We don't collect CC directly, we redirect users to Stripe Checkout page (so not on our website anymore) and we get a webhook from stripe with a token of the CC and no details about the real CC number... It's pretty safe and that way we dont need to be PCI compliant