I suspect a temporary ID that links the two that lives for just the time of the Payment Request and transmitted as metadata? Once the payment is successful, it removes the ID linking the payment to the account ID & severs the link - just the account has the credit

Handle what? Of course someone can go to Stripe and get that info, but as OP just said, they won't be able to tie it to a specific VPN account as that link is now broken.

They also mentioned it's about less data, not about zero data. The moment you use a credit card, of course it's stored in a bunch of places. But this won't be stored with them.