Reviewed: 10 September 2026 - prepared by WAIMAKERS B.V.

1 Purpose

Deployment-specific review. Lovable can support an EU app-development workflow when the correct plan, DPA, Lovable Cloud region and downstream services are governed. Selecting an EU app-backend region does not prove that account, prompt, telemetry, AI-provider, support and GitHub flows all stay in the EU.

2 Comparison of Lovable Tiers (EU focus)

Plan	Privacy and contract route	Public price at review date
Free	No included DPA; user training opt-out in account settings	Free; 5 daily build credits, capped at 30/month
Pro	No included DPA; user training opt-out in account settings	$25/month or $21/month billed annually for the entry credit bundle
Business	DPA included; workspace data excluded from training by default; SSO	From $50/month or $42/month billed annually
Enterprise	DPA included; custom security, support and volume terms	Custom

Lovable uses workspace credit balances for building, Cloud and in-app AI. Credits, grants and consumption rates can change; verify the live checkout and order form.

3 Is Lovable GDPR-Compliant?

Training policy is plan-dependent

Under Lovable's 9 September 2026 training documentation and Privacy Policy, Customer Content and Usage Data from Free and Pro accounts may contain personal data and may be used for model training, development and human quality review. Each user can disable Use my Lovable content for model training in Account settings. The opt-out applies prospectively to data assembled after it takes effect; it does not retract content from earlier training datasets or models.

Business and Enterprise workspace data is excluded from training by default and needs no opt-out. Lovable says its third-party model-provider contracts restrict provider training. Its DPA separately permits Lovable to train or tune proprietary models on Service Data, while section 10 prohibits AI/ML training on Customer Personal Data and on de-identified data derived from Customer Personal Data. Procurement should verify that the purchased workspace and every contributor are on the intended plan before adding data.

Residency, DPA and retention

✅ Lovable Cloud supports customer-selected EU, US and Asia-Pacific app-backend hosting and says Customer Data in Lovable Cloud does not move across regions by default. This claim is scoped to Lovable Cloud; the core development platform and AI-provider flows need separate review.
✅ The public DPA is included for Business and Enterprise. It incorporates SCC Modules 2 and 3 and a UK Addendum for covered transfers, and permits Lovable to process Service Data independently for analytics, security, billing and product development.
⚠️ Lovable's Privacy Policy uses purpose-based retention: account data and Customer Content remain while the account is open, then are deleted or de-identified after closure or a verified deletion request, subject to legal needs. Operational and security logs may remain as long as needed, including longer during an incident. The DPA gives the customer 30 days after termination to instruct return or deletion; without an instruction Lovable may delete or irreversibly anonymise according to its schedule.
⚠️ The DPA prohibits customers from providing protected health information, financial-account numbers, government identifiers, biometric data or other data it classifies as sensitive.
✅ Lovable advertises SOC 2 Type II and ISO 27001:2022. Certifications support assurance review but do not prove a generated app is secure. Customers remain responsible for generated code, access rules, secrets, databases and production configuration.

The former page's claims about on-premises Enterprise deployment, a named primary model, immutable regionality for all platform data, and a specific April 2026 incident are omitted because current primary-source support was not established in this audit.

4 EU Rollout Checklist (Practical)

Use Business or Enterprise when a processor DPA, SSO and default exclusion from training are required.
Execute and archive the DPA; inspect current subprocessors and document transfer mechanisms.
For any Free or Pro contributor, disable Use my Lovable content for model training before adding data; record that the control is prospective.
Select the EU Lovable Cloud region before creating the production backend; document which flows are outside that scope.
Review AI providers, GitHub, Supabase/Lovable Cloud, connectors and any deployed app services separately.
Scan generated code for exposed secrets, broken access control and unsafe database policies; perform an independent security review before production.
Test export and deletion for projects, prompts, logs, app data and backups. Record differing retention rules.
Complete a DPIA where the app or development process is likely to create high risk.

5 Notes & Caveats

Open procurement questions

Are all contributors covered by a Business or Enterprise workspace, and how does Lovable classify their Customer Content versus Service Data?
Which prompt, code, account and telemetry flows remain outside the selected Lovable Cloud region?
Which AI providers receive content for each feature, in which locations and for how long?
What operational schedule applies to project data, logs, backups and de-identification after closure or a deletion request?
Which SOC 2/ISO scope covers the development platform, Lovable Cloud and AI gateway?

6 References

7 Disclaimer

This page is a practical procurement and data-risk overview, not legal advice. Suitability depends on plan, signed terms, opt-out state, app region, subprocessors, generated application controls and the customer's GDPR assessment.