Ask HN: GDPR compliance for a systems-oriented SaaS

I have a SaaS product that does not deal with personal data, it's a systems monitoring service. However there are a few types of potentially personal data it has to collect:

* user email addresses (for signing in, and for password reset links)

* optionally, billing address

* it uses a third party service for recurring payments (Braintree). My service does not store users' credit card details but Braintree of course has to

The service does not use any analytics scripts. It currently only has generic Terms of Service and Privacy Policy documents, generated online by answering yes/no questions and paying $20 or so for each.

For a SaaS service like mine, what are the minimum required things to be GDPR compliant? Are there walkthroughs, templates or recommended services for preparing GDPR-related documentation?

I'm sure many SaaS tools / services are in similar situation as mine, and I'm sure many have already figured this out. Looking for friendly advice!