Lovable
Lovable Labs Inc. ·lovable.dev· As of: 2026-07-30
Work through this tool with an AI
Our verdict
It shortens the path from idea to something visible to hours, and that is real. What comes afterwards it does not change: operations, permissions, evidence and maintenance stay work. As an edge it does not qualify, because the same shortcut is open to everyone. As a way to prove a point inside your own company it qualifies very well, and that is exactly what we would use it for.
Evidence:Plans, prices, which plans include SSO, audit logs and provisioning, and the statement on code ownershipOpen sourceStorage on Supabase, subprocessors with a pointer to the trust centre, transfer to the US under standard contractual clauses with the UK and Swiss addenda, retention and deletion periods, annual SOC 2 Type II auditOpen sourceThe data processing agreement applies from the Business plan upwards, standard contractual clauses Modules Two and Three, 20 business days to object to new subprocessors, processing ends within 30 calendar days, model training on personal customer data excludedOpen sourceRegional hosting in the EU, the US and Australia, commitment that data stays in the selected region, statement that prompts, code and workspace data are not used to train the vendor's own modelsOpen sourceContracting party Lovable Labs Incorporated, law of the US state of Delaware, reservation of the right to use customer data for developing and training models together with a free opt-out at any timeOpen sourceThree selectable regions, Americas, Europe and Asia Pacific, country-specific regions only on the enterprise plan by request, Supabase as the basis of the built-in data storage and sign-inOpen sourceComplete index of the vendor's legal documents; no document on the EU AI Act and no statement on labelling AI-generated contentOpen source
Who it fits
Solo
suitable
Start free, 25 dollars a month for serious use. For one person who wants to prove something, this is the shortest path.
Mid-market
suitable with caveats
With caveats: single sign-on only appears in the Business plan at 50 dollars a month. Anyone who needs it pays for approval, not for a feature.
Enterprise
not suitable
Audit logs, SCIM user provisioning and publishing controls only appear in the enterprise plan with a platform fee. In the lower plans the tool fails any internal review, however well it builds.
Buy, switch or build
Off-the-shelf
A project with an agency
Reliable in acceptance and liability, slow at the start, expensive to change. For an application whose requirements are still moving, it is the wrong contract.
AI-native
This tool itself
Here the AI-native product is the fastest route to something visible. The price is in the line about the result: the application initially lives at the vendor.
Build it yourself
A coding agent on your own building blocks
An agent in your own directory plus database, sign-in and hosting as separate blocks. The start is slower and needs someone who can read what is produced. In return the result sits in your own house from minute one, and there is no exit to pay for because there is nothing to exit.
Our advice
- Solo: Take it to prove something in a day. For continuous operation, settle where it moves afterwards.
- Mid-market: Yes for prototypes; for a system in daily business only after answering who maintains it in two years.
- Enterprise: Not in the lower plans. Without audit logs and user provisioning it is not a candidate, whatever it can build.
Who owns what gets built
partly your repository, partly the platform · portable with limits
The vendor states that the projects and code you create belong to you. That is not the same as portable. What is generated is an application assembled in the browser; taking it out means taking the vendor's structure with you and rebuilding it. What we measured doing that is one line above.Plans, prices, which plans include SSO, audit logs and provisioning, and the statement on code ownershipOpen source
Who is behind it
Staying power: Funded
Lovable is barely three years old and is carried entirely by venture capital: about 545 million USD across three documented rounds since February 2025, most recently 330 million USD at a 6.6 billion USD valuation led by CapitalG and Menlo Ventures. The growth figures are spectacular but are consistently vendor claims without audited accounts, and the only solid margin figure comes from a leaked pitch deck showing roughly 35 percent gross margin against a 65 percent target for the second half of 2026. For a customer this means the product is well funded and will not disappear in the short term, but its staying power depends on the next injection of capital and on model costs that Lovable does not control. At this valuation level an acquisition or consolidation is also a realistic scenario that would force a migration.
- Legal entity and contracting party: Per the terms of service and the privacy policy, the service is provided by Lovable Labs Incorporated under the law of the US state of Delaware. The address given is that of the Swedish operating company, Regeringsgatan 25, 111 53 Stockholm. The contracting party is therefore a US corporation, while the team operates out of Sweden.Storage on Supabase, subprocessors with a pointer to the trust centre, transfer to the US under standard contractual clauses with the UK and Swiss addenda, retention and deletion periods, annual SOC 2 Type II auditOpen source · As of 2026-04-14
- Swedish operating company in the register: Lovable Labs Sweden AB, company registration number 559506-1739, registered in Stockholm at Regeringsgatan 25, business purpose AI and software development. An aktiebolag, that is a registered limited company.allabolag.se/…/2KJ5L9NI5YFHLOpen source · As of 2026-07-30
- Founding and product launch: Founded in 2023 in Stockholm by Anton Osika and Fabian Hedin out of the open source project GPT Engineer. The commercial product was renamed Lovable in December 2024 and launched roughly eight months before the Series A in July 2025. The tool has therefore been on the market for a good year and a half.techcrunch.com/…Open source · As of 2025-07-17
- Series A and preceding round: February 2025: USD 15 million led by Creandum, at USD 17 million ARR and 30,000 paying customers. July 2025: USD 200 million Series A led by Accel at a USD 1.8 billion valuation, at USD 75 million ARR and more than 180,000 paying customers.techcrunch.com/…Open source · As of 2025-07-17
- Series B, 330 million USD at a 6.6 billion valuation: USD 330 million led by CapitalG and the Anthology fund of Menlo Ventures. Participants include NVentures (Nvidia), Salesforce Ventures, Databricks Ventures, T.Capital (Deutsche Telekom), Atlassian Ventures, HubSpot Ventures, Khosla Ventures, DST Global and EQT Growth, alongside existing investors Accel and Creandum. The documented rounds therefore add up to around USD 545 million.lovable.dev/blog/series-bOpen source · As of 2025-12-18
- Further round under negotiation, not closed: Reported talks about USD 300 million at a USD 13.2 billion valuation, expected to be led by Menlo Ventures. According to the report, the company confirms no final terms. As of 30.07.2026 this round is not documented as closed and must not be counted as equity.techcrunch.com/…Open source · As of 2026-07-08
- Revenue as a vendor claim, not audited: USD 500 million ARR in June 2026, extrapolated from the current monthly revenue. The run-up per the company: 100 million (July 2025), 200 million (November 2025), 300 million (January 2026), 400 million (February 2026). The reporting outlet points out explicitly that the figures are self-reported and not confirmed by financial statements.thenextweb.com/news/lovable-build-economy-500m-arr-vibe-codingOpen source · As of 2026-06-09
- Headcount: 146 full-time staff, cited by the company's own CRO Ryan Meadows, at what was then USD 400 million ARR, with 70 open roles and a Stockholm office built for 300 desks. Databases quote markedly higher numbers that include contractors and agencies and carry no source.techcrunch.com/…Open source · As of 2026-03-11
- Gross margin and cost dependency: Around 35 percent gross margin against a 65 percent target for the second half of 2026, per a leaked pitch deck. The cause is the dependency on third-party model providers whose prices Lovable does not control. The company has made no statement on profitability.sifted.eu/articles/lovable-margins-leaked-pitch-deckOpen source · As of 2025-12-03
Cost of leaving: Moderate
We walked this path ourselves. Fully moving convios.com to a static build took about two weeks of work, not an export. That is not a charge against the tool but the price of a generated application resting on the vendor's building blocks.
Regulation and data
| Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann. | documented, tied to a conditionpublic data processing agreement, effective 6 November 2025, applies from the Business plan upwardsThe data processing agreement applies from the Business plan upwards, standard contractual clauses Modules Two and Three, 20 business days to object to new subprocessors, processing ends within 30 calendar days, model training on personal customer data excludedOpen sourceThe agreement is freely available at lovable.dev/data-processing-agreement, plus a pre-signed version for download. It incorporates the EU standard contractual clauses, grants 20 business days to object to new subprocessors and ends processing within 30 calendar days after termination. The privacy policy assigns it explicitly to the Business and Enterprise plans. Anyone working on the Pro plan therefore does not have it.As of 2025-11-06 |
|---|---|
| Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt. | documented, tied to a conditionregion selectable between Americas, Europe and Asia Pacific; Lovable Cloud runs on SupabaseRegional hosting in the EU, the US and Australia, commitment that data stays in the selected region, statement that prompts, code and workspace data are not used to train the vendor's own modelsOpen sourceThe security page states that Lovable Cloud supports regional hosting in the EU, the US and Australia, and that customer data stays in the region you select and does not move across regions by default. The documentation names the same three regions as Americas, Europe and Asia Pacific and adds that country-specific regions such as Germany are available only on the enterprise plan and only on request. The privacy policy names Supabase as the underlying infrastructure for customer data, hosted applications, files and generated outputs. An EU region has to be chosen actively, it is not the default.As of 2026-07-30 |
| Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren. | documented, no condition attachedpublic list in the trust centre, 20 business days to objectStorage on Supabase, subprocessors with a pointer to the trust centre, transfer to the US under standard contractual clauses with the UK and Swiss addenda, retention and deletion periods, annual SOC 2 Type II auditOpen sourceFor the current list the privacy policy points to trust.lovable.dev and states that each entry carries the subprocessor's name, location and processing purpose. The legal index lists it at lovable.dev/subprocessors, last updated 14 January 2026. The page itself is served through Vanta and is readable only in a browser, but it is freely accessible without a login. The privacy policy names among others Supabase for storage and databases, Stripe for payments, GitHub for the integration, plus OpenAI, Google Gemini and OpenRouter as model providers. The data processing agreement at lovable.dev/data-processing-agreement grants 20 business days to object to new subprocessors, with termination as the only remedy.As of 2026-04-14 |
| Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt. | documented, no condition attachedtransfer to the USA, based on the EU standard contractual clausesStorage on Supabase, subprocessors with a pointer to the trust centre, transfer to the US under standard contractual clauses with the UK and Swiss addenda, retention and deletion periods, annual SOC 2 Type II auditOpen sourceThe contracting party is a corporation under the law of the US state of Delaware, so a transfer to the United States takes place. As the legal basis the privacy policy names the EU standard contractual clauses, Module Two for the controller-to-processor relationship under Commission Decision 2021/914, plus the UK international data transfer addendum in version B1.0 issued under section 119A of the UK Data Protection Act 2018, and a Swiss addendum naming the Swiss Federal Data Protection and Information Commissioner as the competent authority. The data processing agreement adds Module Three for the chain down to subprocessors. No self-certification under the EU-US Data Privacy Framework is claimed anywhere we checked.As of 2026-04-14 |
| Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt. | documented, but unfavourableopt-out available at any time, but the vendor's own documents contradict each otherContracting party Lovable Labs Incorporated, law of the US state of Delaware, reservation of the right to use customer data for developing and training models together with a free opt-out at any timeOpen sourceThe security page states without qualification that customer prompts, code and workspace data are not used to train Lovable's own models. The terms of service reserve the opposite, namely the use of customer data for developing and training models, and set against it an opt-out that is free of charge and available at any time for prospective use. The privacy policy gives a third position: no training on raw or identifiable data, but use of anonymised or aggregated data to improve the vendor's own models, with an opt-out via privacy@lovable.dev or by moving to the Business plan. Training on personal customer data is clearly ruled out only in the data processing agreement, which applies from the Business plan upwards. Anyone who has to rely on this needs the commitment in writing.As of 2026-06-16 |
| Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung. | documented, no condition attacheddeletion within 30 days after termination, backups up to 90 daysStorage on Supabase, subprocessors with a pointer to the trust centre, transfer to the US under standard contractual clauses with the UK and Swiss addenda, retention and deletion periods, annual SOC 2 Type II auditOpen sourceThe privacy policy states three periods. Log data is retained for up to 90 days unless the law requires longer. After termination or expiry of the account, personal data is deleted within 30 days, except for data needed for fraud prevention, legal compliance and legal defence. Backups may still hold the data for a further 90 days. Identifiers from analytics cookies expire after 13 months at the latest. The data processing agreement follows the same line and ends processing within 30 calendar days after termination, but reserves the right to charge separately for manual export or deletion work beyond two person-hours.As of 2026-04-14 |
| Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden. | documented, tied to a conditionSOC 2 Type II at the vendor, reports only on request; ISO 27001 substantiated only for the data centresStorage on Supabase, subprocessors with a pointer to the trust centre, transfer to the US under standard contractual clauses with the UK and Swiss addenda, retention and deletion periods, annual SOC 2 Type II auditOpen sourceThe privacy policy names annual SOC 2 Type II audits for the vendor itself. The same section mentions ISO 27001, but there it refers to the data centres used, not to Lovable. The security page speaks generally of SOC 2 and GDPR requirements, without a type and without a scope. The trust centre runs on Vanta and releases the reports only after a request, approval and a confidentiality undertaking. We found no full-text evidence of an ISO 27001 certificate held by the vendor itself, neither on the legal pages nor on the security page nor in the trust centre. Before any approval the report should be requested and its scope checked.As of 2026-04-14 |
| EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen. | documented, but unfavourableunclearComplete index of the vendor's legal documents; no document on the EU AI Act and no statement on labelling AI-generated contentOpen sourceAnyone building an application in which AI answers carries the Article 50 transparency duty themselves. We checked the legal index at lovable.dev/legal with every document listed there, including the terms of service, product terms, data processing agreement, definitions, subprocessor list, DORA addendum and legal change log, plus the privacy policy, the security page and the trust centre. None of them contains any statement on the EU AI Act or on labelling AI-generated content. The duty therefore rests entirely with whoever operates the application that was built.As of 2026-07-30 |
| Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält. | documented, tied to a conditiononly on the enterprise planPlans, prices, which plans include SSO, audit logs and provisioning, and the statement on code ownershipOpen sourceAudit logs and publishing controls are listed under the enterprise plan.As of 2026-07-30 |
What it really costs
Entry price
Free with limited build credits. Pro costs 25 dollars a month with 100 credits, Business 50 dollars a month, enterprise with a platform fee and volume-based credits.Plans, prices, which plans include SSO, audit logs and provisioning, and the statement on code ownershipOpen source
As of 2026-07-30
What gets expensive
The credits. Every build step counts, and for an application you rework several times the bill is not the plan but the top-ups. On top of that comes the jump to Business as soon as single sign-on is required.
What it displaces
- A prototype made of mockups
- A small outsourced proof-of-concept project
Interfaces
- Git integration
- The vendor's own data storage and sign-in
- Custom domains
Matching methods
- Minimizing Need-to-BelievesThe method counts the assumptions a buyer has to take on faith, and a working draft built in hours removes the assumption that the thing described would even look the way it was described.
- Discovery-Driven Planning / Reverse Income StatementThe planning releases money only up to the next checkpoint, and Lovable lowers the cost of that first checkpoint far enough to test an assumption against something visible rather than in a spreadsheet.
Alternatives
Sources
- 1.Plans, prices, which plans include SSO, audit logs and provisioning, and the statement on code ownership (opens in a new tab)lovable.dev/pricing · As of 2026-07-30
- 2.Storage on Supabase, subprocessors with a pointer to the trust centre, transfer to the US under standard contractual clauses with the UK and Swiss addenda, retention and deletion periods, annual SOC 2 Type II audit (opens in a new tab)lovable.dev/privacy · As of 2026-04-14
- 3.The data processing agreement applies from the Business plan upwards, standard contractual clauses Modules Two and Three, 20 business days to object to new subprocessors, processing ends within 30 calendar days, model training on personal customer data excluded (opens in a new tab)lovable.dev/data-processing-agreement · As of 2025-11-06
- 4.Regional hosting in the EU, the US and Australia, commitment that data stays in the selected region, statement that prompts, code and workspace data are not used to train the vendor's own models (opens in a new tab)lovable.dev/security · As of 2026-07-30
- 5.Contracting party Lovable Labs Incorporated, law of the US state of Delaware, reservation of the right to use customer data for developing and training models together with a free opt-out at any time (opens in a new tab)lovable.dev/terms · As of 2026-06-16
- 6.Three selectable regions, Americas, Europe and Asia Pacific, country-specific regions only on the enterprise plan by request, Supabase as the basis of the built-in data storage and sign-in (opens in a new tab)docs.lovable.dev/features/cloud · As of 2026-07-30
- 7.Complete index of the vendor's legal documents; no document on the EU AI Act and no statement on labelling AI-generated content (opens in a new tab)lovable.dev/legal · As of 2026-07-30
- 8.allabolag.se/…/2KJ5L9NI5YFHL (opens in a new tab)As of 2026-07-30
- 9.techcrunch.com/… (opens in a new tab)As of 2025-07-17
- 10.lovable.dev/blog/series-b (opens in a new tab)As of 2025-12-18
- 11.techcrunch.com/… (opens in a new tab)As of 2026-07-08
- 12.thenextweb.com/news/lovable-build-economy-500m-arr-vibe-coding (opens in a new tab)As of 2026-06-09
- 13.techcrunch.com/… (opens in a new tab)As of 2026-03-11
- 14.sifted.eu/articles/lovable-margins-leaked-pitch-deck (opens in a new tab)As of 2025-12-03
Last reviewed: 2026-07-30 by Dr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.