GDPR and other laws are supposed to stop that, and has worked out nicely according to audits. Stores are not allowed to keep your credit card number just a reference number. (But a lot of clubs are now registered on the credit card so they can still conncet a sale to a person with out storing the credit card number.)