You're talking about names and addresses combined with credit card details. That's enough to make large purchases online.
This would not be the case in any EU country due to the fact that purchases above circa. 30.00EUR will trigger 3D Secure where the card holder will be asked to input 2FA data
Also in terms of data, card holder name and addresses would only be secured on our database - card details such as card number, expiry, and CVC would be stored on Stripes database. We have no access to this information whatsoever
As a user, I can't check if you really delete the data. Anyone with a new website can claim to destroy personal data, but the only way to be sure you don't have it is by not sharing it.
This is a good point, we are clearly aware that our database is a honeypot to hackers. We don't want to hold the data for a second more than necessary. We are exploring some sort of mechanism where the data can be "provably destroyed" or an independent third party to verify the destruction of the data.