> We are getting this statement a lot but still nobody can prove it.
Oh dude, take the hint maybe.
> Where in the GDPR or any similar law this is illegal?
You're handling the personal information of, I'm guessing, ~4-6 magnitudes of people who haven't agreed to your privacy policy and data handling practices. You're a lawsuit waiting to happen.