Is it safe to build an app with AI?
It depends on one thing: whether anyone accountable reviewed the code before it went live. The tool that wrote it does not carry the risk. Under GDPR, the business that collects the data does. This guide explains why, and gives you a checklist you can run against your own app.
Whoever collects the data carries the risk.
Under GDPR, the business that collects personal data is the data controller. The AI tool, the no-code platform, and the person who wrote the prompt carry none of that liability. It sits with the business.
So if a gym's member database leaks, the fine and the duty to notify land on the gym. In Latvia, the supervisory authority is Datu valsts inspekcija, and serious breaches must be reported within 72 hours. Most owners have never been told this, which is exactly why it matters.
The problem with a vibe-coded or no-code app is rarely the AI itself. It is that the code shipped without anyone accountable reading it. The failures below are common, individually checkable, and fixable once someone looks.
Eleven things to check before you trust an app.
Run these against any app you already have, or ask whoever built it. Each one has a plain description, what it costs you, and a way to check it yourself.
-
Database rules left open
-
Secrets shipped to the client
-
Authorisation checked only in the UI
-
No rate limiting or bot attestation
-
Predictable record IDs
-
Prices trusted from the client
-
Personal data with no lawful basis or deletion path
-
Secrets committed to git history
-
No logging
-
Unmaintained dependencies
-
No backups and no tested restore
How Scholar builds to close these gaps.
On every build, we write and review server-side rules, keep secret keys out of the client, and add app attestation such as App Check where it fits. We set up a privacy policy and a data-deletion path, and you own the repository and the store accounts throughout.
None of this is exotic. It is the difference between code that shipped because it ran once, and code that someone accountable read before it reached your customers. If you want the detail for a technical review, ask on the call.