is VAPI GDPR compliant? Or do I need to go with AWS and store all data there in an EU located server?