I'm interested to know what level of "cannot store" the info is implemented? Or is it mediated by a 3rd party company / algorithm that sanitizes the data but t

I'm interested to know what level of "cannot store" the info is implemented? Or is it mediated by a 3rd party company / algorithm that sanitizes the data but to a certain amount that some association can still be done? For example, can the customer's credit card be anonymized but still tracked to know that the same credit card is used on 2 different transactions, for example? E.g. if I wanted to give the customer only 1 special offer per credit card number, is that possible for the retailer to tell? Or is it even more sanitized such that every single transaction gets a different hashing? How do refunds get issued if the number can't be stored and presumably you don't want the retailer to have the backwards decoding to be possible?