Data privacy is a real concern, but any SaaS provider worth their salt is using Stripe or similar for payments, not rolling their own. That's not as good as not providing the info in the first place but that makes it much less likely that your CC info is going to turn up in an S3 bucket with bad permissions or something.