How is that relevant? You seem to be assuming GDPR doesn’t apply to US companies.

Their own privacy policy acknowledges their obligations under the GDPR.