How to use supabase with GDPR compliant?

[404apps]

Hi, I'm not familiar with GDPR requirements. I read the discussion in https://github.com/orgs/supabase/discussions/2341, but couldn't really follow all the discussion. I asked the follow-up question, but I didn't get any updates for a while.
I saw that there is the DPA from supabase mentioned that I can download and sign.
There is also the comment mentioned supabase is not on the Data Privacy Framework Program.

Does that mean I couldn't use supabase to store the European user data?
I would like to build a game which store user name, email and game scores into supabase. Is that legal if I select Europe server in supabase?

I believe I need to sign and send the DPA as mentioned in the supabase link. Also, I need to state the usage of supabase in the privacy policy and provide ways to remove and get user's data if they request to compliant to GDPR.
Is there anything else I need to do on supabase, like settings or conifg, on top of this?
How and what are the steps for me to use supabase with fulfilling the requirements of GDPR?
Thanks in advance!

[gludington]

Cross-referencing the cookie size discussion https://github.com/supabase/auth-helpers/issues/643 , because supabase cookies transmit significant amounts of personal user data, and this was not addressed in the earlier discussion.

1. For applications that want to use supabase, what is the argument we can make that all the information transmitted in the cookie qualifies as strictly necessary under the GDPR definition?
2. If any part may not be, what steps can a developer using supabase take to trim that default cookie information to what is strictly necessary?

Essentially, the question is how we, as developers, can square supabase cookies with the "Cookie Compliance" section of https://gdpr.eu/cookies/