Is this a genuine question? When one reveals identifying information about someone, clearly this is doxxing. What did you think doxxing would be?

Personal data, under GDPR, constitutes anything pertaining to an identifiable natural person. That includes e-mail, financial information, cryptographic keys, IP address, name, telephone number, photographs, etc. I have no idea what demons are chasing you, but we are not the insane ones, here.

His "ToS" are clearly that he will publish everything like any other KYC/ID service. But he should have made it like the pros. "Oopsie the email got leaked..." That said email is shit. It's public by default (ironically like Bitcoin). GDPR (another story) is the biggest bullshit ever produced. Since it got introduced surveillance increased by a factor of 1000. Data got leaked by a factor of 100 and people got killed more by a factor of 10. All non sovereign, non decentralised, non open source, non private digitalisation projects would be illegal if GDPR mattered.