GitHub Copilot vs. Lovable: data protection per plan
GitHub Copilot (7 plans) and Lovable (4 plans) side by side: DPA, training on inputs, hosting and data retention per plan, based on the providers’ public documents. Without rating.
Last updated: (latest review date of the tools shown)
At a glance
Each value is listed with the plans it applies to. Pick a tier to see only plans of that tier; if plans are chosen in the plan comparison below, the table shows exactly those.
All plans: each value is listed with the plans it applies to.
| Feature | GitHub Copilot | Lovable |
|---|---|---|
| Provider based in | According to the GitHub General Privacy Statement | Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden |
| Plans recorded | 7 | 4 |
| Hosting | mixed: Free, Student, Pro, Pro+, MaxEU option: Business, Enterprise | mixed: Free, Pro, BusinessEU option: Enterprise |
| Training on inputs | opt-out available: Free, Pro, Pro+, Maxnot documented: Studentno: Business, Enterprise | opt-out available: Free, Prono: Business, Enterprise |
| DPA | not documented: Free, Student, Pro, Pro+, Maxyes: Business, Enterprise | no: Free, Proyes: Business, Enterprise |
| As of | 18 Oct 2026 | 18 Oct 2026 |
Plans compared
Comparing: GitHub Copilot Business vs. Lovable Business
| Feature | GitHub CopilotBusiness | LovableBusiness |
|---|---|---|
| yes | yes | |
| Details: DPA available | yes: Copilot is covered by the GitHub Data Protection Agreement, which applies to all generally available (GA) Copilot features and the previews listed in 'GitHub DPA-Covered Previews' (q8); GitHub and customers 'can enter a Data Protection Agreement that supports compliance with the GDPR' (q1). For purchases directly from GitHub, the GitHub Generative AI Services Terms apply; for purchases via Microsoft, the Microsoft Product Terms apply (q8). Provider’s DPA | yes (DPA included in the plan; signed version available for download) Provider’s DPA |
| no | no | |
| Details: Training on inputs | "No. GitHub does not use either Copilot Business or Enterprise data to train its models." (q1); q3: "GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models." Third-party models: according to q3, OpenAI, among others, "do not train models on customer business data", Google/Gemini does not use prompts for training, zero data retention agreements with OpenAI, Anthropic, xAI and Fireworks AI (details per provider in q3). q14: "Copilot Business and Copilot Enterprise customers' data is protected under GitHub's Data Protection Agreement, which prohibits such use without customer authorization." | Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention. |
| differs by plan | EU option | mixed |
| Details: Data residency | Default on github.com: storage in the USA (q7). EU data residency via GitHub Enterprise Cloud with GHE.com: Copilot Business or Enterprise can be assigned there (q7). With the policy 'Restrict Copilot to data residency compliant models', according to q6, 'all inference processing and associated data' remain in the selected region (EU or USA); policy disabled by default, additional consumption +10 % AI Credits (q6). Without this policy, according to q5, Copilot data and logs are 'by default stored outside your region'. Inline suggestions: models hosted on Azure (q3). | Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Business: administrators can set a mandatory default region for new projects. |
| list available | list available | |
| Details: List published |
|
|
| differs by plan | Default settings according to q1: access… | Privacy Policy |
| Details: Data retention | Default settings according to q1: access via IDE (chat and code completions): prompts and suggestions "Not retained"; User Engagement Data two years; Feedback Data "as long as needed for its intended purpose". All other access routes (including github.com, Mobile, CLI): prompts and suggestions 28 days; User Engagement Data two years. DPA (October 2025 version), Section 8: after the end of the services, GitHub deletes the Customer Personal Data or returns it at the customer's choice and deletes existing copies "in accordance with our retention and deletion policy" (q13). Unlike q1, the Copilot Trust Center FAQ (q16) assigns Copilot CLI to IDE access: inputs and outputs "Not retained by default" (exception: time-limited retention in the event of confirmed violations of the Acceptable Use Policies or Terms of Service); other access: "Retained for up to 28 days by default". | Privacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months. |
| differs by plan | 19 USD/user/mo | several tiers |
| Details: Price | 19 USD per assigned seat/month (q2) | 50 EUR per month with monthly payment or 42 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 30 USD per 50 credits (0.60 USD per credit); plan credit rate 0.50 USD per credit (Docs) |
| yes | yes | |
| Details: AI features included | yes (1,900 AI Credits per user/month, access to premium models; q2) | yes (additional governance and team features; top-up USD 30 per 50 credits) |
| 11 sources | 12 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- GitHub Copilot Businessyes
- Lovable Businessyes
- GitHub Copilot Business
yes: Copilot is covered by the GitHub Data Protection Agreement, which applies to all generally available (GA) Copilot features and the previews listed in 'GitHub DPA-Covered Previews' (q8); GitHub and customers 'can enter a Data Protection Agreement that supports compliance with the GDPR' (q1). For purchases directly from GitHub, the GitHub Generative AI Services Terms apply; for purchases via Microsoft, the Microsoft Product Terms apply (q8).
Provider’s DPA
Training
- GitHub Copilot Businessno
- Lovable Businessno
- GitHub Copilot Business
"No. GitHub does not use either Copilot Business or Enterprise data to train its models." (q1); q3: "GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models." Third-party models: according to q3, OpenAI, among others, "do not train models on customer business data", Google/Gemini does not use prompts for training, zero data retention agreements with OpenAI, Anthropic, xAI and Fireworks AI (details per provider in q3). q14: "Copilot Business and Copilot Enterprise customers' data is protected under GitHub's Data Protection Agreement, which prohibits such use without customer authorization."
Lovable BusinessPrivacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention.
Hosting
- differs by plan
- GitHub Copilot BusinessEU option
- Lovable Businessmixed
- GitHub Copilot Business
Default on github.com: storage in the USA (q7). EU data residency via GitHub Enterprise Cloud with GHE.com: Copilot Business or Enterprise can be assigned there (q7). With the policy 'Restrict Copilot to data residency compliant models', according to q6, 'all inference processing and associated data' remain in the selected region (EU or USA); policy disabled by default, additional consumption +10 % AI Credits (q6). Without this policy, according to q5, Copilot data and logs are 'by default stored outside your region'. Inline suggestions: models hosted on Azure (q3).
Lovable BusinessDocs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Business: administrators can set a mandatory default region for new projects.
Sub-processors
- GitHub Copilot Businesslist available
- Lovable Businesslist available
- GitHub Copilot Business
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- GitHub subsidiaries as per the list: GitHub Australia Pty Ltd, GitHub BV (NL), GitHub Canada ULC, GitHub Germany GmbH, GitHub India Pty Ltd, npm Inc, Semmle Inc
Lovable Business- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
Retention
- differs by plan
- GitHub Copilot BusinessDefault settings according to q1: access…
- Lovable BusinessPrivacy Policy
- GitHub Copilot BusinessDefault settings according to q1: access via IDE (chat and code completions): prompts and suggestions "Not retained"; User Engagement Data two years; Feedback Data "as long as needed for its intended purpose". All other access routes (including github.com, Mobile, CLI): prompts and suggestions 28 days; User Engagement Data two years. DPA (October 2025 version), Section 8: after the end of the services, GitHub deletes the Customer Personal Data or returns it at the customer's choice and deletes existing copies "in accordance with our retention and deletion policy" (q13). Unlike q1, the Copilot Trust Center FAQ (q16) assigns Copilot CLI to IDE access: inputs and outputs "Not retained by default" (exception: time-limited retention in the event of confirmed violations of the Acceptable Use Policies or Terms of Service); other access: "Retained for up to 28 days by default".Lovable BusinessPrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
Price
- differs by plan
- GitHub Copilot Business19 USD/user/mo
- Lovable Businessseveral tiers
- GitHub Copilot Business
19 USD per assigned seat/month (q2)
Lovable Business50 EUR per month with monthly payment or 42 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 30 USD per 50 credits (0.60 USD per credit); plan credit rate 0.50 USD per credit (Docs)
- GitHub Copilot Businessyes
- Lovable Businessyes
- GitHub Copilot Business
yes (1,900 AI Credits per user/month, access to premium models; q2)
Lovable Businessyes (additional governance and team features; top-up USD 30 per 50 credits)
Evidence
- GitHub Copilot Business11 sources
- Lovable Business12 sources
- GitHub Copilot Business
- GitHub Copilot: Plans & pricing incl. FAQ (Privacy, Retention, Training)Pricing page / provider FAQ, retrieved 18 Oct 2026
- Plans for GitHub Copilot (GitHub Docs)Official documentation, retrieved 14 Oct 2026
- Hosting of models for GitHub Copilot (GitHub Docs)Official documentation, retrieved 18 Oct 2026
- GitHub SubprocessorsSub-processor list, retrieved 14 Oct 2026
- About storage of your data with data residency (GHE.com)Official documentation, retrieved 14 Oct 2026
- GitHub Copilot with data residencyOfficial documentation, retrieved 14 Oct 2026
- About GitHub Enterprise Cloud with data residencyOfficial documentation, retrieved 14 Oct 2026
- Resources for getting approval of GitHub CopilotOfficial documentation, retrieved 14 Oct 2026
- GitHub Data Protection Agreement (DPA), version October 2025DPA, retrieved 14 Oct 2026
- Managing GitHub Copilot policies as an individual subscriber (GitHub Docs)Documentation, retrieved 18 Oct 2026
- GitHub Copilot Trust Center: FAQ (Privacy, Security, Commercial)Trust Center / provider FAQ, retrieved 18 Oct 2026
Lovable Business- Pricing (German version, plan cards read in the browser)Pricing page, retrieved 18 Oct 2026
- Docs: Plans and creditsDocumentation, retrieved 14 Oct 2026
- SecurityTrust Center, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-09-15)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2025-11-06)DPA, retrieved 14 Oct 2026
- Subprocessors (as of 2026-01-14; refers to the Trust Center)Sub-processor list, retrieved 14 Oct 2026
- Lovable's Trust CenterTrust Center, retrieved 18 Oct 2026
- Trust Center: Subprocessors (44 entries)Sub-processor list, retrieved 18 Oct 2026
- Docs: Lovable Cloud (Region selection)Documentation, retrieved 18 Oct 2026
- Docs: Manage training data and privacyDocumentation, retrieved 18 Oct 2026
- Docs: Privacy & security settingsDocumentation, retrieved 18 Oct 2026
- Docs: Delete a projectDocumentation, retrieved 18 Oct 2026
| Feature | GitHub Copilot | Lovable |
|---|---|---|
| differs by tool |
|
|
| Details: DPA available |
|
|
| differs by tool |
|
|
| Details: Training on inputs |
|
|
|
| |
| Details: Data residency |
|
|
| list availableall 7 plans | list availableall 4 plans | |
| Details: List published |
|
|
| differs by tool |
| Privacy Policyall 4 plans |
| Details: Data retention |
|
|
| differs by tool |
|
|
| Details: Price |
|
|
| yesall 7 plans | yesall 4 plans | |
| Details: AI features included |
|
|
| 13 sources | 13 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by tool
- GitHub Copilot
- not publicly documentedFree, Student, Pro, Pro+, Max
- yesBusiness, Enterprise
- Lovable
- noFree, Pro
- yesBusiness, Enterprise
- GitHub Copilot
- Free
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Student
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Pro
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Pro+
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Max
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Business
yes: Copilot is covered by the GitHub Data Protection Agreement, which applies to all generally available (GA) Copilot features and the previews listed in 'GitHub DPA-Covered Previews' (q8); GitHub and customers 'can enter a Data Protection Agreement that supports compliance with the GDPR' (q1). For purchases directly from GitHub, the GitHub Generative AI Services Terms apply; for purchases via Microsoft, the Microsoft Product Terms apply (q8).
Provider’s DPA - Enterprise
yes: as Business (GitHub Data Protection Agreement for GA features and listed DPA previews; q8, q1).
Provider’s DPA
Lovable- Free
no (DPA page: applies to Business and Enterprise plans)
- Pro
no (DPA page: applies to Business and Enterprise plans)
- Business
yes (DPA included in the plan; signed version available for download)
Provider’s DPA - Enterprise
yes (DPA included in the plan)
Provider’s DPA
- Free
Training
- differs by tool
- GitHub Copilot
- opt-out availableFree, Pro, Pro+, Max
- not publicly documentedStudent
- noBusiness, Enterprise
- Lovable
- opt-out availableFree, Pro
- noBusiness, Enterprise
- GitHub Copilot
- Free
GitHub Docs "Managing Copilot policies as an individual subscriber" (q14): "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services—including inputs, outputs, code snippets, and associated context—to train and improve AI models." Opt-out via the setting "Allow GitHub to use my data for AI model training" = Disabled (q14) or https://github.com/settings/copilot/features: "Individual subscribers can opt out of having their data used for AI model training at any time." (q1). q3: the same applies to Copilot Free, Pro, Pro+ and Max "in accordance with our GitHub General Privacy Statement and applicable user settings".
- Student
q1, q3 and q14 expressly state the training rule for Copilot Free, Pro, Pro+ and Max (q14: "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan ..."). Copilot Student is not mentioned in these sentences; the retrieved primary sources contain no separate statement on Student. The Copilot Trust Center FAQ (q16) likewise states the training rule only for "Individual (Free/Pro/Pro+/Max) Subscribers"; the documentation page on Copilot Student (q17) contains no statement on training.
- Pro
GitHub Docs "Managing Copilot policies as an individual subscriber" (q14): "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services—including inputs, outputs, code snippets, and associated context—to train and improve AI models." Opt-out via the setting "Allow GitHub to use my data for AI model training" = Disabled (q14) or https://github.com/settings/copilot/features: "Individual subscribers can opt out of having their data used for AI model training at any time." (q1). q3: the same applies to Copilot Free, Pro, Pro+ and Max "in accordance with our GitHub General Privacy Statement and applicable user settings".
- Pro+
GitHub Docs "Managing Copilot policies as an individual subscriber" (q14): "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services—including inputs, outputs, code snippets, and associated context—to train and improve AI models." Opt-out via the setting "Allow GitHub to use my data for AI model training" = Disabled (q14) or https://github.com/settings/copilot/features: "Individual subscribers can opt out of having their data used for AI model training at any time." (q1). q3: the same applies to Copilot Free, Pro, Pro+ and Max "in accordance with our GitHub General Privacy Statement and applicable user settings".
- Max
GitHub Docs "Managing Copilot policies as an individual subscriber" (q14): "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services—including inputs, outputs, code snippets, and associated context—to train and improve AI models." Opt-out via the setting "Allow GitHub to use my data for AI model training" = Disabled (q14) or https://github.com/settings/copilot/features: "Individual subscribers can opt out of having their data used for AI model training at any time." (q1). q3: the same applies to Copilot Free, Pro, Pro+ and Max "in accordance with our GitHub General Privacy Statement and applicable user settings".
- Business
"No. GitHub does not use either Copilot Business or Enterprise data to train its models." (q1); q3: "GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models." Third-party models: according to q3, OpenAI, among others, "do not train models on customer business data", Google/Gemini does not use prompts for training, zero data retention agreements with OpenAI, Anthropic, xAI and Fireworks AI (details per provider in q3). q14: "Copilot Business and Copilot Enterprise customers' data is protected under GitHub's Data Protection Agreement, which prohibits such use without customer authorization."
- Enterprise
"GitHub does not use either Copilot Business or Enterprise data to train its models." (q1, q3). q14: "Copilot Business and Copilot Enterprise customers' data is protected under GitHub's Data Protection Agreement, which prohibits such use without customer authorization."
Lovable- Free
Privacy Policy (as of 2026-09-15): Lovable uses Customer Content and Usage Data to train, develop and improve its own AI models; no training on account/billing data or on data of end users of the apps created. Staff may view content for quality review. Contracts with third-party model providers restrict their use for training and retention. Docs 'Manage training data and privacy': since 2026-09-09, customer data from Free and Pro (prompts including attachments, code, project files, outputs, usage data) may be used for training 'unless you opt out'; opt-out at any time and free of charge via the toggle 'Use my Lovable content for model training' (Account settings → Preferences → AI model training), effective only for training data assembled in the future.
- Pro
Privacy Policy (as of 2026-09-15): Lovable uses Customer Content and Usage Data to train, develop and improve its own AI models; no training on account/billing data or on data of end users of the apps created. Staff may view content for quality review. Contracts with third-party model providers restrict their use for training and retention. Docs 'Manage training data and privacy': since 2026-09-09, customer data from Free and Pro (prompts including attachments, code, project files, outputs, usage data) may be used for training 'unless you opt out'; opt-out at any time and free of charge via the toggle 'Use my Lovable content for model training' (Account settings → Preferences → AI model training), effective only for training data assembled in the future.
- Business
Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention.
- Enterprise
Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention. Enterprise: setting 'Extended-retention models' (default: disabled); unless enabled, the workspace uses only zero-data-retention models; according to the docs, retained data is never used for model training.
- Free
Hosting
- GitHub Copilot
- mixedFree, Student, Pro, Pro+, Max
- EU optionBusiness, Enterprise
- Lovable
- mixedFree, Pro, Business
- EU optionEnterprise
- GitHub Copilot
- Free
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Student
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Pro
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Pro+
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Max
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Business
Default on github.com: storage in the USA (q7). EU data residency via GitHub Enterprise Cloud with GHE.com: Copilot Business or Enterprise can be assigned there (q7). With the policy 'Restrict Copilot to data residency compliant models', according to q6, 'all inference processing and associated data' remain in the selected region (EU or USA); policy disabled by default, additional consumption +10 % AI Credits (q6). Without this policy, according to q5, Copilot data and logs are 'by default stored outside your region'. Inline suggestions: models hosted on Azure (q3).
- Enterprise
As Business: default USA (q7); EU data residency via GHE.com with the policy 'Restrict Copilot to data residency compliant models' (q6, q5). q6 lists models of the GPT and Claude series for the EU; according to q6, model availability per region changes continuously. Not all Copilot features are available on GHE.com (q7).
Lovable- Free
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global).
- Pro
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global).
- Business
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Business: administrators can set a mandatory default region for new projects.
- Enterprise
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Enterprise: mandatory default region for new projects; 'EU inference' (Enterprise only) sends all AI requests to model endpoints in the EU, requests without an EU endpoint fail; country-specific regions on request.
- Free
Sub-processors
- GitHub Copilotlist availableall 7 plans
- Lovablelist availableall 4 plans
- GitHub Copilot
- Free
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Student
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Pro
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Pro+
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Max
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Business
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- GitHub subsidiaries as per the list: GitHub Australia Pty Ltd, GitHub BV (NL), GitHub Canada ULC, GitHub Germany GmbH, GitHub India Pty Ltd, npm Inc, Semmle Inc
- Enterprise
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- GitHub subsidiaries as per the list: GitHub Australia Pty Ltd, GitHub BV (NL), GitHub Canada ULC, GitHub Germany GmbH, GitHub India Pty Ltd, npm Inc, Semmle Inc
Lovable- Free
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Pro
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Business
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Enterprise
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Free
Retention
- differs by tool
- GitHub Copilot
- not publicly documentedFree, Student, Pro, Pro+, Max
- Default settings according to q1: access…Business, Enterprise
- LovablePrivacy Policyall 4 plans
- GitHub Copilot
- Freenot publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- Studentnot publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- Pronot publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- Pro+not publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- Maxnot publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- BusinessDefault settings according to q1: access via IDE (chat and code completions): prompts and suggestions "Not retained"; User Engagement Data two years; Feedback Data "as long as needed for its intended purpose". All other access routes (including github.com, Mobile, CLI): prompts and suggestions 28 days; User Engagement Data two years. DPA (October 2025 version), Section 8: after the end of the services, GitHub deletes the Customer Personal Data or returns it at the customer's choice and deletes existing copies "in accordance with our retention and deletion policy" (q13). Unlike q1, the Copilot Trust Center FAQ (q16) assigns Copilot CLI to IDE access: inputs and outputs "Not retained by default" (exception: time-limited retention in the event of confirmed violations of the Acceptable Use Policies or Terms of Service); other access: "Retained for up to 28 days by default".
- EnterpriseDefault settings according to q1: access via IDE (chat and code completions): prompts and suggestions "Not retained"; User Engagement Data two years; Feedback Data "as long as needed for its intended purpose". All other access routes (including github.com, Mobile, CLI): prompts and suggestions 28 days; User Engagement Data two years. DPA (October 2025 version), Section 8: after the end of the services, GitHub deletes the Customer Personal Data or returns it at the customer's choice and deletes existing copies "in accordance with our retention and deletion policy" (q13). Unlike q1, the Copilot Trust Center FAQ (q16) assigns Copilot CLI to IDE access: inputs and outputs "Not retained by default" (exception: time-limited retention in the event of confirmed violations of the Acceptable Use Policies or Terms of Service); other access: "Retained for up to 28 days by default".
Lovable- FreePrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
- ProPrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
- BusinessPrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
- EnterprisePrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months. Enterprise: if 'Extended-retention models' are enabled, model providers retain prompts and outputs for at least 30 days, content flagged by safety systems or subject to a legal hold for up to 2 years.
Price
- differs by tool
- GitHub Copilot
- 0 USDFree, Student
- 10 USD/moPro
- 39 USD/moPro+
- 100 USD/moMax
- 19 USD/user/moBusiness
- 39 USD/user/moEnterprise
- Lovable
- 0 EUR/moFree
- several tiersPro, Business
- customEnterprise
- GitHub Copilot
- Free
0 USD (q2)
- Student
0 USD for verified students (q2)
- Pro
10 USD/month (q2; free of charge for some user groups)
- Pro+
39 USD/month (q2)
- Max
100 USD/month (q2)
- Business
19 USD per assigned seat/month (q2)
- Enterprise
39 USD per assigned seat/month (q2)
Lovable- Free
0 EUR per month (pricing page, German version; without stating whether VAT is included)
- Pro
25 EUR per month with monthly payment or 21 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 15 USD per 50 credits (0.30 USD per credit); plan credit rate 0.25 USD per credit (Docs)
- Business
50 EUR per month with monthly payment or 42 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 30 USD per 50 credits (0.60 USD per credit); plan credit rate 0.50 USD per credit (Docs)
- Enterprise
Custom (pricing page: platform fee and volume-based pricing)
- Free
- GitHub Copilotyesall 7 plans
- Lovableyesall 4 plans
- GitHub Copilot
- Free
yes (limited: according to q2, an allowance of GitHub AI Credits, automatic model selection; according to q1, 2000 completions and 50 chat requests)
- Student
yes (allowance of GitHub AI Credits, automatic model selection, without third-party agents; q2)
- Pro
yes (base 1,000 AI Credits; q2)
- Pro+
yes (base 3,900 AI Credits, access to premium models; q2)
- Max
yes (base 10,000 AI Credits, priority access to premium models; q2)
- Business
yes (1,900 AI Credits per user/month, access to premium models; q2)
- Enterprise
yes (3,900 AI Credits per user/month, priority access to premium models; q2; requires GitHub Enterprise Cloud)
Lovable- Free
yes (5 daily build credits, up to 30 per month; 20 cloud credits and 4 credits for AI features in the apps created each month)
- Pro
yes (from 100 subscription credits per month; additionally daily build credits, cloud grant, AI grant; top-up USD 15 per 50 credits)
- Business
yes (additional governance and team features; top-up USD 30 per 50 credits)
- Enterprise
yes (volume-based credit pricing, SSO/SAML/OIDC, SCIM)
- Free
Evidence
- GitHub Copilot13 sources
- Lovable13 sources
- GitHub Copilot
- GitHub Copilot: Plans & pricing incl. FAQ (Privacy, Retention, Training)Pricing page / provider FAQ, retrieved 18 Oct 2026
- Plans for GitHub Copilot (GitHub Docs)Official documentation, retrieved 14 Oct 2026
- Hosting of models for GitHub Copilot (GitHub Docs)Official documentation, retrieved 18 Oct 2026
- GitHub SubprocessorsSub-processor list, retrieved 14 Oct 2026
- About storage of your data with data residency (GHE.com)Official documentation, retrieved 14 Oct 2026
- GitHub Copilot with data residencyOfficial documentation, retrieved 14 Oct 2026
- About GitHub Enterprise Cloud with data residencyOfficial documentation, retrieved 14 Oct 2026
- Resources for getting approval of GitHub CopilotOfficial documentation, retrieved 14 Oct 2026
- GitHub General Privacy Statement (effective 2026-04-27)Privacy notices, retrieved 14 Oct 2026
- GitHub Data Protection Agreement (DPA), version October 2025DPA, retrieved 14 Oct 2026
- Managing GitHub Copilot policies as an individual subscriber (GitHub Docs)Documentation, retrieved 18 Oct 2026
- GitHub Copilot Trust Center: FAQ (Privacy, Security, Commercial)Trust Center / provider FAQ, retrieved 18 Oct 2026
- Access GitHub Copilot for free as a student (GitHub Docs)Official documentation, retrieved 18 Oct 2026
Lovable- Pricing (German version, plan cards read in the browser)Pricing page, retrieved 18 Oct 2026
- Docs: Plans and creditsDocumentation, retrieved 14 Oct 2026
- SecurityTrust Center, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-09-15)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2025-11-06)DPA, retrieved 14 Oct 2026
- Subprocessors (as of 2026-01-14; refers to the Trust Center)Sub-processor list, retrieved 14 Oct 2026
- Lovable's Trust CenterTrust Center, retrieved 18 Oct 2026
- Trust Center: Subprocessors (44 entries)Sub-processor list, retrieved 18 Oct 2026
- Docs: Lovable Cloud (Region selection)Documentation, retrieved 18 Oct 2026
- Docs: EU inferenceDocumentation, retrieved 18 Oct 2026
- Docs: Manage training data and privacyDocumentation, retrieved 18 Oct 2026
- Docs: Privacy & security settingsDocumentation, retrieved 18 Oct 2026
- Docs: Delete a projectDocumentation, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
No guarantee of accuracy, not legal advice. Each entry is valid as of the date shown. Open points are listed on the detail pages.
More comparisons
GitHub Copilot compared with
Individual pages: GitHub Copilot, Lovable. All tools in the category: Software development.