Regarding your first statement, GDPR does not apply to personal projects. Only to business to consumer interaction. You are at less risk (in fact, zero), if you don't have an LTD as you are outside the scope of the law.