Lovable vs. Windsurf: data protection per plan
Lovable (4 plans) and Windsurf (5 plans) side by side: DPA, training on inputs, hosting and data retention per plan, based on the providers’ public documents. Without rating.
Last updated: (latest review date of the tools shown)
At a glance
Each value is listed with the plans it applies to. Pick a tier to see only plans of that tier; if plans are chosen in the plan comparison below, the table shows exactly those.
All plans: each value is listed with the plans it applies to.
| Feature | Lovable | Windsurf |
|---|---|---|
| Provider based in | Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden | Cognition AI, Inc., 550 Third Street, San Francisco, CA 94107, USA |
| Plans recorded | 4 | 5 |
| Hosting | mixed: Free, Pro, BusinessEU option: Enterprise | US only: Free, Pro, Max, Teamsnot documented: Enterprise |
| Training on inputs | opt-out available: Free, Prono: Business, Enterprise | yes: Freeopt-out available: Pro, Max, Teamsno: Enterprise |
| DPA | no: Free, Proyes: Business, Enterprise | yes: all 5 plans |
| As of | 18 Oct 2026 | 18 Oct 2026 |
Plans compared
Comparing: Lovable Business vs. Windsurf Teams
| Feature | LovableBusiness | WindsurfTeams |
|---|---|---|
| yes | yes | |
| Details: DPA available | yes (DPA included in the plan; signed version available for download) Provider’s DPA | yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum) Provider’s DPA |
| differs by plan | no | opt-out available |
| Details: Training on inputs | Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention. | Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law. |
| differs by plan | mixed | US only |
| Details: Data residency | Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Business: administrators can set a mandatory default region for new projects. | DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented. |
| list available | list available | |
| Details: List published |
|
|
| differs by plan | Privacy Policy | DPA |
| Details: Data retention | Privacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months. | DPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented. |
| differs by plan | several tiers | 80 USD/mo… (further prices in the details) |
| Details: Price | 50 EUR per month with monthly payment or 42 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 30 USD per 50 credits (0.60 USD per credit); plan credit rate 0.50 USD per credit (Docs) | 80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users. |
| yes | yes | |
| Details: AI features included | yes (additional governance and team features; top-up USD 30 per 50 credits) | yes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products) |
| 12 sources | 6 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- Lovable Businessyes
- Windsurf Teamsyes
- Windsurf Teams
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA
Training
- differs by plan
- Lovable Businessno
- Windsurf Teamsopt-out available
- Lovable Business
Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention.
Windsurf TeamsPlatform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
Hosting
- differs by plan
- Lovable Businessmixed
- Windsurf TeamsUS only
- Lovable Business
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Business: administrators can set a mandatory default region for new projects.
Windsurf TeamsDPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
Sub-processors
- Lovable Businesslist available
- Windsurf Teamslist available
- Lovable Business
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
Windsurf Teams- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
Retention
- differs by plan
- Lovable BusinessPrivacy Policy
- Windsurf TeamsDPA
- Lovable BusinessPrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.Windsurf TeamsDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
Price
- differs by plan
- Lovable Businessseveral tiers
- Windsurf Teams80 USD/mo… (further prices in the details)
- Lovable Business
50 EUR per month with monthly payment or 42 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 30 USD per 50 credits (0.60 USD per credit); plan credit rate 0.50 USD per credit (Docs)
Windsurf Teams80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users.
- Lovable Businessyes
- Windsurf Teamsyes
- Lovable Business
yes (additional governance and team features; top-up USD 30 per 50 credits)
Windsurf Teamsyes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products)
Evidence
- Lovable Business12 sources
- Windsurf Teams6 sources
- Lovable Business
- Pricing (German version, plan cards read in the browser)Pricing page, retrieved 18 Oct 2026
- Docs: Plans and creditsDocumentation, retrieved 14 Oct 2026
- SecurityTrust Center, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-09-15)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2025-11-06)DPA, retrieved 14 Oct 2026
- Subprocessors (as of 2026-01-14; refers to the Trust Center)Sub-processor list, retrieved 14 Oct 2026
- Lovable's Trust CenterTrust Center, retrieved 18 Oct 2026
- Trust Center: Subprocessors (44 entries)Sub-processor list, retrieved 18 Oct 2026
- Docs: Lovable Cloud (Region selection)Documentation, retrieved 18 Oct 2026
- Docs: Manage training data and privacyDocumentation, retrieved 18 Oct 2026
- Docs: Privacy & security settingsDocumentation, retrieved 18 Oct 2026
- Docs: Delete a projectDocumentation, retrieved 18 Oct 2026
Windsurf Teams- Plans and Pricing (windsurf.com/pricing redirects here)Pricing page, retrieved 18 Oct 2026
- Docs: Devin Desktop FAQ (transition from Windsurf)Documentation, retrieved 18 Oct 2026
- Platform Terms of Service (Last updated: 2026-06-30)Terms and conditions, retrieved 18 Oct 2026
- Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C)DPA, retrieved 18 Oct 2026
- Privacy Policy (Last updated: 2026-03-09)Privacy notice, retrieved 18 Oct 2026
- Docs: Security at Cognition (windsurf.com/security redirects here)Documentation, retrieved 18 Oct 2026
| Feature | Lovable | Windsurf |
|---|---|---|
| differs by tool |
| yesall 5 plans |
| Details: DPA available |
|
|
| differs by tool |
|
|
| Details: Training on inputs |
|
|
| differs by tool |
|
|
| Details: Data residency |
|
|
| list availableall 4 plans | list availableall 5 plans | |
| Details: List published |
|
|
| differs by tool | Privacy Policyall 4 plans | DPAall 5 plans |
| Details: Data retention |
|
|
| differs by tool |
|
|
| Details: Price |
|
|
| yesall 4 plans | yesall 5 plans | |
| Details: AI features included |
|
|
| 13 sources | 8 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by tool
- Lovable
- noFree, Pro
- yesBusiness, Enterprise
- Windsurfyesall 5 plans
- Lovable
- Free
no (DPA page: applies to Business and Enterprise plans)
- Pro
no (DPA page: applies to Business and Enterprise plans)
- Business
yes (DPA included in the plan; signed version available for download)
Provider’s DPA - Enterprise
yes (DPA included in the plan)
Provider’s DPA
Windsurf- Free
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Pro
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Max
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Teams
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Enterprise
yes (Enterprise Terms 4.3: the Data Processing Addendum at cognition.com/dpa is incorporated into the agreement; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA
- Free
Training
- differs by tool
- Lovable
- opt-out availableFree, Pro
- noBusiness, Enterprise
- Windsurf
- yesFree
- opt-out availablePro, Max, Teams
- noEnterprise
- Lovable
- Free
Privacy Policy (as of 2026-09-15): Lovable uses Customer Content and Usage Data to train, develop and improve its own AI models; no training on account/billing data or on data of end users of the apps created. Staff may view content for quality review. Contracts with third-party model providers restrict their use for training and retention. Docs 'Manage training data and privacy': since 2026-09-09, customer data from Free and Pro (prompts including attachments, code, project files, outputs, usage data) may be used for training 'unless you opt out'; opt-out at any time and free of charge via the toggle 'Use my Lovable content for model training' (Account settings → Preferences → AI model training), effective only for training data assembled in the future.
- Pro
Privacy Policy (as of 2026-09-15): Lovable uses Customer Content and Usage Data to train, develop and improve its own AI models; no training on account/billing data or on data of end users of the apps created. Staff may view content for quality review. Contracts with third-party model providers restrict their use for training and retention. Docs 'Manage training data and privacy': since 2026-09-09, customer data from Free and Pro (prompts including attachments, code, project files, outputs, usage data) may be used for training 'unless you opt out'; opt-out at any time and free of charge via the toggle 'Use my Lovable content for model training' (Account settings → Preferences → AI model training), effective only for training data assembled in the future.
- Business
Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention.
- Enterprise
Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention. Enterprise: setting 'Extended-retention models' (default: disabled); unless enabled, the workspace uses only zero-data-retention models; according to the docs, retained data is never used for model training.
Windsurf- Free
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. An opt-out is only available on paid plans ("If you subscribe to a paid Service Tier, you may opt out of this use"); no opt-out is documented for Free. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Pro
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Max
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Teams
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Enterprise
Enterprise Terms (as of 2026-06-08) 3.3: Cognition does not use, or permit any third party to use, Customer Data to train AI models without the customer's express prior written consent; Usage Data may be used for internal analytics. Documentation: "If you are an Enterprise customer, we will never train on your data without your express prior written consent." DPA (as of 2026-07-23) section 4: sub-processors are subject to equivalent restrictions.
- Free
Hosting
- differs by tool
- Lovable
- mixedFree, Pro, Business
- EU optionEnterprise
- Windsurf
- US onlyFree, Pro, Max, Teams
- not publicly documentedEnterprise
- Lovable
- Free
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global).
- Pro
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global).
- Business
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Business: administrators can set a mandatory default region for new projects.
- Enterprise
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Enterprise: mandatory default region for new projects; 'EU inference' (Enterprise only) sends all AI requests to model endpoints in the EU, requests without an EU endpoint fail; country-specific regions on request.
Windsurf- Free
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Pro
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Max
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Teams
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Enterprise
Standard SaaS according to DPA Appendix C (as of 2026-07-23) with sub-processors in the United States, support workflow in India. Pricing page: Enterprise with "Dedicated deployment option" and deployment in the customer's own VPC; documentation: FedRAMP deployment on AWS GovCloud. Regions of the dedicated or VPC deployment not publicly documented; an EU region is not documented.
- Free
Sub-processors
- Lovablelist availableall 4 plans
- Windsurflist availableall 5 plans
- Lovable
- Free
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Pro
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Business
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
- Enterprise
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
Windsurf- Free
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Pro
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Max
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Teams
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Enterprise
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Free
Retention
- differs by tool
- LovablePrivacy Policyall 4 plans
- WindsurfDPAall 5 plans
- Lovable
- FreePrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
- ProPrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
- BusinessPrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
- EnterprisePrivacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months. Enterprise: if 'Extended-retention models' are enabled, model providers retain prompts and outputs for at least 30 days, content flagged by safety systems or subject to a legal hold for up to 2 years.
Windsurf- FreeDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Without opt-out, ZDR with model providers is not committed; specific retention periods for prompts and code not publicly documented.
- ProDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- MaxDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- TeamsDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- EnterpriseDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Specific retention periods for prompts and code in Enterprise agreements not publicly documented.
Price
- differs by tool
- Lovable
- 0 EUR/moFree
- several tiersPro, Business
- customEnterprise
- Windsurf
- 0 USD/moFree
- 20 USD/moPro
- 200 USD/moMax
- 80 USD/mo… (further prices in the details)Teams
- customEnterprise
- Lovable
- Free
0 EUR per month (pricing page, German version; without stating whether VAT is included)
- Pro
25 EUR per month with monthly payment or 21 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 15 USD per 50 credits (0.30 USD per credit); plan credit rate 0.25 USD per credit (Docs)
- Business
50 EUR per month with monthly payment or 42 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 30 USD per 50 credits (0.60 USD per credit); plan credit rate 0.50 USD per credit (Docs)
- Enterprise
Custom (pricing page: platform fee and volume-based pricing)
Windsurf- Free
0 USD per month (pricing page)
- Pro
20 USD per month (pricing page, no information on taxes); extra usage at API pricing. Quotas refresh daily and weekly (FAQ).
- Max
200 USD per month (pricing page, no information on taxes); extra usage at API pricing.
- Teams
80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users.
- Enterprise
Price on request (pricing page: "Let's talk")
- Free
- Lovableyesall 4 plans
- Windsurfyesall 5 plans
- Lovable
- Free
yes (5 daily build credits, up to 30 per month; 20 cloud credits and 4 credits for AI features in the apps created each month)
- Pro
yes (from 100 subscription credits per month; additionally daily build credits, cloud grant, AI grant; top-up USD 15 per 50 credits)
- Business
yes (additional governance and team features; top-up USD 30 per 50 credits)
- Enterprise
yes (volume-based credit pricing, SSO/SAML/OIDC, SCIM)
Windsurf- Free
yes (light quota for agents, limited model availability, unlimited inline edits and Tab completions)
- Pro
yes (Free plus higher quotas with frontier models from OpenAI, Claude, Gemini and SpaceXAI as well as open-source models, full model availability, SWE-2, cloud agents (Devin Cloud), extra usage at API pricing)
- Max
yes (Pro plus significantly higher quotas)
- Teams
yes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products)
- Enterprise
yes (highest priority support, dedicated account management, SAML/OIDC SSO, centralised enterprise admin controls, teamspace isolation, dedicated deployment option or deployment in the customer's VPC, custom terms)
- Free
Evidence
- Lovable13 sources
- Windsurf8 sources
- Lovable
- Pricing (German version, plan cards read in the browser)Pricing page, retrieved 18 Oct 2026
- Docs: Plans and creditsDocumentation, retrieved 14 Oct 2026
- SecurityTrust Center, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-09-15)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2025-11-06)DPA, retrieved 14 Oct 2026
- Subprocessors (as of 2026-01-14; refers to the Trust Center)Sub-processor list, retrieved 14 Oct 2026
- Lovable's Trust CenterTrust Center, retrieved 18 Oct 2026
- Trust Center: Subprocessors (44 entries)Sub-processor list, retrieved 18 Oct 2026
- Docs: Lovable Cloud (Region selection)Documentation, retrieved 18 Oct 2026
- Docs: EU inferenceDocumentation, retrieved 18 Oct 2026
- Docs: Manage training data and privacyDocumentation, retrieved 18 Oct 2026
- Docs: Privacy & security settingsDocumentation, retrieved 18 Oct 2026
- Docs: Delete a projectDocumentation, retrieved 18 Oct 2026
Windsurf- Plans and Pricing (windsurf.com/pricing redirects here)Pricing page, retrieved 18 Oct 2026
- Docs: Devin Desktop FAQ (transition from Windsurf)Documentation, retrieved 18 Oct 2026
- Platform Terms of Service (Last updated: 2026-06-30)Terms and conditions, retrieved 18 Oct 2026
- Enterprise Terms of Service (Last updated: 2026-06-08)Terms and conditions, retrieved 18 Oct 2026
- Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C)DPA, retrieved 18 Oct 2026
- Privacy Policy (Last updated: 2026-03-09)Privacy notice, retrieved 18 Oct 2026
- Docs: Security at Cognition (windsurf.com/security redirects here)Documentation, retrieved 18 Oct 2026
- Docs: FedRAMP Security Admin Guide (Devin Desktop)Documentation, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
No guarantee of accuracy, not legal advice. Each entry is valid as of the date shown. Open points are listed on the detail pages.
More comparisons
Lovable compared with
Individual pages: Lovable, Windsurf. All tools in the category: Software development.