I was not telling about the credit card data obviously, they have much more data they can actually sell.

In my opinion, storing someone's credit card data online after purchase, without a clear option to delete it should be illegal.

GDPR them, if you're in the EU. Or just pretend you are and see if they flinch.