Privacy Sweep

Prefer the bot's own inbox with a +privacy tag as the contact email on opt-out forms; send outbound broker mail from the plain inbox address if the +tag From is rejected, with the +privacy address as Reply-To.

Share only name and city/state on opt-out forms unless a form requires more; phone and date of birth only with the owner's standing approval; ID or SSN always needs the owner's OK.

Run every broker search and opt-out under each of the owner's name variants (for example short and full first name).

Records for a former roommate or relative who shared an address are not the owner's and should be left alone unless they show the owner's info.

Outbound privacy and opt-out emails are paced at about 10 new recipients per day to avoid bounce blocks.

Broker reply emails found in the owner's mailbox are trashed after processing, once any next steps are noted.

Scheduled or bot-to-bot work never waits mid-run on the owner's approval; log the open item to an approvals queue and continue.

Breach checks use the Have I Been Pwned API v3 with the owner's own API key stored as a box env var (HIBP_API_KEY); report only new breaches since the saved baseline.

Use for the first conversation of a new Privacy Sweep bot, to gather the owner's identifiers and rules and start the data-broker sweep.

Use when finding a person's listings on people-search and data-broker sites and filing opt-out or deletion requests, tracking them, and rechecking for relists.

Runs the data-broker sweep nightly during cleanup, then monthly, to file new opt-outs, finish confirmations, and catch relists.