We see a lot of applications on the market essentially "proxying" traffic to OpenAI, moving to a non-proxy implementation is not too hard if they have any issues with us doing this.

I mean from your users' perspective, not yours. Since it's their OpenAI access that will get revoked for violating the TOS.

More direct concern: PII leaking from end-users will be a problem if the usage of this service isn't made clear and consented with from each individual. I really think the responsible thing by providers like OP is to remind their customers about this.

If you have end-users in for example EU then integrating a service like Helicone would usually require new informed consent to be legal.

I think you could dispense with this issue by just adding Helicone to your list of subprocessors in your GDPR disclosure.