- they keep a payment token linking the credit card transaction to the VPN account for x days before deleting it.
- You can mail them cash or send them cryptocurrency to avoid them having any data.
- They may need to mitigate the EMV chargeback policy
Maybe reducing the refund time is a bad thing, though also maybe it reduces the amount of time that you would need to hold an account before doing risky stuff with it if you didn't want to send them cash. (providing you assume they are true to their word and that no one has backdoored them to log the data without their knowledge)