Hello Hubert,
I just tried the CC module myself a few days ago. The truncated card number is stored on the order section of the cart. The missing numbers are emailed to the email address you specify. This helps keep everything separate and you a little safe.

The only thing that is technically in violation of TOS with a lot of credit card processors is the storing of CVV2 data. I know and understand 'why' ZenCart offers this as if you are going to be keying in said card information you will typically be prompted for this data. It does not effect the rate you're charged if you're on a tiered structure but it's nice to have that added level of security.

That's a tough choice.