The question isn't where the company is based, it's where your customers are based. You could be purely based in the US but if you have any customers in the EU,

The question isn't where the company is based, it's where your customers are based. You could be purely based in the US but if you have any customers in the EU, you have to comply with GDPR. Obviously, for an internet based company ruling out the whole EU market is kinda untenable.