If you’re a Mastercard holder in the US, Google has reportedly been tracking whether your buying habits are influenced by online ads in your offline purchases for the past year. The secret deal between the two companies was brokered after four years of negotiation, according to a Bloomberg report published today.

Neither Google nor Mastercard have publicly announced the partnership, and neither company let its customers know that their offline purchases made in stores are being tracked through Mastercard purchase histories and correlated with online ad interactions. Both Google and Mastercard say that the data is anonymized in order to protect personally identifiable information.

Google reportedly paid Mastercard millions of dollars for data on what people have been buying. It used that data to build a tool for advertisers that would break down whether people who had clicked online ads later went on to purchase a product at a physical retail store.

Bloomberg reported in detail how the process works. It starts with a customer who’s logged into a Google account on the web clicking a Google ad. That person browses a certain item, but doesn’t purchase it. Later on, if they use their MasterCard to buy that item in a physical store within 30 days, Google will send the advertiser a report about that product and the effectiveness of its ads, with a section for “offline revenue” listing the retail sales.

To opt out, you have to toggle off “Web and App Activity,” which is enabled by default. The very non-specific category controls whether Google can pinpoint your exact GPS coordinates through Maps data and browser searches and, as today’s news highlights, whether it can crosscheck your offline purchases with your online ad-related activity.

This is Google’s latest attempt to see how effective its ads have been in influencing offline purchase behavior, plugging a hole in its system where retailers would buy ads, but never ultimately know if it translated to a real-life purchase. Google has in the past provided advertisers with location history data culled from Google Maps and other more granular data points collected by its Android operating system. But that data never indicated whether a customer actually purchased a product. With clothes, beauty products, and other items that people usually like to try out in the physical store before buying, Google’s new tracking tool answers that question for advertisers.

Google told The Verge that users’ personally identifiable information is hidden from both Google and its partners. It declined to confirm the deal with Mastercard.

In a statement, a Google spokersperson said:

“Before we launched this beta product last year, we built a new, double-blind encryption technology that prevents both Google and our partners from viewing our respective users’ personally identifiable information. We do not have access to any personal information from our partners’ credit and debit cards, nor do we share any personal information with our partners. Google users can opt-out with their Web and App Activity controls, at any time.”

Mastercard elaborated further in a statement to The Verge:

The way our network operates, we do not know the individual items that a consumer purchases in any shopping cart – physical or digital. No individual transaction or personal data is provided. That delivers on the expectation of privacy from both consumers and merchants around the world. In processing a transaction, we see the retailer’s name and the total amount of the consumer’s purchase, but not specific items.

Mastercard told The Verge that the company shares aggregated and anonymized data, such as the merchant’s average ticket size and sales volumes, with merchants and their service providers so they have metrics to measure their ad campaigns’ “effectiveness.”

We knew about this partially last year, because Google announced a service called Store Sales Measurement, stating it recorded about 70 percent of US credit and debit cards transactions through third-party partnerships. At the time, we did not know what the specific partners were and we didn’t know how Google would make it work. Now it’s been anonymously confirmed that Mastercard is one of them. It’s likely that the 70 percent metric doesn’t involve just Mastercard, but includes other credit card providers as well.

Update August 31st, 1:16AM ET: Added Mastercard statement and updated second paragraph with mention of anonymized data.