Privacy Policy
Draft · Owner review required before public launch
Operator and contact
Owner review required before public launch: insert the legal operator name, registered address where applicable, and privacy contact email. These details have not been supplied.
Data we process
Pluto AI stores account identifiers and email, optional display name and avatar, conversations, model selections, reply ratings and measured usage, projects, uploaded files and generated images, appearance settings, custom instructions, explicit saved memories, and consent choices. Authentication and infrastructure providers may process security and operational logs.
Purposes and legal bases
Account and chat processing support the service you request (contract necessity where applicable). Optional tracking requires consent. Security and abuse prevention may rely on legitimate interests subject to a documented assessment. Legal obligations may require particular records. The operator must review and document the applicable bases.
Conversations, files and external AI
Chats and files are stored privately with account-scoped access. Submitted prompts, relevant chat history and attachments are sent through Lovable’s AI gateway to the provider for the selected model or tool. Current integrations include OpenAI and Anthropic for chat, OpenAI for images and transcription, and Google for narration. Search requests may invoke provider-native web tools. Avoid uploading data you are not authorized to share.
Training, retention and international transfers
No guarantee about external provider training or retention is made here. The operator must confirm current gateway/provider contractual terms, subprocessors, locations, transfer safeguards and training use before launch. The app retains saved content until you delete it or your account; exact infrastructure log retention and backup deletion windows require owner verification. Deletion from active storage does not establish immediate deletion from backups or provider systems.
Your rights
Subject to applicable law, you may request access, correction, deletion, portability, restriction and object to eligible processing, and withdraw consent without affecting prior lawful processing. Settings provides exports, content deletion, memory controls and account deletion. Additional requests require the owner’s privacy contact above. You may complain to your supervisory authority; in Slovenia this is the Information Commissioner (Informacijski pooblaščenec).
Review status
This notice is a draft requiring operator and legal review. It is not legal certification or a guarantee of GDPR compliance.