Technically, not deleting your data would be a GDPR violation of the right to be forgotten. They could be ignoring that but it would be very expensive if they were found out. Probably doesn't apply to models that have already been trained, but should apply effectively going forward.