[toyg]

There might be reasonable issues but still it does not look compliant with credit-card processing rules to me. I hope they have some exception in their contracts or someone upstream is going to put them out of business with lawsuits and bans.

[hn_throwaway_99]

There are no contact exceptions that would allow this. It's fundamentally not PCI compliant for a merchant to store CVV.