It is more likely the retailer uploaded this purchase to Facebook with hopes to target you in the future. If you used the same email address or the phone number

It is more likely the retailer uploaded this purchase to Facebook with hopes to target you in the future. If you used the same email address or the phone number associated with your Facebook account at the checkout, Facebook "enriched" your interest graph with this information. In these cases private browsing or a VPN or a using Tor would not help. This is a much common vector for interest targeting at Facebook. Retailers willfully share what you believed would be private with ad targeting platforms like Facebook and Google. Twitter has something similar too I think.