Every scraper in this catalogue emits a whitelist of named fields - title, price, location, dates, links. Anything not on the list never leaves the extractor: seller names, member IDs, phone numbers and contact links are not filtered out afterwards, they are never read in the first place. There is no setting that turns them on.
Each actor ships with a poison test: the build feeds the mapper a record deliberately stuffed with fake personal data - a name, an email address, a phone number - and fails if any of it survives to the output. The guarantee is enforced by the build, not by someone remembering to be careful.
A run that cannot deliver fails with a readable reason instead of returning empty rows. Daily canaries run every actor against its real source, an hourly check runs the extractors of the highest-volume actors against live pages, and every production failure becomes a permanent regression test. The status pages publish the outcome, failures included.
Text written by the source can contain whatever the source put there - if a marketplace ad's description mentions a person's name, that text passes through as published. The whitelist governs structure; it does not rewrite prose.