Just like I’m not bound by the laws in the US as I don’t live there nor have the rights under their constitution, Y Combinator does not have a legal entity AFAIK in a country with GDPR legislation, so they’re not bound by it.

I’m not sure why EU citizens feel their laws apply to a US owned and operated website, because I’m quite sure most would not want eg US law to apply in the EU (I am European fwiw)

GDPR rights descend from EU law.

Google, Facebook etc were in the GDPR spotlight because they have entities in the EU. Not because EU law suddenly applied to US only entities