Ooof, this is a deep topic and people bleed all over it when running a SaaS company. I used Pin Payments (nee Spreedly Subscriptions) for Appointment Reminder. You will probably end up using Stripe's subscription feature, which has some (but not all) of this logic baked in.
> What happens when credit card is declined
You retry the card on three consecutive days (many declines are due to network or balance issues) then start emailing the customer about it. After a few emails you escalate to phone calls. Except, you don't do this -- you use Churnbuster to do this, because for a pittance they will make you thousands of dollars a month at scale. (Churnbuster assumes you're going to be using Stripe... but you should use Stripe.)
> What happens when they downgrade the subscription
Judgment call here: do you want to do a pro-rated refund or a pro-rated account credit? e.g. If someone changes from a $100 plan to a $25 plan halfway through the month, we observe that they've consumed $50 worth of services and have $50 remaining, which we could either a) send them back on their CC and bill them normally from here out or b) give them an account credit for $50, which will cover their next two months of service, then bill them normally.
The case for the account credit is largely "it optimizes for your cash-flow management as opposed to their cash-flow management." (This can be important in corner cases like e.g. switching from $5.5k for 12 months to $1k per month in month 2. Which, by the way, annual to monthly pro-ration logic is something you're going to probably have to write.)
> How long should the data be retained in a suspended account
Judgment call; I default to "indefinitely unless legally required otherwise or requested otherwise." Many customers will come back to you a year later and _expect_ that you still have their account on file. Customers who are more privacy conscious will tell you; you can delete their account then. (Note that deleting an account is largely a feel-good measure for the customer and accomplishes epsilon from the privacy perspective. There are probably 1+ people reading this who disagree with this assertion, so riddle me this: what happens to our last 2 years of backups when I delete an account? Do I re-hydrate all of them, run the delete SQL, then re-backup and blow away the old version? Nope. Do I toss 2 years of backups because a $29 account churned? Umm, nope. We have your data at least as long as our data recovery window and it is probably recoverable for longer than that, and us deleting an account does not change that.)