I wouldn't be too sure about that.

IANAL, but I've had several hosting companies. And while most situations where a customers' site is hacked and/or their data leaked, the hoster does have an obligation to provide good tooling (i.e. ssh, not telnet) and to promote good behaviour (i.e. not allowing the backup system to write the backups to public hosted directories).

Lovable has a responsibility, and, as you pointed out in your article, their proposition of "building apps without technical knowledge" (my words), might make theirs to be more than just putting lines in a EULA to waver that responsibility.

Sorry, I was flippant in my previous comment -- they SAY they can’t be sued. I’d hope those “non-technical founders” wouldn’t be left out in the cold and that Lovable would be held liable as well.

That's not a run race. They are a processor and this definitely was on their watch. Both controller (the website owner) and the processor and sub-processor (Lovable, Supabase) all have pretty clear joint and individual responsibilities here and all of them have failed to greater or lesser degree. The Controller may even be in the better position of the three.