Doesn't this just shift who gets your information from the credit card company to the company running this?

If it's only intended to prevent identity fraud or data theft, then it's really 'security' more than 'privacy'.