Legally, you'd have to start by applying to the Data Registar for permission to do this, you'd have to tell the user that you stored this data, then you'd have to make it VERY secure, then you become a hackers' target when your site's privacy policy states you do this, then you lose customers who are worried you'll lose their data, then you go out of business...

Other than just names, address, tel nos, membership details (for a club), and a few other simple things (employee details for example, or sales details), you need to speak to the Data Registrar to store personal info. And even the above may soon require you to be registered.

So credit cards - not a good idea

__________________
www.kidneydialysis.org.uk