Offerable Back to app

Security & Data Handling

v1.0 · Last updated June 18, 2026 · Offerable is intended for use only by residents of the United States.

This page is maintained by Offerable to answer common security and privacy questions about how the Service handles your data. It describes app-owner practices and the enabled controls of underlying platforms. It is not an independent certification. For our privacy-rights disclosures, see the Privacy Policy.

1. AI Negotiation Coach architecture

The AI Negotiation Coach uses Lovable AI Gateway to interface with Google Gemini under Google's enterprise commercial tier. Data flow:

  1. User sends message in the Offerable browser app.
  2. Message is routed to Lovable AI Gateway (https://ai.gateway.lovable.dev/v1/chat/completions).
  3. Gateway routes to Google Gemini API (enterprise commercial tier).
  4. Gemini processes and responds.
  5. Response is returned to the user.
  6. Conversation is discarded — not stored by Google, Lovable, or Offerable.

2. Zero Data Retention (ZDR) guarantees

Google's commitment

  • Conversation data is not retained by Google after processing.
  • Conversation data is not used to train, fine-tune, or develop Google's AI/ML models.
  • Enforced by Google's enterprise commercial agreement terms.

Lovable's commitment

  • DPA Section 10: personal data is not used for training, retraining, fine-tuning, or AI/ML model development.
  • DPA Section 7.5: the same obligation flows to sub-processors (including Google) by contract.
  • See lovable.dev/security for Lovable's published security commitment.

3. Implementation details

  • File API: not used. Lovable's AI Gateway exposes only the Chat Completions endpoint, a stateless request-response model. Offerable's AI Coach does not use the Google File API; user data does not sit at rest in Google File Storage.
  • Session Resumption: disabled. Lovable AI Gateway does not expose the Gemini Live API. If Gemini Live is integrated in the future, SessionResumptionConfig will be disabled in Offerable's application code by default.

4. Data storage at Offerable

  • Offer comparison data: stored in your browser's localStorage only — not transmitted to Offerable servers.
  • AI Coach conversations: routed to Lovable AI Gateway only; not stored by Offerable.
  • Backend database: encrypted at rest with AES-256.
  • Data in transit: all API calls encrypted with TLS 1.2 minimum, TLS 1.3 where supported.

5. Entity-scoped logging attestation

Lovable's published DPA (lovable.dev/security) covers all customers platform-wide. If your organization requires a written attestation that Google Cloud Logging and BigQuery are specifically disabled for Offerable, this is available through Lovable's Enterprise program.

For standard users and most organizations, Lovable's published DPA is the source of truth for data handling practices.

6. Security Attestation Memo

Offerable maintains a detailed Security Attestation Memo documenting:

  • Infrastructure security architecture (Cloudflare DDoS, TLS encryption, AES-256 at rest).
  • Zero Data Retention verification (Lovable DPA + Google enterprise tier).
  • File API and Session Resumption configuration.
  • DDoS protection and rate limiting.
  • Security event audit log details.

Available upon request. Submit via our contact form.

7. TLS encryption in transit

  • TLS 1.3 negotiated by default (preferred).
  • TLS 1.2 fallback if the client or proxy does not support TLS 1.3.
  • TLS 1.2+ guaranteed minimum across the entire transit lifecycle.

8. DDoS protection

All Offerable traffic — including the /api/coach endpoint — is served through Cloudflare's edge network via Lovable's infrastructure. Cloudflare applies baseline, always-on, unmetered DDoS mitigation (L3/L4/L7) to all traffic by default.

9. Security event logging

Offerable maintains a server-side security event log capturing event types including:

  • Prompt injection attempts detected.
  • Sensitive data pattern detections.
  • Rate limit thresholds reached.
  • Bot traffic flags triggered.
  • Crisis signal detections.
  • Age indicator detections.
  • Code generation attempts.
  • Exfiltration attempts.
  • Hate speech detections.
  • Medical / mental-health advice requests.
  • Employment-law redirects.
  • Public profile / social account requests.
  • Dangerous content attempts.
  • Personal advice redirects.
  • Bribery / misinformation attempts.
  • Political / religious content redirects.
  • And others — 18 event types total.
  • Log retention: minimum 90 days.
  • Log contents: session timestamp and IP address only — no message content, offer data, or user identity.
  • Access: administrator-only; never exposed via public or unauthenticated API.
  • High-severity events: crisis signals, dangerous content, bribery, and hate speech trigger immediate administrator notification.

10. Compliance and attestation

Offerable's security practices are designed to align with:

  • General Data Protection Regulation (GDPR) — for EU users (note: Offerable is intended for US residents only).
  • California Consumer Privacy Act (CCPA) — for California residents.
  • Children's Online Privacy Protection Act (COPPA) — users must be 18+.
  • FTC guidelines on AI transparency and data handling.

These statements describe Offerable's design intent and operational practices; they are not independent certifications. For detailed infrastructure, data handling, and security information, request the Security Attestation Memo using our contact form.

11. Contact

For security questions or vulnerability reports reach out via our contact form.