I'd go for option A too. If people are paying for something, an email address is a legitimate request. Its a virtual world, and you need a way to contact them. I would have your privacy policy ready to go and prominent though. You might not like option A for some reason, but most of the time if the verification email is sent immediately, its not a big hassle.