I saw that you're collecting credit card numbers on your form... You know that if you are storing them on your servers, you need to follow FDIC regulations, right? Otherwise, you are exposing yourself to a huge liability.

I'd also be worried about whether you are disposing the credit card numbers you collect after they are done in a timely and secure fashion....

Edit: I meant PCI, not FDIC