The implementation looks pretty slick to me!

If you're taking care of most/all the technical details, the only blocker that would prevent me from this kind of service is the unknown legal/compliance work I'd need to do in order to start taking this kind of money and have access to those users' data - is that something you can provide guidance on?