You are hearing a lot of different advice about what GDPR compliance means, and until that is settled (or proven so unsettled as to be unknowable), you lack a k

You are hearing a lot of different advice about what GDPR compliance means, and until that is settled (or proven so unsettled as to be unknowable), you lack a key factor in your business decision. My advice is to consult an attorney who you trust to be knowledgable about GDPR compliance and find out what exactly you need to do to become compliant, or to determine what the options are and what level of comfort you have with them. Then you can make the call whether you want to spend the required effort. The upside here is that this investment also opens the possibility of giving your co-founder the confidence that they need to stay with the project, should the answer be that the compliance work is small / simple.