> they state that they follow whatever privacy laws exist in your country
Well, that's kinda obvious - if they want to do business in a country, they have to follow the laws of that country. That doesn't in and of itself mean that they will apply weaker privacy protections if the local laws are less strict than GDPR...
I don’t really feel like looking it up again but the verbiage sounded more to me like they were specifically trying to say that they weren’t setting the GDPR as a minimum standard.
We also have to realize that any privacy policy that is allowing for something out of vagueness is something where you have to assume the worst.