Data Access and Privacy in Bubble

We have just started to Bubble as a possible solution for automating our organization. There are a few questions that would need help with.

  1. Where is the data stored? How do we timestamp the data and access it?
  2. I have read that Bubble has data privacy shield however GDPR does not allow to move EU Person Data outside EU. So servers cant be in the USA for EU data. They have to be here.
  3. How do we introduce data level security needed within an organisation such as a sales person can only see their contacts and no one else?

Please advise.