There is still significant question whether the EU will be able to enforce the GDPR against companies with no actual presence within the EU.
They tried to solve this be adding a requirement that if a company "knowingly" intends to market within the EU, they must establish a representative within the EU, presumably to receive any legal actions including fines.
Problem is, they can't actually force anyone to do this anymore than insure any fines levied can be collected.
It seems they left the actual enforcement provisions outside of the GDPR with references basically saying according to international agreements which will be determined later.
Such agreements may never come. For example, the EU considers IP addresses to be private data, the US doesn't. Will a US judge or legal entity actually agree to enforce this, that's for a future court to decide.
Some point out generally the US and EU cooperate on reciprocal agreements. It was also noted German courts normally frown on US court punitive damages as recently happened to Blizzard and their judgement against the cheat software firm located in Germany.
I found two pretty good articles/ discussion threads on this subject, and clearly this is in the realm of something which should be dealt with under the advice of competent legal counsel.
Bottom line is, its quite possible smaller firms like Soulbound might not have to really comply, because enforcement actions will likely be centered around larger firms with an EU presence.
Might want to consider moving that German website outside of the EU, or they may end up designated as the representative.
Edit, unfortunately I lack the necessary influence to share the URLs here. I may provide them on another site if anyone is interested as this is a good topic.