Same experience here with the CTO... I was trying to notify some terrible security problems in their product. What she doesn't like she dismisses, deflects, and deletes. edit - it was the CTO, not CEO

Have you disclosed the issues publicly?

I wonder how they'd respond to a GDPR request.

Well they're based on Singapore (at least as far as it appears from the Contact page) so they're outside of any EU jurisdiction unless they have servers there.

You're subject to gdpr if you're serving eu customers, where your hq is doesn't matter. Enforcement is a problem tho.

If you can't enforce a law, saying you're "subject" to it is mostly an academic exercise.

It's definetly hard to enforce, but not impossible, if EU is dealing with a party in a random country which clearly shows no intention of doing business in the EU. I.e. the internet is practically lawless a lot of the time. But it depends on whether you're accepting payments and whether you have paying customers in EU.