If a company takes legal action against you or other users, they will subpoena the card processor, too; the fact that the first company doesn't hold your personal details is irrelevant.