The user in question here is in the EU, the startup has their HQ in the EU, so EU data laws apply, and the user has to be able to delete their account and all data stored.
The site has already been reported by an affected user to the local EU data protection officer, so the legal fallout has already started.
If you still have shares in the company, sell.