All the most important data that shouldn't be for my eyes -- is 256-bit encrypted as it gets entered into any database. All passwords and most user-inputted data is encrypted. Stripe takes care of the payment information which I don't store, but I do keep the expiration date in my database which usually cannot be used to identify anything. Definitely trying to be more GDPR-compliant as I take privacy and security very seriously. Wouldn't want my data exposed if I was using someone else's product and that is how I try to think when developing and encrypting the data.