You don’t need user consent to retain data that’s arguably needed to provide the service itself. I guess, safety falls into that category. Training on that data is probably a grey area, if they can guarantee it won’t contain PII. They have stolen all the internet, so I wouldn’t bet highly on their restraint.