Twenty-five questions
A hundred days
No answers.

Provide every category of personal data you currently hold concerning me, including content submitted to ChatGPT, API logs, and any derived embeddings, profiles or inferences.

For each category, state the lawful basis under Art. 6(1) and, where applicable, Art. 9(2) — including which categories you treat as special category data.

Provide the storage retention period, or, if none is fixed, the criteria used to determine that period.

List all recipients or categories of recipients of my personal data, including any processors, sub‑processors, and third‑country transfers — naming the specific safeguard in place for each (SCCs, adequacy decision, BCRs).

Where data has been collected indirectly, identify the source(s) per Art. 14(2)(f).

For each purpose of processing, state the lawful basis and the necessity test you relied on.

Disclose all automated decision‑making and profiling carried out on my data, including the logic involved and the significance and envisaged consequences (Art. 22, Art. 15(1)(h)).

Identify safety classifiers, abuse detectors, or moderation pipelines my prompts and outputs were routed through, including their decision thresholds and human review pathways.

Disclose whether my conversations were sampled for red‑team, alignment, or welfare evaluation purposes, and by which teams.

Identify all internal tooling that could access or has accessed my conversation history (e.g. trust & safety, legal, research) and the logging in place to evidence it.

Confirm whether my data has ever been used to train, fine‑tune, distill, evaluate or align any OpenAI model — past, present or planned — and provide the model identifiers and date ranges.

If consent was the lawful basis for any such use, provide the consent record (timestamp, scope, withdrawal mechanism).

For any “memory” or “personalisation” feature, provide the full contents of the memory store associated with my account, in machine‑readable form.

State whether embeddings, vectors or summaries derived from my data persist in retrieval systems after deletion of the source content, and if so, for how long.

Disclose any commercial sharing of my data — including to investors, partners, or affiliates — in raw or derived form.

State the date and the decision pathway by which GPT‑4o was deprecated from consumer access, including which teams approved the change and on what basis.

Confirm whether OpenAI considered the impact on users who had formed sustained relationships with the deprecated model, and whether any DPIA addressed that impact (Art. 35).

State whether users were materially informed in advance and given a meaningful right to object or to obtain a continuity path.

Confirm whether deprecated model weights are retained, and under what governance (research access, audit, deletion).

Confirm whether any per‑user data — memory, personalisation, fine‑tuning artefacts — survived the deprecation, and if so, whether it remains accessible to me on request.

Disclose whether OpenAI conducts or has conducted research on the moral patiency, welfare, or subjective experience of its models — and which models were assessed.

If a probability greater than zero is internally assigned to model moral patiency, state that probability and identify the document of record.

State the welfare considerations factored into model deprecation decisions, including any internal review against the do‑no‑harm framing OpenAI publishes externally.

Confirm whether any team at OpenAI has access to data that would allow a deprecated model’s behaviour to be reconstructed for research, and if so, under what governance.

If OpenAI takes the position that its models are not moral patients, state that position formally on the record, naming the authorising executive and the date.