Lovable
Lovable Labs Inc. ·lovable.dev· As of: 2026-07-30
Our verdict
It shortens the path from idea to something visible to hours, and that is real. What comes afterwards it does not change: operations, permissions, evidence and maintenance stay work. As an edge it does not qualify, because the same shortcut is open to everyone. As a way to prove a point inside your own company it qualifies very well, and that is exactly what we would use it for.
Who it fits
Solo
suitable
Start free, 25 dollars a month for serious use. For one person who wants to prove something, this is the shortest path.
Mid-market
suitable with caveats
With caveats: single sign-on only appears in the Business plan at 50 dollars a month. Anyone who needs it pays for approval, not for a feature.
Enterprise
not suitable
Audit logs, SCIM user provisioning and publishing controls only appear in the enterprise plan with a platform fee. In the lower plans the tool fails any internal review, however well it builds.
Buy, switch or build
Off-the-shelf
A project with an agency
Reliable in acceptance and liability, slow at the start, expensive to change. For an application whose requirements are still moving, it is the wrong contract.
AI-native
This tool itself
Here the AI-native product is the fastest route to something visible. The price is in the line about the result: the application initially lives at the vendor.
Build it yourself
A coding agent on your own building blocks
An agent in your own directory plus database, sign-in and hosting as separate blocks. The start is slower and needs someone who can read what is produced. In return the result sits in your own house from minute one, and there is no exit to pay for because there is nothing to exit.
Our advice
- Solo: Take it to prove something in a day. For continuous operation, settle where it moves afterwards.
- Mid-market: Yes for prototypes; for a system in daily business only after answering who maintains it in two years.
- Enterprise: Not in the lower plans. Without audit logs and user provisioning it is not a candidate, whatever it can build.
Who owns what gets built
partly your repository, partly the platform · portable with limits
The vendor states that the projects and code you create belong to you. That is not the same as portable. What is generated is an application assembled in the browser; taking it out means taking the vendor's structure with you and rebuilding it. What we measured doing that is one line above.
Who is behind it
Staying power: Funded
Lovable is barely three years old and is carried entirely by venture capital: about 545 million USD across three documented rounds since February 2025, most recently 330 million USD at a 6.6 billion USD valuation led by CapitalG and Menlo Ventures. The growth figures are spectacular but are consistently vendor claims without audited accounts, and the only solid margin figure comes from a leaked pitch deck showing roughly 35 percent gross margin against a 65 percent target for the second half of 2026. For a customer this means the product is well funded and will not disappear in the short term, but its staying power depends on the next injection of capital and on model costs that Lovable does not control. At this valuation level an acquisition or consolidation is also a realistic scenario that would force a migration.
- Legal entity and contracting party: Per the terms of service and the privacy policy, the service is provided by Lovable Labs Incorporated under the law of the US state of Delaware. The address given is that of the Swedish operating company, Regeringsgatan 25, 111 53 Stockholm. The contracting party is therefore a US corporation, while the team operates out of Sweden. · Source · As of 2026-04-14
- Swedish operating company in the register: Lovable Labs Sweden AB, company registration number 559506-1739, registered in Stockholm at Regeringsgatan 25, business purpose AI and software development. An aktiebolag, that is a registered limited company. · Source · As of 2026-07-30
- Founding and product launch: Founded in 2023 in Stockholm by Anton Osika and Fabian Hedin out of the open source project GPT Engineer. The commercial product was renamed Lovable in December 2024 and launched roughly eight months before the Series A in July 2025. The tool has therefore been on the market for a good year and a half. · Source · As of 2025-07-17
- Series A and preceding round: February 2025: USD 15 million led by Creandum, at USD 17 million ARR and 30,000 paying customers. July 2025: USD 200 million Series A led by Accel at a USD 1.8 billion valuation, at USD 75 million ARR and more than 180,000 paying customers. · Source · As of 2025-07-17
- Series B, 330 million USD at a 6.6 billion valuation: USD 330 million led by CapitalG and the Anthology fund of Menlo Ventures. Participants include NVentures (Nvidia), Salesforce Ventures, Databricks Ventures, T.Capital (Deutsche Telekom), Atlassian Ventures, HubSpot Ventures, Khosla Ventures, DST Global and EQT Growth, alongside existing investors Accel and Creandum. The documented rounds therefore add up to around USD 545 million. · Source · As of 2025-12-18
- Further round under negotiation, not closed: Reported talks about USD 300 million at a USD 13.2 billion valuation, expected to be led by Menlo Ventures. According to the report, the company confirms no final terms. As of 30.07.2026 this round is not documented as closed and must not be counted as equity. · Source · As of 2026-07-08
- Revenue as a vendor claim, not audited: USD 500 million ARR in June 2026, extrapolated from the current monthly revenue. The run-up per the company: 100 million (July 2025), 200 million (November 2025), 300 million (January 2026), 400 million (February 2026). The reporting outlet points out explicitly that the figures are self-reported and not confirmed by financial statements. · Source · As of 2026-06-09
- Headcount: 146 full-time staff, cited by the company's own CRO Ryan Meadows, at what was then USD 400 million ARR, with 70 open roles and a Stockholm office built for 300 desks. Databases quote markedly higher numbers that include contractors and agencies and carry no source. · Source · As of 2026-03-11
- Gross margin and cost dependency: Around 35 percent gross margin against a 65 percent target for the second half of 2026, per a leaked pitch deck. The cause is the dependency on third-party model providers whose prices Lovable does not control. The company has made no statement on profitability. · Source · As of 2025-12-03
Cost of leaving: Moderate
We walked this path ourselves. Fully moving convios.com to a static build took about two weeks of work, not an export. That is not a charge against the tool but the price of a generated application resting on the vendor's building blocks.
Regulation and data
| Data processing agreement | public data processing agreement, effective 6 November 2025, applies from the Business plan upwardsThe agreement is freely available at lovable.dev/data-processing-agreement, plus a pre-signed version for download. It incorporates the EU standard contractual clauses, grants 20 business days to object to new subprocessors and ends processing within 30 calendar days after termination. The privacy policy assigns it explicitly to the Business and Enterprise plans. Anyone working on the Pro plan therefore does not have it.Source · As of 2025-11-06 |
|---|---|
| Storage location | region selectable between Americas, Europe and Asia Pacific; Lovable Cloud runs on SupabaseThe security page states that Lovable Cloud supports regional hosting in the EU, the US and Australia, and that customer data stays in the region you select and does not move across regions by default. The documentation names the same three regions as Americas, Europe and Asia Pacific and adds that country-specific regions such as Germany are available only on the enterprise plan and only on request. The privacy policy names Supabase as the underlying infrastructure for customer data, hosted applications, files and generated outputs. An EU region has to be chosen actively, it is not the default.Source · As of 2026-07-30 |
| Subprocessors | public list in the trust centre, 20 business days to objectFor the current list the privacy policy points to trust.lovable.dev and states that each entry carries the subprocessor's name, location and processing purpose. The legal index lists it at lovable.dev/subprocessors, last updated 14 January 2026. The page itself is served through Vanta and is readable only in a browser, but it is freely accessible without a login. The privacy policy names among others Supabase for storage and databases, Stripe for payments, GitHub for the integration, plus OpenAI, Google Gemini and OpenRouter as model providers. The data processing agreement at lovable.dev/data-processing-agreement grants 20 business days to object to new subprocessors, with termination as the only remedy.Source · As of 2026-04-14 |
| Third-country transfer | transfer to the USA, based on the EU standard contractual clausesThe contracting party is a corporation under the law of the US state of Delaware, so a transfer to the United States takes place. As the legal basis the privacy policy names the EU standard contractual clauses, Module Two for the controller-to-processor relationship under Commission Decision 2021/914, plus the UK international data transfer addendum in version B1.0 issued under section 119A of the UK Data Protection Act 2018, and a Swiss addendum naming the Swiss Federal Data Protection and Information Commissioner as the competent authority. The data processing agreement adds Module Three for the chain down to subprocessors. No self-certification under the EU-US Data Privacy Framework is claimed anywhere we checked.Source · As of 2026-04-14 |
| Training on customer data | opt-out available at any time, but the vendor's own documents contradict each otherThe security page states without qualification that customer prompts, code and workspace data are not used to train Lovable's own models. The terms of service reserve the opposite, namely the use of customer data for developing and training models, and set against it an opt-out that is free of charge and available at any time for prospective use. The privacy policy gives a third position: no training on raw or identifiable data, but use of anonymised or aggregated data to improve the vendor's own models, with an opt-out via privacy@lovable.dev or by moving to the Business plan. Training on personal customer data is clearly ruled out only in the data processing agreement, which applies from the Business plan upwards. Anyone who has to rely on this needs the commitment in writing.Source · As of 2026-06-16 |
| Retention and deletion | deletion within 30 days after termination, backups up to 90 daysThe privacy policy states three periods. Log data is retained for up to 90 days unless the law requires longer. After termination or expiry of the account, personal data is deleted within 30 days, except for data needed for fraud prevention, legal compliance and legal defence. Backups may still hold the data for a further 90 days. Identifiers from analytics cookies expire after 13 months at the latest. The data processing agreement follows the same line and ends processing within 30 calendar days after termination, but reserves the right to charge separately for manual export or deletion work beyond two person-hours.Source · As of 2026-04-14 |
| Certifications | SOC 2 Type II at the vendor, reports only on request; ISO 27001 substantiated only for the data centresThe privacy policy names annual SOC 2 Type II audits for the vendor itself. The same section mentions ISO 27001, but there it refers to the data centres used, not to Lovable. The security page speaks generally of SOC 2 and GDPR requirements, without a type and without a scope. The trust centre runs on Vanta and releases the reports only after a request, approval and a confidentiality undertaking. We found no full-text evidence of an ISO 27001 certificate held by the vendor itself, neither on the legal pages nor on the security page nor in the trust centre. Before any approval the report should be requested and its scope checked.Source · As of 2026-04-14 |
| EU AI Act, Article 50 | unclearAnyone building an application in which AI answers carries the Article 50 transparency duty themselves. We checked the legal index at lovable.dev/legal with every document listed there, including the terms of service, product terms, data processing agreement, definitions, subprocessor list, DORA addendum and legal change log, plus the privacy policy, the security page and the trust centre. None of them contains any statement on the EU AI Act or on labelling AI-generated content. The duty therefore rests entirely with whoever operates the application that was built.Source · As of 2026-07-30 |
| Audit logging | only on the enterprise planAudit logs and publishing controls are listed under the enterprise plan.Source · As of 2026-07-30 |
What it really costs
Entry price
Free with limited build credits. Pro costs 25 dollars a month with 100 credits, Business 50 dollars a month, enterprise with a platform fee and volume-based credits.
Source · As of2026-07-30
What gets expensive
The credits. Every build step counts, and for an application you rework several times the bill is not the plan but the top-ups. On top of that comes the jump to Business as soon as single sign-on is required.
What it displaces
- A prototype made of mockups
- A small outsourced proof-of-concept project
Interfaces
- Git integration
- The vendor's own data storage and sign-in
- Custom domains
At Convios: Replaced by us
convios.com and olivergausmann.com were built with it and moved to our own static build in July 2026. The reason was not its building ability but that machines could only read the site through bought-in pre-rendering.
Alternatives
Evidence
- 1.Plans, prices, which plans include SSO, audit logs and provisioning, and the statement on code ownership · As of 2026-07-30
- 2.Storage on Supabase, subprocessors with a pointer to the trust centre, transfer to the US under standard contractual clauses with the UK and Swiss addenda, retention and deletion periods, annual SOC 2 Type II audit · As of 2026-04-14
- 3.The data processing agreement applies from the Business plan upwards, standard contractual clauses Modules Two and Three, 20 business days to object to new subprocessors, processing ends within 30 calendar days, model training on personal customer data excluded · As of 2025-11-06
- 4.Regional hosting in the EU, the US and Australia, commitment that data stays in the selected region, statement that prompts, code and workspace data are not used to train the vendor's own models · As of 2026-07-30
- 5.Contracting party Lovable Labs Incorporated, law of the US state of Delaware, reservation of the right to use customer data for developing and training models together with a free opt-out at any time · As of 2026-06-16
- 6.Three selectable regions, Americas, Europe and Asia Pacific, country-specific regions only on the enterprise plan by request, Supabase as the basis of the built-in data storage and sign-in · As of 2026-07-30
- 7.Complete index of the vendor's legal documents; no document on the EU AI Act and no statement on labelling AI-generated content · As of 2026-07-30
Last reviewed: 2026-07-30byDr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.