It is pretty clear what streetlend needs to do to be GDPR compliant: if the user data is actually being sent to the third parties (the ad networks) then users need to explicitly be told this. If the data is not being sent to third parties then users already consent to their data being stored by entering the data (the data is necessary for the performance of the service operated).

Next to that: allow users to delete their data when they close their account (this should be as easy as setting cascade on foreign key constraints).

As for the geography: if your interaction with European citizens is incidental and not purposeful, you cannot be charged under the GDPR. It is only if you are actively trying to target your goods or services to the European market that they will enforce against you. This is obviously the case since they will have no power to enforce the law otherwise, but it is also covered by the three paragraphs of Article 3.

> Next to that: allow users to delete their data when they close their account (this should be as easy as setting cascade on foreign key constraints).

That is definitely not easy and doesn't work like that. That's why it's common practice in any serious system to have 'deleted' flag instead of actual deleting.

> It is only if you are actively trying to target your goods or services to the European market that they will enforce against you.

Yes, and if you target whole world like most sites in the internet do, you're targeting Europe?