This is incorrect. Look at the code, there are many services integrations including PayPal, captchas etc. All this must be in privacy statement, as even IP is considered as PII according to GDPR.