As for GDPR, California has something similar, so that also might be good. California still falls under the federal CLOUD Act and their like, though.

If advertising companies (or really, stuff with an incentive to hunger for data) are a concern, I would not recommend the search engine Startpage. Other than that, its policies are afaik fairly decent.

For software, I think it being OSS or at least fully audited by an independent, transparent security auditor, is crucial. You want to avoid shell companies and such whose ultimate ownership is unclear. Or CEOs with questionable histories.

Self-hostability is a good one, though not everyone has the expertise required.