Even if you delete it in Stripe, I very much doubt that stripe or the credit card providers will be deleting the data.

Someone will know that Mr Smith has a mulvad VPN subscription. They just won't know his username on the service.

That's a very good question. I wonder why companies don't push hard to disallow third-party services from storing their customers' data. I had this issue as an employe. My employer used a third-party service for onboarding. This service had a breach and my data (including my SSN) was leaked. I've been begging my employer (one reason I wish I lived in California) to take action and have them remove my data, because another breach is inevitable. They've finally sent a request to delete all employees' data. Now I am waiting.

Mullvad deletes all transactions as soon as they are allowed by law/contract with pay agent. That's 45 days for some things and 60 for others I believe. They have more details on their site. This assumes you trust them to shred that info though. They also supposedly don't keep ip logs, but I assume their ISP does, so I guess that's of limited value.