This register covers WTFB integrations, conditional services and possible downstream recipients. A service’s role as processor, subprocessor or independent controller depends on the operation and agreement. Listing a service does not mean it receives every user’s data.
Agreements and international transfers
Contractual chains, entities, retention, access from other countries and applicable transfer safeguards require confirmation against agreements and account settings. This register does not verify an executed DPA, DPF certification or applicable SCCs. A European primary database region does not guarantee all processing stays in the EEA. Links point to published provider terms, not evidence of executed agreements.
| Service / operator | Purpose | Data | Regions | When used | Provider terms |
|---|---|---|---|---|---|
Lovable Cloud / AI / Emails Lovable Labs AB | Hosting, accounts, storage, AI and email delivery | Account, projects, reports, files, logs, prompts, email addresses and content | Primary database: Frankfurt (eu-central-1); not an EEA-only guarantee for all processing | Platform integration | Terms / privacy ↗ |
Stripe Stripe Payments Europe, Limited / Stripe Technology Europe, Limited | Payments, invoices, fraud prevention; role depends on the operation | Contact, payment details, transactions, IP and device data | Service- and contract-dependent; requires confirmation | Platform integration | Terms / privacy ↗ |
OpenAI Entity depends on Lovable’s agreement and the selected service | Models and transcription through Lovable AI | URLs, page and report text, findings, screenshots; audio/video for transcription. Content may contain personal data | Service- and contract-dependent; requires confirmation | When configured and the feature is used | Terms / privacy ↗ |
Google Gemini Entity and product determined by Lovable’s agreement | Text and screenshot analysis through Lovable AI | URLs, page and report text, findings, screenshots; audio/video for transcription. Content may contain personal data | Service- and contract-dependent; requires confirmation | When configured and the feature is used | Terms / privacy ↗ |
Anthropic Anthropic, PBC | Roast generation; a direct API integration exists, not only Lovable AI | URLs, page and report text, findings, screenshots; audio/video for transcription. Content may contain personal data | Service- and contract-dependent; requires confirmation | When configured and the feature is used | Terms / privacy ↗ |
Firecrawl Operator and contractual chain require confirmation | Website crawling through a Lovable connection | Page URLs, HTML, text, screenshots and element information; may contain personal data | Service- and contract-dependent; requires confirmation | When configured and the feature is used | Terms / privacy ↗ |
Sentry Functional Software, Inc. d/b/a Sentry | Browser/server errors and browser session replay | Errors, logs, request context, pseudonymous ID; page replay masks inputs, not all text | Account region unconfirmed; EU storage does not exclude processing of some data in the US | Browser: after diagnostics consent; server errors: when configured | Terms / privacy ↗ |
Datadog Datadog, Inc. | Browser metrics, logs and session replay after diagnostics consent | Telemetry, pseudonymous ID and page content with input-field masking | Code defaults to datadoghq.eu; account region and international access require confirmation | When configured and the feature is used | Terms / privacy ↗ |
Plausible Analytics Plausible Insights OÜ | Cookieless analytics when configured and diagnostics or marketing consent is given | URLs, referrers, events and technical data for aggregate analytics | Visitor analytics: EU per provider policy; provider account data may be processed outside the EU | When configured and the feature is used | Terms / privacy ↗ |
Cloudflare / Turnstile Cloudflare, Inc. | Turnstile bot checks; other network services depend on hosting | IP, browser/device details, requests and verification results | Global network; EU localization not confirmed | When configured and the feature is used | Terms / privacy ↗ |
Google sign-in Entity depends on Google sign-in terms | Optional Google sign-in; Google processes some data for its own purposes | OAuth ID, email, basic profile and technical sign-in data | Service- and contract-dependent; requires confirmation | When configured and the feature is used | Terms / privacy ↗ |
Meta Pixel Meta Platforms Ireland Limited | Advertising and conversion measurement; provider role depends on service | Events, URLs, IP, browser data and identifiers; scope depends on configuration | Service- and contract-dependent; requires confirmation | Only when configured, enabled and marketing consent is given | Terms / privacy ↗ |
Google Ads / GA4 Google Ireland Limited | Advertising and conversion measurement; provider role depends on service | Events, URLs, IP, browser data and identifiers; scope depends on configuration | Service- and contract-dependent; requires confirmation | Only when configured, enabled and marketing consent is given | Terms / privacy ↗ |
TikTok Pixel TikTok Technology Limited | Advertising and conversion measurement; provider role depends on service | Events, URLs, IP, browser data and identifiers; scope depends on configuration | Service- and contract-dependent; requires confirmation | Only when configured, enabled and marketing consent is given | Terms / privacy ↗ |
Resend Plus Five Five, Inc. | Possible downstream Lovable Emails delivery service; involvement requires confirmation | If involved: recipient email, message content and metadata | Service- and contract-dependent; requires confirmation | Not confirmed as an actual recipient; no separate WTFB agreement asserted | Terms / privacy ↗ |
Mozilla MDN Observatory Operator and legal role require confirmation | HTTP security assessment | Domain name and public HTTP responses | Service- and contract-dependent; requires confirmation | When a check runs; not automatically classified as a subprocessor | Terms / privacy ↗ |
Qualys SSL Labs Operator and legal role require confirmation | TLS and certificate assessment | Domain name and public TLS/certificate information | Service- and contract-dependent; requires confirmation | When a check runs; not automatically classified as a subprocessor | Terms / privacy ↗ |
W3C Nu HTML Checker Operator and legal role require confirmation | HTML validation | Public page HTML (up to 1,500,000 characters); may contain personal data | Service- and contract-dependent; requires confirmation | When a check runs; not automatically classified as a subprocessor | Terms / privacy ↗ |
AI and external checks
Website text, screenshots and recordings may contain personal data even when publicly accessible. No-training does not mean zero retention; terms depend on the product and access channel. Translation and voice playback remain disabled; recording transcription is a separate feature. External check results stay inside WTFB, with access restrictions retained for sensitive technical details.
Notices and questions
For customers with an executed DPA, that agreement governs new-subprocessor notices and objections. This page does not set a separate 14- or 30-day period. Questions about processing and applicable safeguards can be sent to [email protected].