WHOIS privacy isn't managed by Railway, it's handled by your domain registrar.

check your registrar's dashboard to see if it can be disabled.

if Spamhaus has listed the domain, it's worth checking the specific reason for the listing the issue can be resolved through their delisting process

hmm my registrar is Railways :)