Looking in to it now. We don't store any information like credit card numbers, that's all handled directly with the card processors (Stripe or PayPal). The email address is used purely so donors can look up past donations or manage (cancel) ongoing donations.