Bolt.new vs. Lovable: data protection per plan
Bolt.new (4 plans) and Lovable (4 plans) side by side: DPA, training on inputs, hosting and data retention per plan, based on the providers’ public documents. Without rating.
Last updated: (latest review date of the tools shown)
At a glance
Each value is listed with the plans it applies to. Pick a tier to see only plans of that tier; if plans are chosen in the plan comparison below, the table shows exactly those.
All plans: each value is listed with the plans it applies to.
| Feature | Bolt.new | Lovable |
|---|---|---|
| Provider based in | StackBlitz, Inc., 1160 Battery Street, Suite 30W, San Francisco, CA 94111, USA | Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden |
| Plans recorded | 4 | 4 |
| Hosting | US only: all 4 plans | mixed: Free, Pro, BusinessEU option: Enterprise |
| Training on inputs | opt-out available: Free, Prono: Teams, Enterprise | opt-out available: Free, Prono: Business, Enterprise |
| DPA | not documented: all 4 plans | no: Free, Proyes: Business, Enterprise |
| As of | 18 Oct 2026 | 18 Oct 2026 |
Plans compared
Comparing: Bolt.new Teams vs. Lovable Business
| Feature | Bolt.newTeams | LovableBusiness |
|---|---|---|
| differs by plan | not publicly documented | yes |
| Details: DPA available | not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found) | yes (DPA included in the plan; signed version available for download) Provider’s DPA |
| no | no | |
| Details: Training on inputs | Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general. | Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention. |
| differs by plan | US only | mixed |
| Details: Data residency | Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented. | Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Business: administrators can set a mandatory default region for new projects. |
| list available | list available | |
| Details: List published |
|
|
| differs by plan | Privacy policy section 11: storage as… | Privacy Policy |
| Details: Data retention | Privacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented. | Privacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months. |
| differs by plan | 30 USD/user/mo… (further prices in the details) | several tiers |
| Details: Price | 30 USD per month per member with monthly payment or 27 USD per month per member with annual payment (pricing page; net/gross not stated) | 50 EUR per month with monthly payment or 42 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 30 USD per 50 credits (0.60 USD per credit); plan credit rate 0.50 USD per credit (Docs) |
| yes | yes | |
| Details: AI features included | yes (features of Pro plus centralised billing, team management, admin controls) | yes (additional governance and team features; top-up USD 30 per 50 credits) |
| 5 sources | 12 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by plan
- Bolt.new Teamsnot publicly documented
- Lovable Businessyes
- Bolt.new Teams
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
Training
- Bolt.new Teamsno
- Lovable Businessno
- Bolt.new Teams
Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general.
Lovable BusinessPrivacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention.
Hosting
- differs by plan
- Bolt.new TeamsUS only
- Lovable Businessmixed
- Bolt.new Teams
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.
Lovable BusinessDocs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Business: administrators can set a mandatory default region for new projects.
Sub-processors
- Bolt.new Teamslist available
- Lovable Businesslist available
- Bolt.new Teams
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
Lovable Business- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
Retention
- differs by plan
- Bolt.new TeamsPrivacy policy section 11: storage as…
- Lovable BusinessPrivacy Policy
- Bolt.new TeamsPrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented.Lovable BusinessPrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
Price
- differs by plan
- Bolt.new Teams30 USD/user/mo… (further prices in the details)
- Lovable Businessseveral tiers
- Bolt.new Teams
30 USD per month per member with monthly payment or 27 USD per month per member with annual payment (pricing page; net/gross not stated)
Lovable Business50 EUR per month with monthly payment or 42 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 30 USD per 50 credits (0.60 USD per credit); plan credit rate 0.50 USD per credit (Docs)
- Bolt.new Teamsyes
- Lovable Businessyes
- Bolt.new Teams
yes (features of Pro plus centralised billing, team management, admin controls)
Lovable Businessyes (additional governance and team features; top-up USD 30 per 50 credits)
Evidence
- Bolt.new Teams5 sources
- Lovable Business12 sources
- Bolt.new Teams
- PricingPricing page, retrieved 18 Oct 2026
- StackBlitz Privacy Policy (as of 2026-09-22)Privacy notice, retrieved 14 Oct 2026
- StackBlitz Terms of Service (as of 2026-09-22)Terms and conditions, retrieved 14 Oct 2026
- Bolt.new Customer Assurance Profile (Trust Center)Trust Center, retrieved 18 Oct 2026
- Bolt SecuritySecurity page, retrieved 14 Oct 2026
Lovable Business- Pricing (German version, plan cards read in the browser)Pricing page, retrieved 18 Oct 2026
- Docs: Plans and creditsDocumentation, retrieved 14 Oct 2026
- SecurityTrust Center, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-09-15)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2025-11-06)DPA, retrieved 14 Oct 2026
- Subprocessors (as of 2026-01-14; refers to the Trust Center)Sub-processor list, retrieved 14 Oct 2026
- Lovable's Trust CenterTrust Center, retrieved 18 Oct 2026
- Trust Center: Subprocessors (44 entries)Sub-processor list, retrieved 18 Oct 2026
- Docs: Lovable Cloud (Region selection)Documentation, retrieved 18 Oct 2026
- Docs: Manage training data and privacyDocumentation, retrieved 18 Oct 2026
- Docs: Privacy & security settingsDocumentation, retrieved 18 Oct 2026
- Docs: Delete a projectDocumentation, retrieved 18 Oct 2026
| Feature | Bolt.new | Lovable |
|---|---|---|
| differs by tool | not publicly documentedall 4 plans |
|
| Details: DPA available |
|
|
|
| |
| Details: Training on inputs |
|
|
| differs by tool | US onlyall 4 plans |
|
| Details: Data residency |
|
|
| list availableall 4 plans | list availableall 4 plans | |
| Details: List published |
|
|
| differs by tool | Privacy policy section 11: storage as…all 4 plans | Privacy Policyall 4 plans |
| Details: Data retention |
|
|
| differs by tool |
|
|
| Details: Price |
|
|
| yesall 4 plans | yesall 4 plans | |
| Details: AI features included |
|
|
| 7 sources | 13 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by tool
- Bolt.newnot publicly documentedall 4 plans
- Lovable
- noFree, Pro
- yesBusiness, Enterprise
- Bolt.new
- Free
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
- Pro
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
- Teams
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
- Enterprise
not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)
Lovable- Free
no (DPA page: applies to Business and Enterprise plans)
- Pro
no (DPA page: applies to Business and Enterprise plans)
- Business
yes (DPA included in the plan; signed version available for download)
Provider’s DPA - Enterprise
yes (DPA included in the plan)
Provider’s DPA
- Free
Training
- Bolt.new
- opt-out availableFree, Pro
- noTeams, Enterprise
- Lovable
- opt-out availableFree, Pro
- noBusiness, Enterprise
- Bolt.new
- Free
Privacy policy (as of 2026-09-22) section 5.C: Bolt may use inputs, outputs, interaction data and project files arising from Bolt AI features from 2026-10-07 onwards for training/fine-tuning its own models and may license de-identified datasets to third parties for remuneration, unless the user objects (opt-out free of charge, regardless of plan, in the account settings or by email; implemented within 15 days). Accounts in the EEA, the United Kingdom and Switzerland are exempt; accounts whose location cannot be determined are treated like EEA accounts. When 'Bolt Forge' is activated (Terms 3.6), the opt-out does not apply as long as Forge is active.
- Pro
Privacy policy (as of 2026-09-22) section 5.C: Bolt may use inputs, outputs, interaction data and project files arising from Bolt AI features from 2026-10-07 onwards for training/fine-tuning its own models and may license de-identified datasets to third parties for remuneration, unless the user objects (opt-out free of charge, regardless of plan, in the account settings or by email; implemented within 15 days). Accounts in the EEA, the United Kingdom and Switzerland are exempt; accounts whose location cannot be determined are treated like EEA accounts. When 'Bolt Forge' is activated (Terms 3.6), the opt-out does not apply as long as Forge is active. Help Center 'Bolt Forge': when Forge is used, prompts, code, project files, configuration, tool calls and edit histories are stored in de-identified form and used by Bolt's partners to train open-source models (consent before first use of Forge); sessions from the EEA, UK and Switzerland are exempt; switching to another agent only stops future collection, data already collected is removed only on request to privacy@stackblitz.com.
- Teams
Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general.
- Enterprise
Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general.
Lovable- Free
Privacy Policy (as of 2026-09-15): Lovable uses Customer Content and Usage Data to train, develop and improve its own AI models; no training on account/billing data or on data of end users of the apps created. Staff may view content for quality review. Contracts with third-party model providers restrict their use for training and retention. Docs 'Manage training data and privacy': since 2026-09-09, customer data from Free and Pro (prompts including attachments, code, project files, outputs, usage data) may be used for training 'unless you opt out'; opt-out at any time and free of charge via the toggle 'Use my Lovable content for model training' (Account settings → Preferences → AI model training), effective only for training data assembled in the future.
- Pro
Privacy Policy (as of 2026-09-15): Lovable uses Customer Content and Usage Data to train, develop and improve its own AI models; no training on account/billing data or on data of end users of the apps created. Staff may view content for quality review. Contracts with third-party model providers restrict their use for training and retention. Docs 'Manage training data and privacy': since 2026-09-09, customer data from Free and Pro (prompts including attachments, code, project files, outputs, usage data) may be used for training 'unless you opt out'; opt-out at any time and free of charge via the toggle 'Use my Lovable content for model training' (Account settings → Preferences → AI model training), effective only for training data assembled in the future.
- Business
Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention.
- Enterprise
Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention. Enterprise: setting 'Extended-retention models' (default: disabled); unless enabled, the workspace uses only zero-data-retention models; according to the docs, retained data is never used for model training.
- Free
Hosting
- differs by tool
- Bolt.newUS onlyall 4 plans
- Lovable
- mixedFree, Pro, Business
- EU optionEnterprise
- Bolt.new
- Free
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.
- Pro
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.
- Teams
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.
- Enterprise
Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented. For Enterprise, the pricing page mentions 'Data governance & retention policies'; location options are not described.
Lovable- Free
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global).
- Pro
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global).
- Business
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Business: administrators can set a mandatory default region for new projects.
- Enterprise
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Enterprise: mandatory default region for new projects; 'EU inference' (Enterprise only) sends all AI requests to model endpoints in the EU, requests without an EU endpoint fail; country-specific regions on request.
- Free
Sub-processors
- Bolt.newlist availableall 4 plans
- Lovablelist availableall 4 plans
- Bolt.new
- Free
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
- Pro
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
- Teams
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
- Enterprise
- AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
- Cloudfront (content delivery network)
- GitHub (code repository)
- Anthropic (code generation, LLM)
- Google Gemini (code generation, LLM)
Lovable- Free
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Pro
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Business
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Enterprise
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Free
Retention
- differs by tool
- Bolt.newPrivacy policy section 11: storage as…all 4 plans
- LovablePrivacy Policyall 4 plans
- Bolt.new
- FreePrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented.
- ProPrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented.
- TeamsPrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented.
- EnterprisePrivacy policy section 11: storage as long as the account is active; on termination/suspension without a violation, 30 days to export, after which deletion is possible; after voluntary account closure, deletion or anonymisation 'within a reasonable period'; residual copies in backups/logs for a limited time. Specific periods: not publicly documented. Enterprise: retention policies configurable according to the pricing page (details not publicly documented).
Lovable- FreePrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
- ProPrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
- BusinessPrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
- EnterprisePrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months. Enterprise: if 'Extended-retention models' are enabled, model providers retain prompts and outputs for at least 30 days, content flagged by safety systems or subject to a legal hold for up to 2 years.
Price
- differs by tool
- Bolt.new
- 0 USDFree
- 25 USD/mo… (further prices in the details)Pro
- 30 USD/user/mo… (further prices in the details)Teams
- customEnterprise
- Lovable
- 0 EUR/moFree
- several tiersPro, Business
- customEnterprise
- Bolt.new
- Free
0 USD (pricing page; net/gross not stated)
- Pro
25 USD per month with monthly payment or 18 USD per month with annual payment (pricing page; net/gross not stated)
- Teams
30 USD per month per member with monthly payment or 27 USD per month per member with annual payment (pricing page; net/gross not stated)
- Enterprise
Individual (pricing page: 'Custom')
Lovable- Free
0 EUR per month (pricing page, German version; without stating whether VAT is included)
- Pro
25 EUR per month with monthly payment or 21 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 15 USD per 50 credits (0.30 USD per credit); plan credit rate 0.25 USD per credit (Docs)
- Business
50 EUR per month with monthly payment or 42 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 30 USD per 50 credits (0.60 USD per credit); plan credit rate 0.50 USD per credit (Docs)
- Enterprise
Custom (pricing page: platform fee and volume-based pricing)
- Free
- Bolt.newyesall 4 plans
- Lovableyesall 4 plans
- Bolt.new
- Free
yes (AI app builder; 300,000 tokens per day, 1 million tokens per month)
- Pro
yes (no daily limit, from 10M tokens per month, unused tokens roll over); according to the Help Center, Bolt Forge (agent using open-source models) was included at no extra cost during the research preview from 2026-09-14 to 2026-10-14, after which Pro no longer has Forge access
- Teams
yes (features of Pro plus centralised billing, team management, admin controls)
- Enterprise
yes (features of Pro plus SSO, audit logs, compliance support, data governance and retention policies)
Lovable- Free
yes (5 daily build credits, up to 30 per month; 20 cloud credits and 4 credits for AI features in the apps created each month)
- Pro
yes (from 100 subscription credits per month; additionally daily build credits, cloud grant, AI grant; top-up USD 15 per 50 credits)
- Business
yes (additional governance and team features; top-up USD 30 per 50 credits)
- Enterprise
yes (volume-based credit pricing, SSO/SAML/OIDC, SCIM)
- Free
Evidence
- Bolt.new7 sources
- Lovable13 sources
- Bolt.new
- PricingPricing page, retrieved 18 Oct 2026
- StackBlitz Privacy Policy (as of 2026-09-22)Privacy notice, retrieved 14 Oct 2026
- StackBlitz Terms of Service (as of 2026-09-22)Terms and conditions, retrieved 14 Oct 2026
- Bolt.new Customer Assurance Profile (Trust Center)Trust Center, retrieved 18 Oct 2026
- Bolt SecuritySecurity page, retrieved 14 Oct 2026
- Help Center: Bolt ForgeHelp Center, retrieved 18 Oct 2026
- What is Bolt Forge? (Bolt blog)Provider blog, retrieved 18 Oct 2026
Lovable- Pricing (German version, plan cards read in the browser)Pricing page, retrieved 18 Oct 2026
- Docs: Plans and creditsDocumentation, retrieved 14 Oct 2026
- SecurityTrust Center, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-09-15)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2025-11-06)DPA, retrieved 14 Oct 2026
- Subprocessors (as of 2026-01-14; refers to the Trust Center)Sub-processor list, retrieved 14 Oct 2026
- Lovable's Trust CenterTrust Center, retrieved 18 Oct 2026
- Trust Center: Subprocessors (44 entries)Sub-processor list, retrieved 18 Oct 2026
- Docs: Lovable Cloud (Region selection)Documentation, retrieved 18 Oct 2026
- Docs: EU inferenceDocumentation, retrieved 18 Oct 2026
- Docs: Manage training data and privacyDocumentation, retrieved 18 Oct 2026
- Docs: Privacy & security settingsDocumentation, retrieved 18 Oct 2026
- Docs: Delete a projectDocumentation, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
No guarantee of accuracy, not legal advice. Each entry is valid as of the date shown. Open points are listed on the detail pages.
More comparisons
Bolt.new compared with
Individual pages: Bolt.new, Lovable. All tools in the category: Software development.