I coded a credit card payment a few times in my career and from what I saw it's always just a token. That token could be only used to make transactions from your account to the specific vendor's account. Of course there's always could be some incompetent developer who thought that saving credit card data into a database is a great idea, but overall it's not as risky as people think.