Lovable, Bolt.new, Replit & v0: add EU AI Act Art. 50 notices & HMAC receipts in 60 seconds

Shipping an AI assistant, booking agent, or customer support widget built in Lovable, Bolt.new, Replit, v0, Webflow, or Shopify? Default starter templates wire openai or streamText calls directly without an interaction notice, and logging raw user prompts to plaintext tables creates unnecessary GDPR Article 5(1)(c) data-minimisation exposure.

Below are three copy-paste recipes using spurvik@1.0.8 (MIT) and badge.js that instruct your builder to keep secrets on the server while wiring visible Article 50(1) AI notices (24 EU languages) and keyed HMAC-SHA256 call receipts.

Option 1: 1-line HTML script tag (any site, 0 npm packages)

If your chat widget lives in Webflow, Shopify, WordPress, or a static HTML shell, paste one script tag before </body>. It renders inside an isolated Shadow DOM in all 24 official EU languages (auto-detecting <html lang> or data-locale), sets 0 cookies, and makes 0 network telemetry requests:

<script src="https://spurvik.com/badge.js" data-system="Support Assistant" data-locale="en" data-theme="dark" defer></script>

Place <div data-spurvik-badge></div> above your chat input for inline placement, or omit it to float a compact pill in the bottom-right corner.

The badge shows a small “Art. 50 · Spurvik” link after the notice. On Pro (€19/mo), add data-attribution="false" to the script tag for a white-label badge with no Spurvik link.

Option 2: Copy-paste prompt for Lovable + Supabase

Lovable apps run Vite + React in the browser and Deno inside Supabase Edge Functions. Never put SPURVIK_API_KEY or SPURVIK_SIGNING_SECRET in VITE_ variables. Paste this exact prompt into Lovable so the notice renders in React while model calls and HMAC keys stay locked inside the Supabase Edge Function:

Add Spurvik (open-source MIT EU AI Act SDK, spurvik@1.0.8) to this app:
1. Frontend (React): install spurvik@1.0.8 and render <AIDisclosureLabel notice="interaction" /> from "spurvik/react" directly above the chat messages so it is visible before the first message without clicking.
2. Edge Function (supabase/functions/*/deno.json): map "spurvik" to "npm:spurvik@1.0.8" and "spurvik/" to "npm:/spurvik@1.0.8/". Keep all model calls inside the Edge Function — never in src/.
3. Secrets (Supabase Edge Function secrets ONLY, never VITE_): read SPURVIK_API_KEY, SPURVIK_SIGNING_SECRET, SPURVIK_CONTENT_HASH_SECRET, SPURVIK_BASE_URL, and SPURVIK_RISK_TIER ("minimal" | "limited_art50" | "high_annex3" — never default riskTier). Throw a clear Missing variable error if any is unset without logging secret values or user prompts.
4. Wrap the AI model with spurvikMiddleware({ apiKey, signingSecret, contentHash: { mode: "keyed", secret: contentHashSecret }, baseUrl, riskTier, article50Disclosure: true, registerProcessHooks: false, telemetry: { flushTimeoutMs: 3000 } }) from "spurvik/ai" (or withSpurvik from "spurvik" for direct OpenAI/Anthropic/Gemini SDK calls). Flush inside EdgeRuntime.waitUntil when available, and return only receipt.eventId to the browser.

Option 3: Copy-paste prompt for v0, Bolt.new & Replit

For Next.js App Router (v0 / Bolt.new) or Node.js servers (Replit Agent), paste this prompt to wrap your server route and keep secrets out of NEXT_PUBLIC_:

Install spurvik@1.0.8 from npm (MIT) and wire EU AI Act transparency & HMAC logging:
1. Client UI: import { AIDisclosureLabel } from "spurvik/react" and render <AIDisclosureLabel notice="interaction" /> above the AI assistant output.
2. Server Route (app/api/chat/route.ts or Express server — never NEXT_PUBLIC_): validate SPURVIK_API_KEY, SPURVIK_SIGNING_SECRET, SPURVIK_CONTENT_HASH_SECRET, SPURVIK_BASE_URL, and SPURVIK_RISK_TIER ("minimal" | "limited_art50" | "high_annex3" — throw if unset, never default riskTier), then wrap the model with spurvikMiddleware from "spurvik/ai" (for Vercel AI SDK streamText/generateText) or withSpurvik from "spurvik" (for OpenAI/Anthropic/Gemini) using contentHash: { mode: "keyed", secret: contentHashSecret } and article50Disclosure: true.
3. Never log raw user prompts or personal data to console.log.

Important scope boundaries

• Visible interaction notice ≠ Article 50(2) marking: <AIDisclosureLabel /> and badge.js show a human-readable AI interaction notice (supporting Art. 50(1)). Spurvik's HMAC provenance receipt verifies call metadata with your secret, but does not watermark or embed C2PA/machine-readable output marking under Article 50(2) (whose transition window for pre-August 2026 generative systems runs to 2 December 2026 under Art. 111(4)).
• Your own risk classification: pass your own SPURVIK_RISK_TIER (minimal, limited_art50, or high_annex3) after checking with counsel. Article 12 record-keeping and Article 14 human oversight apply to high-risk AI systems.

FAQ

Can I put SPURVIK_API_KEY or SPURVIK_SIGNING_SECRET in Lovable VITE_ or Next.js NEXT_PUBLIC_ variables?

No. Never expose SPURVIK_API_KEY, SPURVIK_SIGNING_SECRET, or SPURVIK_CONTENT_HASH_SECRET in browser bundles (VITE_ or NEXT_PUBLIC_). Keep them strictly inside Supabase Edge Function secrets, Replit Secrets, or server-only Next.js Route Handlers. On the frontend, only render <AIDisclosureLabel /> from spurvik/react or the zero-cookie https://spurvik.com/badge.js script.

Does badge.js set cookies, send telemetry, or satisfy Article 50(2) machine-readable marking?

badge.js sets zero cookies, makes zero telemetry requests, and isolates its styles in Shadow DOM across all 24 official EU languages. It displays a visible human interaction notice supporting Article 50(1) only; it does not watermark or cryptographically mark generated media or text under Article 50(2).

When do agencies and SaaS founders upgrade from the free MIT SDK to Spurvik Pro (€19/mo)?

The MIT SDK (spurvik 1.0.8) and badge.js cost €0 with no account required. Teams and agencies connect console.spurvik.com and upgrade to Pro (€19/mo or €190/yr, excl. VAT, B2B only) when handing off a live app to a European client or DPO who needs 90-day Frankfurt (fra1) HMAC log retention, a hosted human approval queue, and downloadable DPO Engineering Summary (.md) and Annex IV technical documentation drafts.

Does Spurvik work in Deno-based Supabase Edge Functions used by Lovable?

Yes. Map spurvik to npm:spurvik@1.0.8 and spurvik/ to npm:/spurvik@1.0.8/ in the Edge Function's deno.json, pass registerProcessHooks: false, and flush with a 3-second cap inside EdgeRuntime.waitUntil when available.

Sources

• SDK on npm: https://www.npmjs.com/package/spurvik (1.0.8; MIT)
• Drop-in badge script: https://spurvik.com/docs#badge (badge.js 1.0.6, Shadow DOM, 24 EU languages)
• Article 50 dates & checklist: https://spurvik.com/art50-deadline-checklist

Reviewed 12 November 2026. Not legal advice. Supports parts of your EU AI Act engineering work; responsibility stays with you. EyeTea Solutions ApS · Trekantområdet, Denmark