Yes, it is their service. No, they can't do whatever they want with it.
They have to comply with European law to sell products and services here. Google, Facebook and thousands other US companies were forced to change their services after GDPR and everyone did despite loosing billions in the...