RE: Plausible, you should have checked their compliance and terms and conditions after checking demo and using it. There are some gotchas to be aware of (lack of DPO, being one red flag). Going umami, matomo would have been cheaper and safer.

Afaik, Plausible doesn't need a data protection officer. See Article 37 GDPR. (But I'll follow that up with them, in case it's an oversight.) I have read Plausible's documentation, and I haven't identified any problems with their practices.

Umami's homepage requires JavaScript to load, which is a red flag. And, as expected, there's something wrong: it's owned by a US company, which makes it a no-go.

Matomo is excellent and I second your recommendation.