I hope (for your sake) that you don't have any users that can invoke their GDPR rights against you by virtue of their citizenship.
For the sake of incentivising companies to do the right thing, however, I hope you do have some EU or UK citizen users who do litigate or have their data protection authority investigate and formally punish Triplebyte, even if only to establish clear precedent here for the future.