI/ML training on Customer Personal Data for Business/Enterprise customers, creating a two-tier system. Standard tier users have vague opt-out language without clear default protection.

“[ToS] 'you grant us a worldwide, perpetual, royalty-free license to use, copy, modify, process, analyze, and otherwise exploit your Customer Data for our business purposes, including without limitation...developing and training artificial intelligence and machine learning models.' [DPA] 'Lovable shall not use any Customer Personal Data for the purpose of training, retraining, fine-tuning, or otherwise developing any Artificial Intelligence (AI) or Machine Learning (ML) models.'”

Lovable claims a perpetual, worldwide, royalty-free license to Customer Data for any lawful business purpose including model training, sublicensing to sub-processors, and creating derivative works. The license survives account termination for anonymized/aggregated data. This is extremely broad and unfavorable to enterprises.

“[ToS] 'you grant us a worldwide, perpetual, royalty-free license to use, copy, modify, process, analyze, and otherwise exploit your Customer Data for our business purposes, including without limitation: operating, maintaining, and improving the Services; developing and training artificial intelligence and machine learning models; creating benchmarks, analytics, and insights; and any other lawful business purpose.'”

Lovable shares Customer Data with Infrastructure Providers (Supabase) and Third-Party AI Providers (OpenAI, Google, OpenRouter) under their own privacy policies. Sub-processors are listed but sharing is broad. DPA requires DPAs with sub-processors, but standard ToS lacks explicit sub-processor DPA requirements.

“[Privacy] 'We engage third-party sub-processors to support our Services, such as: Hosting and maintaining our platform, website, and databases. Processing payments through secure third-party payment processors. Providing technical support, customer service, and analytics.' [ToS] 'The Services, including the Platform, Lovable Cloud, and the AI Gateway, run in part on Infrastructure Providers (for example, Supabase and other hosting or database providers).'”

Retention periods are vague for standard tiers ('as long as reasonably necessary'). DPA specifies 30-day deletion window post-termination but allows indefinite retention of anonymized/aggregated data. Backups may persist 90 days. Log data retained up to 90 days. No clear automatic purge on account termination for all data types.

“[DPA] 'Within thirty (30) calendar days after the termination of the Agreement the Customer may instruct Lovable, in writing, to return or delete all Customer Personal Data then in Lovable's possession or control...Deleted data may persist in backups for a limited time before being permanently removed.' [Privacy] 'Log data is retained for up to ninety (90) days, unless required by law.'”

Lovable explicitly states that users own Customer Data and AI Output generated for them. The vendor claims no ownership rights to outputs, only a license to use the data for service improvement and model training (which can be opted out on Business plans).

“[ToS] 'As between us, you own your Customer Data, including the applications, websites, or other projects you build using the Services. As between us, you also own any AI Output generated for you through the Services, subject to any third-party rights in the underlying models, training data, or outputs.'”

Lovable maintains SOC 2 Type II and ISO 27001 certifications as stated in the DPA. Security page and trust page are referenced. DPA explicitly requires these certifications for the duration of the agreement and offers access to recent reports upon request.

“[DPA] 'Lovable shall maintain SOC 2 Type II and ISO 27001 accreditations for the duration of the term of the Agreement. Upon request, approval and acceptance to confidentiality obligations, Lovable may provide access to the recent SOC 2 Type II & ISO 27001 reports.' [Privacy] 'Security Monitoring: Real-time monitoring, centralized logging with one-year retention, and annual SOC 2 Type II audits.'”