Someone has to be authorizing their card numbers. They may not track your purchases themselves, but I'm sure there is some middleman capable of collecting and selling transaction data.

edit: it looks like they use visa. so visa can still sell your data