> In order to provide refunds and the ability to recover lost accounts we need to store some record of a payment, at least for a short time. As soon as we do not need the data to enable refunding a payment we scrub the record of anything that can link the payment or the account to any personally identifiable information kept by the payment processor (this could be your bank, for example).

So they hold your info and link for however long the chargeback period is (or the average one, probably 30-60 days is fine) and then lose it.

If you're more worried about privacy than convenience they offer other payment methods:

Which payment methods do you accept? We accept cash, Bitcoin, Bitcoin Cash, Monero, bank wire, credit card, PayPal, Swish, Giropay, Eps transfer, Bancontact, iDEAL, and Przelewy24.

https://mullvad.net/en/pricing/

And you can pay for a decade in advance.

(What is Pretzel24 I wonder?)

Sure, but they can ban your payment method, and they care about privacy enough to eat this (probably small) cost.

Also, they do actually keep a link for 40 days, but it seems like some card card networks allow chargebacks past that.