Training Production Language Models without Memorizing User Data