[kekumu]

If you use a third-party, they would be acting as your data processor. You'd need to make sure you have a contract with them that ensures they're respecting GDPR as well.

I agree with others that you should self-host whenever possible. It will simplify these questions and you'll be able to fully protect your users' data yourself.