Thanks for your input!
No, I won't be storing card numbers. I'll just store a hash I can use to bill again. The PCI certification is cumbersome and costs money I don't have yet, and I'd really prefer if those numbers are on someone elses's server - just in case. (c: