Privacy Policy

Conventa — the vendor & contract management tools suite.

Effective Date: 01.10.2026

Data Controller: Owner

1. Introduction

This Privacy Policy explains how we collect, process, and protect data when you use Conventa — the vendor & contract management tools suite, hereafter designated as The Platform in the following privacy policy text. The Platform is committed to protecting the privacy of customers organizations (making the different data types available) and the individuals (using the tool).

Even though GDPR covers personal data, you as a user should know that AI-driven analysis is private to the user’s session unless you choose to share it by own action. The collected data is only for own use, but the data could in anonymized conversion be used in a general index also after you as user has erased your account and data.

2. Types of Data Collected

We collect data through your interactions with The Platform and the Lovable interface with OS, databases, subsystems, and AI modules:

Identity Data: Name, email address, and professional title (not a requirement).

Business process data: Evaluations of performance, contract purpose summary, contract dates, recommendations from participants etc.

Technical Data: IP address, browser type, and usage data (via Lovable and Lovable’s cloud hosting).

3. Legal Basis for Processing (GDPR Art. 6)

We process your data based on the following:

Performance of a Contract: To provide wizard guided processes structuring your data and assessments with the intend of supporting the effort to improve the maturity of procurement and contract / vendor management activities in your organization.

Legitimate Interest: We analyze anonymized and aggregated data to identify overarching trends and patterns in procurement and contract management. This allows us to generate valuable insights, enhance our services, and contribute to industry knowledge. This processing is conducted under our legitimate business interest to improve and develop our offerings.

Consent: By opting in, you permit us to use an anonymized version of your data. This data is processed in a way that makes it impossible to reverse-engineer or trace back to you or your organization. The anonymous data is used exclusively for statistical analysis and trend reporting.

4. How The Platform Use Data

• To identify areas of weakness with potential for improvement.
• To visualize and illustrate current state of affairs.
• To provide benchmarking of performance over time tracking the effects of improvement measures taken.
• To maintain the security and functionality of The Platform hosted on Lovable.

5. Data Sharing and Sub-processors

As our Platform runs on Lovable AI, your data is processed by the following third-party infrastructure providers (sub-processors):

Lovable AI: Application deployment and management.

Supabase / AWS / Google Cloud: For database storage and hosting.

OpenAI / Anthropic: For processing natural language business descriptions (data is not used for training their models if using API-based services, but we recommend not inputting confidential trade secrets).

Lovable ensures that all sub-processors outside the EU (e.g., in the USA) are compliant with the EU-U.S. Data Privacy Framework or use Standard Contractual Clauses (SCCs) to ensure a high level of data protection.

6. Data Retention

Individualized Account Data: Retained in non-anonymous form as long as your account is active cf. the obligations and restrictions stipulated in Lovable’s end-user policies cf. https://lovable.dev/terms.

Anonymized Data: We may keep anonymized, aggregated data indefinitely for statistical research.

7. Your Rights under GDPR

As a data subject in the EU, you have the following rights:

• Access: Right to know what data we hold about you.
• Rectification: Right to correct inaccurate data.
• Erasure (“Right to be forgotten”): Right to have your non-anonymous data deleted.
• Data Portability: Right to receive your data in a machine-readable format.
• Objection: Right to object to processing based on legitimate interests.

To exercise these rights please make a request via The Platform’s contact form.

8. Confidentiality of Business Ideas

We acknowledge your business processes are yours. While Lovable.ai assure implementation of industry-standard security through cloud providers, users should be aware that:

• The Platform is a tool for collecting data in a structured way and improving processes and, not a vault.
• Do not input trade secrets, information of any kind related to specific named individuals or highly sensitive financial information etc.

9. Cookies

We use essential cookies necessary for the Lovable platform to function and analytical cookies to understand how users interact with The Platform.

10. Complaints

If you believe we are processing your data unfairly, you have the right to lodge a complaint with the Danish Data Protection Agency: