[3np]

More direct concern: PII leaking from end-users will be a problem if the usage of this service isn't made clear and consented with from each individual. I really think the responsible thing by providers like OP is to remind their customers about this.

If you have end-users in for example EU then integrating a service like Helicone would usually require new informed consent to be legal.

[ttul]

I think you could dispense with this issue by just adding Helicone to your list of subprocessors in your GDPR disclosure.