Lovable
Provider: Lovable Labs Sweden AB · Based in: Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden · Provider website
- Plans
- 4
- Sources
- 14
- As of
- 18 Oct
As of 18 Oct 2026. Based on our research on this date and the process described in the methodology. No guarantee of accuracy, not legal advice. The provider’s current documents take precedence. Found an error? Report a correction.
Incomplete. 4 points could not be verified in any provider source (see open points). This does not mean the matter is unproblematic; it means we have not checked it.
At a glance
- Hosting
- mixed: Free, Pro, BusinessEU option: Enterprise
- Training on inputs
- opt-out available: Free, Prono: Business, Enterprise
- DPA
- no: Free, Proyes: Business, Enterprise
- Provider
- Lovable Labs Sweden AB (controller according to the Privacy Policy); contracting party according to the Terms: Lovable Labs Incorporated
- Based in
- Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden (controller according to the Privacy Policy, q4; lead supervisory authority IMY). The Terms of Service name Lovable Labs Incorporated as the contracting party and Delaware law (q7)
Values from 4 plans, each listed with the plans it applies to. Details and evidence are in the plan table.
Compare Lovable
Compare with another toolCompared plan by plan with other tools in the category Software development:
Details per plan
Short values per plan. Click a feature to open the evidence and notes for all plans; sources with retrieval dates are under “Evidence”.
| Feature | FreeCompare Lovable Free with another tool | ProCompare Lovable Pro with another tool | BusinessCompare Lovable Business with another tool | EnterpriseCompare Lovable Enterprise with another tool |
|---|---|---|---|---|
| differs by plan | 0 EUR/mo | several tiers | several tiers | custom |
| Details: Price | 0 EUR per month (pricing page, German version; without stating whether VAT is included) | 25 EUR per month with monthly payment or 21 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 15 USD per 50 credits (0.30 USD per credit); plan credit rate 0.25 USD per credit (Docs) | 50 EUR per month with monthly payment or 42 EUR per month with annual billing (pricing page, German version; without stating whether VAT is included); 100 monthly credits, unlimited users; credit top-up 30 USD per 50 credits (0.60 USD per credit); plan credit rate 0.50 USD per credit (Docs) | Custom (pricing page: platform fee and volume-based pricing) |
| yes | yes | yes | yes | |
| Details: AI features included | yes (5 daily build credits, up to 30 per month; 20 cloud credits and 4 credits for AI features in the apps created each month) | yes (from 100 subscription credits per month; additionally daily build credits, cloud grant, AI grant; top-up USD 15 per 50 credits) | yes (additional governance and team features; top-up USD 30 per 50 credits) | yes (volume-based credit pricing, SSO/SAML/OIDC, SCIM) |
| differs by plan | no | no | yes | yes |
| Details: DPA | no (DPA page: applies to Business and Enterprise plans) | no (DPA page: applies to Business and Enterprise plans) | yes (DPA included in the plan; signed version available for download) Provider’s DPA | yes (DPA included in the plan) Provider’s DPA |
| differs by plan | opt-out available | opt-out available | no | no |
| Details: Training on inputs | Privacy Policy (as of 2026-09-15): Lovable uses Customer Content and Usage Data to train, develop and improve its own AI models; no training on account/billing data or on data of end users of the apps created. Staff may view content for quality review. Contracts with third-party model providers restrict their use for training and retention. Docs 'Manage training data and privacy': since 2026-09-09, customer data from Free and Pro (prompts including attachments, code, project files, outputs, usage data) may be used for training 'unless you opt out'; opt-out at any time and free of charge via the toggle 'Use my Lovable content for model training' (Account settings → Preferences → AI model training), effective only for training data assembled in the future. | Privacy Policy (as of 2026-09-15): Lovable uses Customer Content and Usage Data to train, develop and improve its own AI models; no training on account/billing data or on data of end users of the apps created. Staff may view content for quality review. Contracts with third-party model providers restrict their use for training and retention. Docs 'Manage training data and privacy': since 2026-09-09, customer data from Free and Pro (prompts including attachments, code, project files, outputs, usage data) may be used for training 'unless you opt out'; opt-out at any time and free of charge via the toggle 'Use my Lovable content for model training' (Account settings → Preferences → AI model training), effective only for training data assembled in the future. | Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention. | Privacy Policy (as of 2026-09-15): no training on Customer Content or Usage Data of Business and Enterprise customers (laid down in the DPA). Docs 'Manage training data and privacy': Business and Enterprise workspace data is 'excluded from model training by default'; the training toggle appears disabled if all of a user's workspaces are Business or Enterprise. Contracts with third-party model providers restrict their use for training and retention. Enterprise: setting 'Extended-retention models' (default: disabled); unless enabled, the workspace uses only zero-data-retention models; according to the docs, retained data is never used for model training. |
| Privacy Policy | Privacy Policy | Privacy Policy | Privacy Policy | |
| Details: Data retention | Privacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months. | Privacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months. | Privacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months. | Privacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months. Enterprise: if 'Extended-retention models' are enabled, model providers retain prompts and outputs for at least 30 days, content flagged by safety systems or subject to a legal hold for up to 2 years. |
| differs by plan | mixed | mixed | mixed | EU option |
| Details: Hosting | Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). | Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). | Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Business: administrators can set a mandatory default region for new projects. | Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global). Enterprise: mandatory default region for new projects; 'EU inference' (Enterprise only) sends all AI requests to model endpoints in the EU, requests without an EU endpoint fail; country-specific regions on request. |
| list available | list available | list available | list available | |
| Details: Sub-processors |
|
|
|
|
| differs by plan | 11 sources | 11 sources | 12 sources | 13 sources |
| Details: Sources with retrieval date |
|
|
|
|
Compare Lovable Free with another tool
Price and scope
- differs by plan
- 0 EUR/mo
0 EUR per month (pricing page, German version; without stating whether VAT is included)
- yes
yes (5 daily build credits, up to 30 per month; 20 cloud credits and 4 credits for AI features in the apps created each month)
Contract and data use
- differs by plan
- no
no (DPA page: applies to Business and Enterprise plans)
- differs by plan
- opt-out available
Privacy Policy (as of 2026-09-15): Lovable uses Customer Content and Usage Data to train, develop and improve its own AI models; no training on account/billing data or on data of end users of the apps created. Staff may view content for quality review. Contracts with third-party model providers restrict their use for training and retention. Docs 'Manage training data and privacy': since 2026-09-09, customer data from Free and Pro (prompts including attachments, code, project files, outputs, usage data) may be used for training 'unless you opt out'; opt-out at any time and free of charge via the toggle 'Use my Lovable content for model training' (Account settings → Preferences → AI model training), effective only for training data assembled in the future.
- Privacy Policy
- Privacy Policy (as of 2026-09-15): account and Customer Content are retained as long as the account exists and deleted or de-identified after closure or a verified deletion request; operational and security logs as long as needed for operation/security (longer during incident investigations); billing/tax data according to statutory periods. Docs 'Delete a project': deleted projects are kept for 60 days and can be restored, then permanently deleted (all plans). According to the pricing page, credits expire: monthly credits after 2 months, top-ups after 12 months.
Hosting and sharing
- differs by plan
- mixed
Docs 'Lovable Cloud': projects can be hosted in the Americas, Europe or Asia Pacific regions; the region is chosen per project when Cloud is enabled (default: closest region) and cannot be changed afterwards; no plan restriction is stated there. The region concerns storage, not AI processing; according to the sub-processor list, AI model providers are mostly in the USA (Azure AI Foundry also EU, Fireworks and Baseten global).
- list available
- Trust Center (44 entries; list last updated on 2026-10-02): infrastructure Google Cloud Platform (EU, Netherlands europe-west4), Amazon Web Services (UK London for storage, cache and secrets; US Oregon for Bedrock inference), Supabase (databases and authentication, EU by default), Cloudflare (global), Temporal (UK), Modal (execution of project code, global), Pierre (code repository, EU), GitHub (US), Turbopuffer (EU)
- AI models and services according to the Trust Center: Anthropic (US), OpenAI (US), Google Cloud Vertex/Gemini (US), Microsoft Azure AI Foundry (EU and US, for the AI Gateway), OpenRouter (US), Fireworks and Baseten (global), ElevenLabs, Perplexity, Firecrawl (US); Braintrust (LLM evaluation, stores prompts and responses, EU)
- Others according to the Trust Center (excerpt): Browserbase, Entri, Posthog, Rudderstack, Castle.io, Grafana, Sentry, Stripe, HubSpot, Customer.io, Mailgun, Intercom (US); ClickHouse, Altinity, Hex, Whitecircle.ai (EU); add-on providers (including Google Maps Platform, WhatsApp Business, Pipedrive) only if administrators enable the add-on service
- The Privacy Policy additionally names Meta and Google as advertising platforms
Evidence
- differs by plan
- 11 sources
- Pricing (German version, plan cards read in the browser)Pricing page, retrieved 18 Oct 2026
- Docs: Plans and creditsDocumentation, retrieved 14 Oct 2026
- SecurityTrust Center, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-09-15)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2025-11-06)DPA, retrieved 14 Oct 2026
- Subprocessors (as of 2026-01-14; refers to the Trust Center)Sub-processor list, retrieved 14 Oct 2026
- Lovable's Trust CenterTrust Center, retrieved 18 Oct 2026
- Trust Center: Subprocessors (44 entries)Sub-processor list, retrieved 18 Oct 2026
- Docs: Lovable Cloud (Region selection)Documentation, retrieved 18 Oct 2026
- Docs: Manage training data and privacyDocumentation, retrieved 18 Oct 2026
- Docs: Delete a projectDocumentation, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
Third-country transfers
Privacy Policy (as of 2026-09-15): processing in several countries including the USA; transfer bases: EU standard contractual clauses (Decision 2021/914) with transfer impact assessment, UK Addendum, Swiss addendum, for Brazil ANPD standard clauses; copy of the safeguards on request to privacy@lovable.dev. The DPA contains EU SCCs. The sub-processor list in the Trust Center shows locations: core infrastructure mostly EU/UK (GCP Netherlands, AWS London, Supabase EU by default), AI model providers mostly USA. The Trust Center lists a 'Transfer Impact Assessment' (not reviewed). Enterprise: 'EU inference' for AI requests. Transfer basis per sub-processor: not publicly documented.
- Privacy Policy (as of 2026-09-15) (Privacy notice), retrieved 14 Oct 2026
- Data Processing Agreement (as of 2025-11-06) (DPA), retrieved 14 Oct 2026
- Lovable's Trust Center (Trust Center), retrieved 18 Oct 2026
- Trust Center: Subprocessors (44 entries) (Sub-processor list), retrieved 18 Oct 2026
- Docs: EU inference (Documentation), retrieved 18 Oct 2026
Certifications (as stated by the provider)
The Trust Center (retrieved 2026-10-18) lists SOC 2 Type II, SOC 2 Type I, ISO 27001:2022 (document 'Certificate of Registration'), AIUC-1 and GDPR. Update of 2026-10-05: SOC 2 Type II audit completed for the observation period 2026-02-01 to 2026-08-01, report on request, according to the provider 'issued with no exceptions noted'. Update of 2026-07-27: AIUC-1 certification. Reports and certificate not reviewed. Security page: 'Lovable supports SOC 2 and GDPR requirements'.
- Security (Trust Center), retrieved 18 Oct 2026
- Lovable's Trust Center (Trust Center), retrieved 18 Oct 2026
AI Act
Functions: AI software engineer that generates websites and web apps via chat, including an AI gateway for AI features in the apps created and third-party models (pricing page, docs).
Provider’s statement: not publicly documented(no mention of the EU AI Act found in the Privacy Policy, security page and DPA). Terms: do not use AI outputs in high-risk contexts (medical, legal, financial, safety-critical) without appropriate review.
Classification (for review, not legal advice): For review: customer typically a deployer (Art. 3(4) AI Act). Which obligations apply depends on the specific intended use (check Annex III). Anyone who builds AI features into their own apps with Lovable may themselves be a provider or deployer. Not legal advice.
- Security (Trust Center), retrieved 18 Oct 2026
- Privacy Policy (as of 2026-09-15) (Privacy notice), retrieved 14 Oct 2026
- Terms of Service (as of 2026-08-28) (Terms and conditions), retrieved 14 Oct 2026
Current notes 2026
Privacy Policy 2026-09-15, Terms 2026-08-28, DPA 2025-11-06, sub-processors notice 2026-01-14. The legal navigation additionally lists a DORA addendum and an Enterprise Agreement. The pricing page states that the current chat pricing model may be subject to change; credit rates differ between Pro and Business; some regional plans limit the daily build credits to 30 per month. Since 2026-09-09 (amended Privacy Policy) training on Free and Pro data unless opted out; Business and Enterprise excluded by default. Enterprise offers 'EU inference' and the setting 'Extended-retention models'.
Provider structure
Two companies named: Lovable Labs Sweden AB (Stockholm, controller according to the Privacy Policy) and Lovable Labs Incorporated (contracting party and Delaware law according to the Terms).
Open points of the review
- The sub-processor list names locations but no transfer basis per provider; 'Transfer Impact Assessment' in the Trust Center not reviewed.
- SOC 2 reports, ISO 27001 certificate and AIUC-1 report only listed in the Trust Center or available on request, not reviewed.
- Monthly prices on the German pricing page in EUR without stating whether VAT is included; credit top-ups in the docs in USD.
- Provider's AI Act statement not found.
Frequently asked questions
Where does Lovable store data?
mixed (plans: Free, Pro, Business); EU hosting selectable (plans: Enterprise). According to the provider, as of 18 Oct 2026.
Is there a DPA for Lovable?
no in: Free, Pro; yes in: Business, Enterprise. According to the provider, as of 18 Oct 2026.
Does Lovable use inputs for AI training?
opt-out available in: Free, Pro; no in: Business, Enterprise. According to the provider, as of 18 Oct 2026.
Where is the provider based?
Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden (controller according to the Privacy Policy; lead supervisory authority IMY). The Terms of Service name Lovable Labs Incorporated as the contracting party and Delaware law. According to the provider, as of 18 Oct 2026.
All sources
- 01Pricing (German version, plan cards read in the browser)Pricing page · retrieved 18 Oct 2026
- 02Docs: Plans and creditsDocumentation · retrieved 14 Oct 2026
- 03SecurityTrust Center · retrieved 18 Oct 2026
- 04Privacy Policy (as of 2026-09-15)Privacy notice · retrieved 14 Oct 2026
- 05Data Processing Agreement (as of 2025-11-06)DPA · retrieved 14 Oct 2026
- 06Subprocessors (as of 2026-01-14; refers to the Trust Center)Sub-processor list · retrieved 14 Oct 2026
- 07Terms of Service (as of 2026-08-28)Terms and conditions · retrieved 14 Oct 2026
- 08Lovable's Trust CenterTrust Center · retrieved 18 Oct 2026
- 09Trust Center: Subprocessors (44 entries)Sub-processor list · retrieved 18 Oct 2026
- 10Docs: Lovable Cloud (Region selection)Documentation · retrieved 18 Oct 2026
- 11Docs: EU inferenceDocumentation · retrieved 18 Oct 2026
- 12Docs: Manage training data and privacyDocumentation · retrieved 18 Oct 2026
- 13Docs: Privacy & security settingsDocumentation · retrieved 18 Oct 2026
- 14Docs: Delete a projectDocumentation · retrieved 18 Oct 2026
More tools in Software development with an EU hosting option (in at least one plan)
- Amazon Q Developer · Based in: Depending on the account country: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg
- GitHub Copilot · Based in: According to the GitHub General Privacy Statement
- IONOS AI Model Hub · Based in: IONOS Cloud GmbH, Elgendorfer Straße 57, 56410 Montabaur, Germany
- STACKIT AI · Based in: Schwarz Digits Cloud GmbH & Co. KG, Am Campus 1, 74177 Bad Friedrichshall, Germany
All tools in Software development · Tools with an EU hosting option
Further reading
All tools in the category: Software development. Lovable has at least one plan with an EU hosting option; see also AI tools with an EU hosting option. Figures across all tools: Data report.