Those are all good questions, I think the customers' perception is that they have outsourced this but obviously they too have a responsibility (for instance: to do due diligence on the parties they do business with to make sure that they are observing their duties as controllers). One thing is certain: the data subjects are without blame and their interests have been violated substantially, the question really is what else happened to the data and that is something that nobody knows right now. But if it is true that it ended up on common crawl then that would be quite a big problem.
The controller/processor relationship is very clearly described as part of the GDPR and there is little doubt in my mind that both of these parties jointly and separately carry responsibility here.
To clarify: no PII leaked from Lovable apps ended up in Common Crawl. Common Crawl was used solely to identify Lovable apps—not to retrieve leaked data. It does not store XHR responses, which are how data is retrieved from Supabase.
Any data fetched during the analysis was deleted long ago, though you’ll have to take my word for that. Only metadata was retained.
That said, I fully agree that no one can say for certain whether anyone else collected this data or what happened to it afterward.
The controller/processor relationship is very clearly described as part of the GDPR and there is little doubt in my mind that both of these parties jointly and separately carry responsibility here.
Any data fetched during the analysis was deleted long ago, though you’ll have to take my word for that. Only metadata was retained.
That said, I fully agree that no one can say for certain whether anyone else collected this data or what happened to it afterward.