According to GDPR: you're fine if you're just calling an endpoint and not storing any PII anywhere. According to ePrivacy: it is fine as your backend is storin

According to GDPR: you're fine if you're just calling an endpoint and not storing any PII anywhere. According to ePrivacy: it is fine as your backend is storing this data, and not the user's computer.