Let me be a bit of a stickler about your security statements. This assumes you have to text your credit card information to use this service, which it appears

Let me be a bit of a stickler about your security statements. This assumes you have to text your credit card information to use this service, which it appears is true? It's not correct to say it's "about as secure and encrypted as it gets". GSM/CDMA networks do employ encryption to and from towers, but it's weak encryption by modern TLS standards, and who knows what happens to it when it leaves the tower? It's certainly not end-to-end encrypted between your customer and your server and could be silently eavesdropped at multiple points. And if you're receiving and processing the SMS that contains the card details it's disingenuous to say "[we] have no idea what your credit card numbers actually are". Yes you do. You may discard that information after you trade it with Stripe for a token, but you had access to it, and the customer has no guarantee that you've discarded it.