Industries
Retail: what your operating records are worth to AI research
A retailer's unit of work is the order: how it is placed, picked, paid and returned. Shopper names, addresses and card numbers are customer details and are excluded. What can be discussed is the operating path the order took through the systems.
Up to $150K · $0 cost · 3 days
| Fact | Detail |
|---|---|
| Unit of work | order |
| First exclusion | shopper names and addresses |
| First rule | The PCI Data Security Standard is aimed at entities that store, process, or transmit cardholder data or sensitive authentication data, and at entities that could affect the security of the cardholder data environment. The audience includes merchants. PCI DSS is an industry standard, not a statute. PCI Security Standards Council |
| Second rule | For purposes of PCI DSS, a merchant is any entity that accepts payment cards bearing the logos of a PCI Security Standards Council participating payment brand as payment for goods or services. PCI Security Standards Council |
What Retail operating records look like
Retail operating records are the order: how it is placed, picked, paid, and returned, and they are not the shopper's name, address, or card number.
Taking an order records the channel, the items, and the promise date. Picking and dispatching records the location and the handoff to a carrier. The shopper's name, the street address, and the card number are customer details. The path through the building can be discussed once those are gone.
Other sectors are grouped under company data licensing by industry.
The license itself is explained in how to sell company data to AI companies.
Workflows in Retail that AI research can learn from
Taking an order, picking and dispatching it, and processing a return are three trails inside one order a store works end to end.
- taking an order
- picking and dispatching
- processing a return
Processing a return records the reason and whether the unit went back to stock. The full order matters because a sale alone hides the return path.
For a related sector's records, read manufacturing company data for AI research or accounting firm data for AI research.
Systems Retail companies usually run
Chat, docs, the support desk, and the books hold the staff side of an order. A commerce platform is named only as plain text.
Slack holds the floor question. Google Workspace holds the vendor sheet. Zendesk holds the shopper's service thread, which has to be stripped. QuickBooks Online holds the settlement, not the card. The commerce platform is listed as plain text.
| System | Category | Why it holds this sector's work |
|---|---|---|
| Slack | Chat | Floor questions about a pick sit in chat. |
| Google Workspace | Email and collaboration | Vendor and inventory sheets sit in documents. |
| Zendesk | Support or ticketing | Shopper service threads sit in the support desk. |
| QuickBooks Online | Finance and accounting | Settlement of the day's orders sits in the books. |
| commerce platform | Industry system | Cart, catalog, and tender sit in the commerce platform. |
What a Retail license leaves out
Shopper names and addresses, and payment card numbers, stay out of a license even when they were stored on the order itself.
- shopper names and addresses
- payment card numbers
Shopper names and addresses identify the person and the home. Payment card numbers are the card data on the tender. Selling online does not replace the records test.
The details that never leave any company are listed in what is never shared.
Rules cited for Retail records
A note about an order quotes a public source, and where it names a card-security standard it says that standard is an industry standard, not a statute.
Card-security notes describe a merchant taking a card as payment for goods, from the cart through the return.
| Rule | What the source says | Source |
|---|---|---|
| PCI Data Security Standard — Merchants | The PCI Data Security Standard is aimed at entities that store, process, or transmit cardholder data or sensitive authentication data, and at entities that could affect the security of the cardholder data environment. The audience includes merchants. PCI DSS is an industry standard, not a statute. | PCI Security Standards Council |
| Merchant | For purposes of PCI DSS, a merchant is any entity that accepts payment cards bearing the logos of a PCI Security Standards Council participating payment brand as payment for goods or services. | PCI Security Standards Council |
| Account data | Account data consists of cardholder data, sensitive authentication data, or both. | PCI Security Standards Council |
| Primary account number | A primary account number is the unique payment card number, on a credit, debit, or prepaid card, that identifies the issuer and the cardholder account. | PCI Security Standards Council |
| Cardholder data environment | The cardholder data environment is made up of the system components, people, and processes that store, process, or transmit cardholder data or sensitive authentication data, and of system components that do not hold that data but have unrestricted connectivity to components that do. | PCI Security Standards Council |
| Service code | A service code is a three-digit or four-digit value in the magnetic stripe that follows the expiration date of the payment card on the track data. It is used to define service attributes, to differentiate international and national interchange, or to identify usage restrictions. | PCI Security Standards Council |
Wind-down specifics for Retail
Closing a storefront does not turn shopper profiles into a licensable archive. The order path is the record, and shopper details stay out.
Export the order path with shopper fields removed. Leave the card vault and the address book out. Shutting the storefront does not price the history.
- Export the order path with shopper fields removed.
- Leave the card vault and the address book out.
- Shutting the storefront does not price the history.
General information only. This is not legal, tax or financial advice.
Related
- Industries
What operating records look like by sector, and what is left out.
- How to sell company data
How to sell or license company data to AI companies, and which route fits.
- What's shared
Which records can be licensed, which details never leave, and what you approve.
- Eligibility
Staff, records, daily-use systems, and the right to license, plus a checker.
- Estimate
US payout bands by staff at peak, and the estimator that uses them.
- Manufacturing
Work orders, with worker names left out.
- Accounting
Client closes, with returns and workpapers left out.
Questions about retail company data for AI research
Which shopper identities and card numbers never leave a retailer in a license?
Shopper names and addresses never leave a retailer in a license. Payment card numbers stay out with them. The order that can be discussed is how it was placed, picked, paid, and returned, after those fields are gone. The address book and the card vault are not the operating path. A home address is a customer detail even on a delivery order.
What is left of an order after the shopper's identity is removed?
After the shopper's identity is removed, an order still shows the channel, the items, the promise date, the pick location, the handoff to a carrier, and the return reason. Taking an order, picking and dispatching, and processing a return are the trails. A sale alone hides the return. The card number is not part of what remains.
Which commerce and support systems should a retailer connect to the systems directory?
Connect Slack for the floor question, Google Workspace for the vendor sheet, Zendesk for the service thread, and QuickBooks Online for the settlement. The commerce platform is named only as plain text. The service thread has to be stripped before anyone discusses it. The settlement is not the card data. List the platform in the inventory anyway.
Does selling online replace the two-year records rule?
No. Selling online does not replace the two-year records rule. A storefront with a short history still has to meet the records test, and the fit check decides. The unit of work is the order. Shutting the storefront does not price the history and does not turn shopper profiles into something that can be discussed. Card numbers stay out either way.
Sources
- PCI Security Standards Council. PCI Data Security Standard — Merchants. Checked 2026-11-04
- PCI Security Standards Council. Merchant. Checked 2026-11-04