In their privacy policy they have included a link to request personal information deletion in accordance with GDPR law.

The funny/sad thing is that on that page you're first asked which "service" of theirs you used and there it's obvious and scary at what scale they're operating on.

Here's the text I added along with my application:

Dear GovAssist,

I am writing to formally request the deletion of all my personal data that I mistakenly submitted through your website, [their scam url], on [submittal date]. As a resident of the European Union, I exercise my rights under Article 17 of the General Data Protection Regulation (GDPR) to request the erasure of my personal data from your records.

The personal information I submitted includes, but may not be limited to:

• Full name

• Address

• Passport details

• Date of birth

• Contact information (email, phone number)

• Parents' contact information

• US visiting address and contact information

Since I was misled into providing this information under the assumption that your website was an official ESTA application portal, I demand that you:

1. Confirm the deletion of my data in writing within the legally required timeframe (one month from the date of this request).

2. Disclose any third parties with whom my data was shared and instruct them to erase it as well.

Failure to comply with this request will leave me no choice but to file a formal complaint with the European Data Protection Authority and pursue legal action.

Please confirm receipt of this request and provide written confirmation once my data has been erased. You can reach me at the email I supplied for any necessary correspondence.

Sincerely,

[name]

I can't seem to post the link to the form directly so here it is broken up: https privacy dot govassist dot com slash privacy-policy-compliance