Lovable Cloud and GDPR: who is responsible for what in Belgium?

The responsibility boundary that matters

The official logo only identifies the platform discussed. Hebora is not a Lovable partner and is not certified or endorsed by Lovable.

Lovable’s official pages describe Lovable Cloud, regional options and security controls. The DPA frames processing entrusted to the vendor. Those documents do not describe your form copy, extra fields, advertising pixels or the accounts that can read your database.

• Lovable: infrastructure and measures stated in its documents.
• Application owner: purposes, data, users, content, access and added suppliers.
• Both: contractual and operational duties according to their respective roles.

Technical controls that create substance

An audit opens the published application, configuration and flows. It checks public routes, roles, table and file access rules, secrets, server functions, logs, test environments and third-party integrations.

The useful question is not “is security enabled?”. It is whether user A can read or alter B’s data, an unauthenticated visitor can call a sensitive function, or a private key reaches the browser. These scenarios can be tested and documented.

Hebora delivers a role × resource × action matrix, evidence requests, applied corrections and a short list of residual risks.

DPA, region and processors: the evidence to gather

Keep the applicable DPA version, check the required plan, and document the selected region, data categories, individuals, retention and added processors or APIs. Lovable’s privacy policy also covers Lovable’s own processing; it does not replace yours.

If a feature sends data to email, analytics, payment or AI tools, that flow belongs in the inventory. Hebora prepares the technical register and evidence links; a lawyer or DPO can then validate legal grounds and clauses that require interpretation.