Can you be more specific about what in their TOS violates GDPR? They say they’ve had a policy written to align with GDPR since 2018. And simply being cloud-based is not a non-compliance.
Kinda shitty to force use of their software, but not a GDPR non-compliance.
Are we assuming personal data includes anything uploaded to the cloud? Like the .svg files? Because that is likely not personal data, at least it’s not all personal data by default.
Source: https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en
So I would think what details are associated with one’s account, and what sort of encryption and control of the .SVG files plays a part.
As for what you can do if you think your rights under GDPR haven’t been respected, you can boycott them or file a complaint or file a legal action.
IMO, unless you could show your data specifically was mismanaged and exposed to someone who should not have had it, I would be skeptical of the success of any lawsuit. Obligatory, not a lawyer.