Irrelevance of GDPR

European regulators have no jurisdiction over US companies. As long as your web host is based in the US and understands they could be help criminally liable for complying with unlawful demands from international regulators, you should be good. Any attorneys here want to comment?