A data business that consumers fear, operators distrust, and buyers can't verify does not have a compliance problem. It has no market. What follows is not a set of concessions made to close deals — it is the reason the business can exist at all. These commitments are drawn from Circuit's operating principles and are reflected in our Terms of Use and Privacy Policy.
Principle zero
No individual is ever identified, resolved, or inferred.
Circuit does not resolve consumer identity. It does not link transactions to a person, build or license consumer identity graphs, join to loyalty, card, device, or household identifiers, or infer individual-level attributes of any kind. The data model has no place to put a person. The unit of analysis is the basket, the venue, the cohort, and the market.
We are interested in what sells alongside what, in which kind of room, at what hour, at what price, and what a promotion actually did when it ran. None of that requires knowing a single person, and the system is built so that it never can.
Every version of this business that resolves individuals is more valuable in the short run, and every one of those proposals arrives looking reasonable and incremental. Restraint that depends on someone's judgment in a hard quarter is not restraint. It has to be in the architecture, and it has to be written down where the next person can find it. That is what this page is for.
This is not an alcohol rule
The most common assumption about Principle Zero is that we hold it because beverage alcohol is a controlled substance, and that it would relax in grocery or convenience where someone is buying cereal, bread, and eggs. It would not — and the assumption has the risk exactly backwards.
No US privacy statute treats alcohol purchase data as a protected category. It appears in no state's sensitive-data enumeration alongside health, religion, sexual orientation, immigration status, or biometrics. Federal alcohol regulation governs producers, permits, and trade practice — not what anyone may infer about a shopper. There is no alcohol carve-out for us to have inherited.
Meanwhile a grocery basket supports more sensitive inference about a person than a bar tab does. The story that defined retail data for a generation — a mass retailer inferring a teenager's pregnancy from unscented lotion, zinc supplements, and a handful of unremarkable items — happened in grocery and mass, not in a liquor store. Washington's consumer health data law reaches information “derived or extrapolated from nonhealth information,” which is a precise description of what a shopping basket does. Pregnancy, illness, recovery, religious observance, and financial hardship are all legible in ordinary groceries.
So the commitment is scoped to the architecture, not to the category. It holds in bars, in independent liquor, in grocery, in convenience, and in anything we do next. It also survives a change of control: a promise that lasts until the company is sold was never a promise.
One clarification, because it comes up. If a retailer operates its own loyalty program, that is their relationship with their own shoppers, and it is not ours to have an opinion about. Our commitment is narrower and firmer than a judgment about their business: Circuit neither requests nor receives those identifiers, and there would be nowhere to put them if we did.
What Circuit will never do
Name a venue to a buyer
No brand, distributor, agency, or partner ever receives data attributed to an identifiable venue — not by name, not by inference, and not by a breakout thin enough to give it away. Circuit does not offer a consent-based exception: a venue cannot elect to be identified in a buyer-facing output, at any price. This channel runs on word of mouth, and one breach doesn't cost a venue, it closes a market.
Publish a number the panel can't hold up
Every cut of the data must clear a minimum venue count before it renders at all. Below that threshold the product refuses to show the figure rather than shipping it with a caveat — because anonymity fails by arithmetic long before it fails by disclosure.
Run, fund, or administer the programs we measure
Circuit measures trade and marketing programs. It does not place them, fund them, deliver them, or administer them, and it does not route, broker, hold, reconcile, or disburse funds moving between a supplier or wholesaler and a licensed retailer. Circuit purchases venue data with its own revenue, as its own cost of goods.
Federal tied-house law makes this mandatory in beverage alcohol, and that is the reason people assume we hold it. It is not the reason. There are two rules bundled in the sentence above, and only the first came from alcohol regulation:
We are not a conduit for supplier money. No brand or wholesaler dollar reaches a retailer through us, in any category. Holding the money would make us a party to the commercial relationship we are supposed to be reporting on.
We are never paid for an outcome we also measure. This one has nothing to do with alcohol. A company that places a program and then grades it is marking its own work, and every buyer who has been sold that arrangement before knows it. It is the difference between a measurement business and an agency, and it does not change when the product is cereal.
The second rule is the one doing the work, so both hold everywhere. We can tell a brand which cohorts are worth investing in. What happens next is between the brand and the retailer, and we would rather be able to tell you honestly whether it worked.
Let a brand influence what a venue is paid
Venue payments are calculated on a single published formula that applies identically to every participating venue. The inputs are the volume and completeness of the data supplied and structural attributes of the venue. Payment is never sized by, conditioned on, or triggered by the brands a venue carries, stocks, features, or promotes, by revenue attributable to any brand, or by any brand's spending with Circuit. No supplier, wholesaler, distributor, brand, or agency funds, directs, or influences any payment.
Tell a venue which brands are customers
Buyer identity is not disclosed to venues in any channel, including sales conversations and marketing. Nothing in a venue's agreement requires, requests, or rewards the stocking, featuring, promotion, or sale of any product.
Claim above what the data supports
Every cohort and panel carries a tier, and the product enforces it — downgrading automatically when a panel falls below. We publish coverage, sample composition against the population with known skews named, and margin of error. We label measured results separately from modeled results, and we never average an experimental read together with an observational one. Programs measured for lift are identified from trade calendars or client input, never detected from the same outcome data used to measure them.
Chase retailers who already monetize
Circuit serves operators who earn nothing from their transaction data. It does not compete for the national chains that already run their own data businesses — that work is done. In scope: bars and restaurants, independent liquor, independent and regional grocery, independent convenience, and any fragmented channel where the operator gives the asset away.
Three commitments
To the consumer
An individual's spending history is sacred. There is no version of this business worth building that exposes it — so we built one that never holds it. No names, no email addresses, no loyalty tracking, no profiles, no following anyone anywhere. Circuit does not collect full payment card numbers or store payment credentials.
To the operator
The data you contribute is yours. You choose which cohorts to join, you can see what you are contributing, and you can disconnect whenever you want. Your name never appears in anything we sell — not to a brand, not to a distributor, not to anyone, at any price.
To the buyer
We will not tell you things our data cannot support. You get the coverage, the sample composition, and the margin of error alongside the answer, and we will tell you when a number is too thin to bet on. In a category that has trained everyone to expect vagueness, we would rather be the ones who show the working.
One honest thing
Better measurement does not grow trade spend. It moves it. If we show a brand that a large share of what they spent produced nothing, that money does not evaporate — programs that work get more, programs that don't get cut, and venues that took the support and did nothing with it stop getting it.
That is healthier. It is not painless, and some of the operators on the losing side of that reallocation will be operators we work with. We would rather say so plainly than sell a version where everyone wins and be asked about it later.
Security & handling
Transaction data reaches Circuit under contract and is held encrypted in transit and at rest, with production access restricted to a small team and logged. Code is reviewed, incident response is documented, and a data processing agreement is available the moment your legal team asks for one. Our practices are aligned to CCPA/CPRA, GDPR, and PIPEDA.
Data is anonymized and pooled with other venues before it enters any report or product. No brand, no other venue, and no party outside Circuit sees an individual venue's raw data. We do not attempt to re-identify de-identified data, and we contractually require recipients not to attempt re-identification — of an individual, a household, or a venue.
Policy documents
These commitments are given effect in our binding agreements. See the Privacy Policy for how information is collected, used, and shared, and the Terms of Use — in particular Section 6 (aggregated data limits), Section 7 (venue participation and payment), and Section 8 (measurement services) — for the contractual form of what is described here.
Questions about any of this: privacy@circuitdata.ai.