> Most apps these days gather credit card details

That's one of the few consumer-facing areas where there are still standards in place, namely PCI-DSS. As far as I know the audits require the name of a human who is responsible for payment security. Card companies can one-hit kill your startup if you're breaking those rules (maybe purely blockchain startups are exempt).

Yes, you can offload this to stripe, but then your app should never see the card number and certainly not the CVV. You end up storing these, even by accident, both stripe and the card companies will hate you.