Good write-up. Incidents like this show how easy it is for data to leak through third-party tools, even with good internal policies. The more dependencies a product has, the harder it is to keep the full chain secure.
I will report OpenAI to the data protection agency in my country and I encourage others to do the same. They can not blame Mixpanel when they sprinkle others personal information around like this. NOT OK.
Name that was provided to us on the API account
Email address associated with the API account
Approximate coarse location based on API user browser (city, state, country)
Operating system and browser used to access the API account
Referring websites
Organization or User IDs associated with the API account