The card companies can get data from the Merchant Category Code to infer the nature of purchases, without specifics. The stores also have a record of what items you bought, which could also be sold unless you have a contract with the store that guarantees they won't sell your purchase history (at least in the countries without strong privacy laws)