The POS can store anything that can trace a customer. It wouldn't be hard to derive a unique token from the credit card information, so it doesn't have to deal storing anything sensible.