They probably aren't allowed to delete it and California law likely has carveouts for financial information.

In the future, use Monero ideally, or privacy.com

You can call Mercury bank to have them change your credit card number and dispute transactions.

I'd report them to the BBB and file a complaint with the California Department of Consumer Affairs.