Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time.
Is it legal to store the credit card information as they're filling it out on the checkout, for say 6 hours or something, on a PCI compliant data store, and then only if they perform the action which lets them know their card will be billed again, then and only then charge it.
And then just delete records of cards after some number of time?