Lovable

Users retain ownership of their Customer Data including applications, code, and files submitted to the platform. The terms clearly state 'As between us, you own your Customer Data, including the applications, websites, or other projects you build using the Services.'

Users own AI-generated outputs, but this ownership is subject to potential third-party rights in underlying models and training data. The policy warns that AI outputs may be similar to content generated for other users with similar prompts.

By default, Lovable grants itself broad rights to use Customer Data (excluding PII) for business purposes including model training. However, users can opt out by contacting the company or upgrading to a Business plan with enhanced data-handling controls.

The service retains data indefinitely in anonymized/aggregated form and has broad retention rights for business purposes. While users can request deletion, certain data may persist in backups and for legal/fraud prevention purposes. Log data is retained for 90 days, and cookie identifiers for up to 13 months.

Data is extensively shared with third-party infrastructure and AI providers as part of core service delivery. The service uses Supabase for cloud hosting, Stripe for payments, and multiple AI providers (OpenAI, Google, OpenRouter) for AI Gateway functionality. Users consent to these transfers by using the services.

Users have clear opt-out mechanisms for model training (by contacting support or upgrading plans), marketing communications (via account settings), and cookie preferences (via cookie settings panel). The service also respects Global Privacy Control signals.

Strong compliance framework with explicit coverage of major privacy laws including GDPR, CCPA/CPRA, and other state privacy laws. The service undergoes annual SOC 2 Type II audits and uses ISO 27001-certified data centers. Clear legal bases for data processing are provided.

No provisions found for model explainability, transparency into AI decision-making processes, or enterprise auditing capabilities. The terms focus on disclaimers about AI output accuracy rather than providing transparency tools.

Comprehensive security practices including end-to-end encryption, role-based access controls, multi-factor authentication, continuous monitoring, and 24/7 incident response. Uses certified data centers and conducts annual SOC 2 Type II audits. No breach history disclosed.

Significant differences exist between tiers. Business plans provide 'enhanced data-handling controls' and opt-out capabilities for model training that aren't available to free/basic users. Enterprise agreements offer additional protections through separate terms and DPAs.

While the terms don't explicitly reserve rights for human review of inputs, the broad data usage rights and need to monitor for platform rules compliance suggest potential human access. The service processes data through multiple third-party providers who may have their own access policies.

Clear procedures for handling legal requests with customer notification where legally permitted. Strong compliance framework for export controls and sanctions. Structured approach to government data requests and legal cooperation.

Clear inventory of collected data types including name, email, phone, IP address, device identifiers, and usage data. Service explicitly instructs against uploading sensitive data like health information, financial account numbers, or biometric data. Payment data is handled by Stripe.