Cursor vs. Lovable: data protection per plan
Cursor (5 plans) and Lovable (4 plans) side by side: DPA, training on inputs, hosting and data retention per plan, based on the providers’ public documents. Without rating.
Last updated: (latest review date of the tools shown)
At a glance
Each value is listed with the plans it applies to. Pick a tier to see only plans of that tier; if plans are chosen in the plan comparison below, the table shows exactly those.
All plans: each value is listed with the plans it applies to.
| Feature | Cursor | Lovable |
|---|---|---|
| Provider based in | Anysphere, Inc., 2261 Market Street STE 86466, San Francisco, CA 94114, USA | Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden |
| Plans recorded | 5 | 4 |
| Hosting | mixed: all 5 plans | mixed: Free, Pro, BusinessEU option: Enterprise |
| Training on inputs | opt-out available: all 5 plans | opt-out available: Free, Prono: Business, Enterprise |
| DPA | not documented: Free, Plus, Premium / Super / Ultra, Teamsyes: Enterprise | no: Free, Proyes: Business, Enterprise |
| As of | 18 Oct 2026 | 18 Oct 2026 |
Plans compared
Comparing: Cursor Teams vs. Lovable Business
| Feature | CursorTeams | LovableBusiness |
|---|---|---|
| differs by plan | not publicly documented | yes |
| Details: DPA available | not publicly documented (the public DPA refers to a Master Services Agreement with Anysphere; according to the Terms of Service an MSA applies only if the organisation has concluded one; the Privacy Policy mentions a processor role only generally 'For commercial uses of the Service') | yes (DPA included in the plan; signed version available for download) Provider’s DPA |
| differs by plan | opt-out available | no |
| Details: Training on inputs | Data Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. Teams: team-wide privacy settings; new members inherit the team setting; admins can enforce Privacy Mode. | Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention. |
| mixed | mixed | |
| Details: Data residency | Privacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development. | Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Business: administrators can set a mandatory default region for new projects. |
| list available | list available | |
| Details: List published |
|
|
| differs by plan | With Privacy Mode: ZDR with model… | Privacy Policy |
| Details: Data retention | With Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented. | Privacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months. |
| differs by plan | from 30 USD/user/mo | several tiers |
| Details: Price | from USD 30 per user per month (pricing page: "$30+/user/month", excl. taxes); seat types can be combined. | 50 EUR per month with monthly payment or 42 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 30 USD per 50 credits (0.60 USD per credit); plan credit rate 0.50 USD per credit (Docs) |
| yes | yes | |
| Details: AI features included | yes (as Premium, plus team marketplace, centralised billing, team-wide privacy settings, custom chat data retention, SAML/OIDC SSO; usage 4x to 50x Plus depending on seat tier) | yes (additional governance and team features; top-up USD 30 per 50 credits) |
| 6 sources | 12 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by plan
- Cursor Teamsnot publicly documented
- Lovable Businessyes
- Cursor Teams
not publicly documented (the public DPA refers to a Master Services Agreement with Anysphere; according to the Terms of Service an MSA applies only if the organisation has concluded one; the Privacy Policy mentions a processor role only generally 'For commercial uses of the Service')
Training
- differs by plan
- Cursor Teamsopt-out available
- Lovable Businessno
- Cursor Teams
Data Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. Teams: team-wide privacy settings; new members inherit the team setting; admins can enforce Privacy Mode.
Lovable BusinessPrivacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention.
Hosting
- Cursor Teamsmixed
- Lovable Businessmixed
- Cursor Teams
Privacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development.
Lovable BusinessDocs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Business: administrators can set a mandatory default region for new projects.
Sub-processors
- Cursor Teamslist available
- Lovable Businesslist available
- Cursor Teams
- Amazon Web Services (primary cloud hosting; US, EU, Singapore)
- Further infrastructure: Microsoft Azure (secondary, US), Google Cloud Platform (US), Vercel (web hosting, US), Cloudflare (CDN/network security, worldwide)
- Model providers: OpenAI, Anthropic, Google Gemini (Vertex API), Meta (each worldwide), SpaceXAI (US), TypeSafe AI (US)
- Inference infrastructure: Fireworks (US, Canada, EU, UK), Baseten (US, Canada), Together (own models, with a ZDR agreement according to the list; US, Canada, UK), Nebius (UK), CoreWeave (US), Databricks (analytics database and inference, worldwide)
- Exa (web search, US), Datadog (logging/monitoring, US), WorkOS (SSO/SCIM, US)
Lovable Business- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
Retention
- differs by plan
- Cursor TeamsWith Privacy Mode: ZDR with model…
- Lovable BusinessPrivacy Policy
- Cursor TeamsWith Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented.Lovable BusinessPrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
Price
- differs by plan
- Cursor Teamsfrom 30 USD/user/mo
- Lovable Businessseveral tiers
- Cursor Teams
from USD 30 per user per month (pricing page: "$30+/user/month", excl. taxes); seat types can be combined.
Lovable Business50 EUR per month with monthly payment or 42 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 30 USD per 50 credits (0.60 USD per credit); plan credit rate 0.50 USD per credit (Docs)
- Cursor Teamsyes
- Lovable Businessyes
- Cursor Teams
yes (as Premium, plus team marketplace, centralised billing, team-wide privacy settings, custom chat data retention, SAML/OIDC SSO; usage 4x to 50x Plus depending on seat tier)
Lovable Businessyes (additional governance and team features; top-up USD 30 per 50 credits)
Evidence
- Cursor Teams6 sources
- Lovable Business12 sources
- Cursor Teams
- PricingPricing page, retrieved 18 Oct 2026
- Security (as of 2026-08-25)Trust Center, retrieved 18 Oct 2026
- Data Use & Privacy Overview (as of 2026-09-03)Privacy notice, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-10-11)Privacy notice, retrieved 18 Oct 2026
- Docs: Privacy and data governanceDocumentation, retrieved 18 Oct 2026
- Trust Center: Subprocessors (Vanta, 20 entries)Sub-processor list, retrieved 18 Oct 2026
Lovable Business- Pricing (German version, plan cards read in the browser)Pricing page, retrieved 18 Oct 2026
- Docs: Plans and creditsDocumentation, retrieved 14 Oct 2026
- SecurityTrust Center, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-09-15)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2025-11-06)DPA, retrieved 14 Oct 2026
- Subprocessors (as of 2026-01-14; refers to the Trust Center)Sub-processor list, retrieved 14 Oct 2026
- Lovable's Trust CenterTrust Center, retrieved 18 Oct 2026
- Trust Center: Subprocessors (44 entries)Sub-processor list, retrieved 18 Oct 2026
- Docs: Lovable Cloud (Region selection)Documentation, retrieved 18 Oct 2026
- Docs: Manage training data and privacyDocumentation, retrieved 18 Oct 2026
- Docs: Privacy & security settingsDocumentation, retrieved 18 Oct 2026
- Docs: Delete a projectDocumentation, retrieved 18 Oct 2026
| Feature | Cursor | Lovable |
|---|---|---|
| differs by tool |
|
|
| Details: DPA available |
|
|
| differs by tool | opt-out availableall 5 plans |
|
| Details: Training on inputs |
|
|
| differs by tool | mixedall 5 plans |
|
| Details: Data residency |
|
|
| list availableall 5 plans | list availableall 4 plans | |
| Details: List published |
|
|
| differs by tool | With Privacy Mode: ZDR with model…all 5 plans | Privacy Policyall 4 plans |
| Details: Data retention |
|
|
| differs by tool |
|
|
| Details: Price |
|
|
| yesall 5 plans | yesall 4 plans | |
| Details: AI features included |
|
|
| 8 sources | 13 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by tool
- Cursor
- not publicly documentedFree (free of charge), Plus, Premium / Super / Ultra (Individual), Teams
- yesEnterprise
- Lovable
- noFree, Pro
- yesBusiness, Enterprise
- Cursor
- Free (free of charge)
not publicly documented (the public DPA refers to a Master Services Agreement with Anysphere; according to the Terms of Service an MSA applies only if the organisation has concluded one; the Privacy Policy mentions a processor role only generally 'For commercial uses of the Service')
- Plus
not publicly documented (the public DPA refers to a Master Services Agreement with Anysphere; according to the Terms of Service an MSA applies only if the organisation has concluded one; the Privacy Policy mentions a processor role only generally 'For commercial uses of the Service')
- Premium / Super / Ultra (Individual)
not publicly documented (the public DPA refers to a Master Services Agreement with Anysphere; according to the Terms of Service an MSA applies only if the organisation has concluded one; the Privacy Policy mentions a processor role only generally 'For commercial uses of the Service')
- Teams
not publicly documented (the public DPA refers to a Master Services Agreement with Anysphere; according to the Terms of Service an MSA applies only if the organisation has concluded one; the Privacy Policy mentions a processor role only generally 'For commercial uses of the Service')
- Enterprise
yes (public DPA, applies together with the Master Services Agreement; EU SCCs Module Two and UK Addendum)
Provider’s DPA
Lovable- Free
no (DPA page: applies to Business and Enterprise plans)
- Pro
no (DPA page: applies to Business and Enterprise plans)
- Business
yes (DPA included in the plan; signed version available for download)
Provider’s DPA - Enterprise
yes (DPA included in the plan)
Provider’s DPA
- Free (free of charge)
Training
- differs by tool
- Cursoropt-out availableall 5 plans
- Lovable
- opt-out availableFree, Pro
- noBusiness, Enterprise
- Cursor
- Free (free of charge)
Data Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. According to the Security page, Privacy Mode is also available for Free and can be enabled in the settings; default setting for individual accounts not publicly documented.
- Plus
Data Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. According to the Security page, Privacy Mode is available for Free and Pro and can be enabled in the settings; default setting for individual accounts not publicly documented.
- Premium / Super / Ultra (Individual)
Data Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. According to the Security page, Privacy Mode is available for Free and Pro and can be enabled in the settings; default setting for individual accounts not publicly documented.
- Teams
Data Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. Teams: team-wide privacy settings; new members inherit the team setting; admins can enforce Privacy Mode.
- Enterprise
Data Use (as of 2026-09-03): with Privacy Mode enabled, Customer Data is not used by Cursor for training; Cursor has zero data retention agreements with all model providers, and the providers do not store or train on the data. Exception: risk classifiers; where abuse detection is triggered, data may be stored for investigation. Non-ZDR models are labelled or require admin approval. Without Privacy Mode, Cursor may store codebase data, prompts, editor actions and code snippets and use them to train its own models. Enterprise: according to the documentation, Privacy Mode is enabled by default and enforceable; requests to models with provider-side storage (according to the documentation, Claude Fable 5 and 5.1) fail until an admin approves the retention policy.
Lovable- Free
Privacy Policy (as of 2026-09-15): Lovable uses Customer Content and Usage Data to train, develop and improve its own AI models; no training on account/billing data or on data of end users of the apps created. Staff may view content for quality review. Contracts with third-party model providers restrict their use for training and retention. Docs 'Manage training data and privacy': since 2026-09-09, customer data from Free and Pro (prompts including attachments, code, project files, outputs, usage data) may be used for training 'unless you opt out'; opt-out at any time and free of charge via the toggle 'Use my Lovable content for model training' (Account settings → Preferences → AI model training), effective only for training data assembled in the future.
- Pro
Privacy Policy (as of 2026-09-15): Lovable uses Customer Content and Usage Data to train, develop and improve its own AI models; no training on account/billing data or on data of end users of the apps created. Staff may view content for quality review. Contracts with third-party model providers restrict their use for training and retention. Docs 'Manage training data and privacy': since 2026-09-09, customer data from Free and Pro (prompts including attachments, code, project files, outputs, usage data) may be used for training 'unless you opt out'; opt-out at any time and free of charge via the toggle 'Use my Lovable content for model training' (Account settings → Preferences → AI model training), effective only for training data assembled in the future.
- Business
Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention.
- Enterprise
Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention. Enterprise: setting 'Extended-retention models' (default: disabled); unless enabled, the workspace uses only zero-data-retention models; according to the docs, retained data is never used for model training.
- Free (free of charge)
Hosting
- differs by tool
- Cursormixedall 5 plans
- Lovable
- mixedFree, Pro, Business
- EU optionEnterprise
- Cursor
- Free (free of charge)
Privacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development.
- Plus
Privacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development.
- Premium / Super / Ultra (Individual)
Privacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development.
- Teams
Privacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development.
- Enterprise
Privacy Policy (as of 2026-10-11): processing on servers in various jurisdictions, including the US; data of EEA users may be transferred to the US. Sub-processor list (Trust Center): 'Our infrastructure is primarily hosted on AWS US region with some latency critical services in Europe and Singapore.' Docs: data residency only for Enterprise; US-only (inference, processing, storage incl. backups in the US, 10% uplift); EU/UK inference only on request, further EU coverage in development.
Lovable- Free
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global).
- Pro
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global).
- Business
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Business: administrators can set a mandatory default region for new projects.
- Enterprise
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Enterprise: mandatory default region for new projects; 'EU inference' (Enterprise only) sends all AI requests to model endpoints in the EU, requests without an EU endpoint fail; country-specific regions on request.
- Free (free of charge)
Sub-processors
- Cursorlist availableall 5 plans
- Lovablelist availableall 4 plans
- Cursor
- Free (free of charge)
- Amazon Web Services (primary cloud hosting; US, EU, Singapore)
- Further infrastructure: Microsoft Azure (secondary, US), Google Cloud Platform (US), Vercel (web hosting, US), Cloudflare (CDN/network security, worldwide)
- Model providers: OpenAI, Anthropic, Google Gemini (Vertex API), Meta (each worldwide), SpaceXAI (US), TypeSafe AI (US)
- Inference infrastructure: Fireworks (US, Canada, EU, UK), Baseten (US, Canada), Together (own models, with a ZDR agreement according to the list; US, Canada, UK), Nebius (UK), CoreWeave (US), Databricks (analytics database and inference, worldwide)
- Exa (web search, US), Datadog (logging/monitoring, US), WorkOS (SSO/SCIM, US)
- Plus
- Amazon Web Services (primary cloud hosting; US, EU, Singapore)
- Further infrastructure: Microsoft Azure (secondary, US), Google Cloud Platform (US), Vercel (web hosting, US), Cloudflare (CDN/network security, worldwide)
- Model providers: OpenAI, Anthropic, Google Gemini (Vertex API), Meta (each worldwide), SpaceXAI (US), TypeSafe AI (US)
- Inference infrastructure: Fireworks (US, Canada, EU, UK), Baseten (US, Canada), Together (own models, with a ZDR agreement according to the list; US, Canada, UK), Nebius (UK), CoreWeave (US), Databricks (analytics database and inference, worldwide)
- Exa (web search, US), Datadog (logging/monitoring, US), WorkOS (SSO/SCIM, US)
- Premium / Super / Ultra (Individual)
- Amazon Web Services (primary cloud hosting; US, EU, Singapore)
- Further infrastructure: Microsoft Azure (secondary, US), Google Cloud Platform (US), Vercel (web hosting, US), Cloudflare (CDN/network security, worldwide)
- Model providers: OpenAI, Anthropic, Google Gemini (Vertex API), Meta (each worldwide), SpaceXAI (US), TypeSafe AI (US)
- Inference infrastructure: Fireworks (US, Canada, EU, UK), Baseten (US, Canada), Together (own models, with a ZDR agreement according to the list; US, Canada, UK), Nebius (UK), CoreWeave (US), Databricks (analytics database and inference, worldwide)
- Exa (web search, US), Datadog (logging/monitoring, US), WorkOS (SSO/SCIM, US)
- Teams
- Amazon Web Services (primary cloud hosting; US, EU, Singapore)
- Further infrastructure: Microsoft Azure (secondary, US), Google Cloud Platform (US), Vercel (web hosting, US), Cloudflare (CDN/network security, worldwide)
- Model providers: OpenAI, Anthropic, Google Gemini (Vertex API), Meta (each worldwide), SpaceXAI (US), TypeSafe AI (US)
- Inference infrastructure: Fireworks (US, Canada, EU, UK), Baseten (US, Canada), Together (own models, with a ZDR agreement according to the list; US, Canada, UK), Nebius (UK), CoreWeave (US), Databricks (analytics database and inference, worldwide)
- Exa (web search, US), Datadog (logging/monitoring, US), WorkOS (SSO/SCIM, US)
- Enterprise
- Amazon Web Services (primary cloud hosting; US, EU, Singapore)
- Further infrastructure: Microsoft Azure (secondary, US), Google Cloud Platform (US), Vercel (web hosting, US), Cloudflare (CDN/network security, worldwide)
- Model providers: OpenAI, Anthropic, Google Gemini (Vertex API), Meta (each worldwide), SpaceXAI (US), TypeSafe AI (US)
- Inference infrastructure: Fireworks (US, Canada, EU, UK), Baseten (US, Canada), Together (own models, with a ZDR agreement according to the list; US, Canada, UK), Nebius (UK), CoreWeave (US), Databricks (analytics database and inference, worldwide)
- Exa (web search, US), Datadog (logging/monitoring, US), WorkOS (SSO/SCIM, US)
Lovable- Free
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Pro
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Business
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Enterprise
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Free (free of charge)
Retention
- differs by tool
- CursorWith Privacy Mode: ZDR with model…all 5 plans
- LovablePrivacy Policyall 4 plans
- Cursor
- Free (free of charge)With Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented.
- PlusWith Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented.
- Premium / Super / Ultra (Individual)With Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented.
- TeamsWith Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented.
- EnterpriseWith Privacy Mode: ZDR with model providers; file contents are encrypted to reduce latency and cached only for the duration of the request. Cloud Agents: according to the documentation, repository contents are stored only during the agent run and deleted afterwards. Without Privacy Mode: inference providers may temporarily store inputs/outputs, which are deleted afterwards. Personal data in general: only as long as necessary (Privacy Policy); specific retention periods not publicly documented.
Lovable- FreePrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
- ProPrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
- BusinessPrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
- EnterprisePrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months. Enterprise: if 'Extended-retention models' are enabled, model providers retain prompts and outputs for at least 30 days, content flagged by safety systems or subject to a legal hold for up to 2 years.
Price
- differs by tool
- Cursor
- 0 USD/moFree (free of charge)
- 8 USD/moPlus
- several tiersPremium / Super / Ultra (Individual)
- from 30 USD/user/moTeams
- customEnterprise
- Lovable
- 0 EUR/moFree
- several tiersPro, Business
- customEnterprise
- Cursor
- Free (free of charge)
USD 0 per month (pricing page; prices excl. taxes such as VAT)
- Plus
USD 8 per month (pricing page, excl. taxes). According to the pricing page FAQ, subscriptions are sold via X Subscription Corp.
- Premium / Super / Ultra (Individual)
Premium USD 30, Super USD 100, Ultra USD 200 per month (pricing page, excl. taxes); third-party models are billed separately based on usage. According to the FAQ, sold via X Subscription Corp.
- Teams
from USD 30 per user per month (pricing page: "$30+/user/month", excl. taxes); seat types can be combined.
- Enterprise
Custom (pricing page: 'Custom'); invoice/PO billing available
Lovable- Free
0 EUR per month (pricing page, German version; without stating whether VAT is included)
- Pro
25 EUR per month with monthly payment or 21 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 15 USD per 50 credits (0.30 USD per credit); plan credit rate 0.25 USD per credit (Docs)
- Business
50 EUR per month with monthly payment or 42 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 30 USD per 50 credits (0.60 USD per credit); plan credit rate 0.50 USD per credit (Docs)
- Enterprise
Custom (pricing page: platform fee and volume-based pricing)
- Free (free of charge)
- Cursoryesall 5 plans
- Lovableyesall 4 plans
- Cursor
- Free (free of charge)
yes (limited AI usage, limited Agent and chat requests; Grok Chat/Imagine/Build limited)
- Plus
yes (shared AI usage pool; according to the pricing page, Grok models only; Grok Chat, Voice, Imagine, Build, Grok API access; plus X features)
- Premium / Super / Ultra (Individual)
yes (Premium 4x, Super 15x, Ultra 50x usage compared with Plus; Cloud Agents and automations, Bugbot, third-party models at API list price, Grok Bot, video generation; plus X features)
- Teams
yes (as Premium, plus team marketplace, centralised billing, team-wide privacy settings, custom chat data retention, SAML/OIDC SSO; usage 4x to 50x Plus depending on seat tier)
- Enterprise
yes (as Teams, plus pooled usage, invoice/PO, SCIM, access, network and model controls, audit logs, Priority Support; optional US data residency)
Lovable- Free
yes (5 daily build credits, up to 30 per month; 20 cloud credits and 4 credits for AI features in the apps created each month)
- Pro
yes (from 100 subscription credits per month; additionally daily build credits, cloud grant, AI grant; top-up USD 15 per 50 credits)
- Business
yes (additional governance and team features; top-up USD 30 per 50 credits)
- Enterprise
yes (volume-based credit pricing, SSO/SAML/OIDC, SCIM)
- Free (free of charge)
Evidence
- Cursor8 sources
- Lovable13 sources
- Cursor
- PricingPricing page, retrieved 18 Oct 2026
- Security (as of 2026-08-25)Trust Center, retrieved 18 Oct 2026
- Data Use & Privacy Overview (as of 2026-09-03)Privacy notice, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-10-11)Privacy notice, retrieved 18 Oct 2026
- Data Processing Addendum (as of 2025-11-05)DPA, retrieved 18 Oct 2026
- Docs: Privacy and data governanceDocumentation, retrieved 18 Oct 2026
- Trust Center: Subprocessors (Vanta, 20 entries)Sub-processor list, retrieved 18 Oct 2026
- SpaceXAI Bundled Subscription Terms (X Subscription Corp)Terms and conditions, retrieved 18 Oct 2026
Lovable- Pricing (German version, plan cards read in the browser)Pricing page, retrieved 18 Oct 2026
- Docs: Plans and creditsDocumentation, retrieved 14 Oct 2026
- SecurityTrust Center, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-09-15)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2025-11-06)DPA, retrieved 14 Oct 2026
- Subprocessors (as of 2026-01-14; refers to the Trust Center)Sub-processor list, retrieved 14 Oct 2026
- Lovable's Trust CenterTrust Center, retrieved 18 Oct 2026
- Trust Center: Subprocessors (44 entries)Sub-processor list, retrieved 18 Oct 2026
- Docs: Lovable Cloud (Region selection)Documentation, retrieved 18 Oct 2026
- Docs: EU inferenceDocumentation, retrieved 18 Oct 2026
- Docs: Manage training data and privacyDocumentation, retrieved 18 Oct 2026
- Docs: Privacy & security settingsDocumentation, retrieved 18 Oct 2026
- Docs: Delete a projectDocumentation, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
No guarantee of accuracy, not legal advice. Each entry is valid as of the date shown. Open points are listed on the detail pages.
More comparisons
Cursor compared with
Individual pages: Cursor, Lovable. All tools in the category: Software development.