schlmoe
V.I.P. AmberLander
The truth of the matter is that charlesbot.com most likely does not get to see or retain any of your CC or personal information. This is governed by the rules of PCI-DSS (https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard)I missed the beta period too. I might buy it just to test it though. 10 bucks is a fair price.
EDIT: was going to buy this, but the only option is credit card, so you would get all my personal information including my full legal name. So I didn't get it.
While not mandatory by US law, any US based CC processor who accepts Visa/MC/AMEX/Discover is bound by these rules. Let's look at a similar transaction: MFC token purchase. Once you chose a CC processor (EPOCH/CCBill/etc), the address bar changes from MFC.com to EPOCH.com (or whatever). When the transaction is approved, all MFC gets is your MFC alias, your email address and an approval code. Since the "purchase" is delivered electronically, MFC does not have any right to (see) your name or address. This is a key tenet in PCI-DSS: "Restrict access to cardholder data by business need-to-know".
While it's nice that charlesbot.com has provided a privacy policy, if you're concerned you should view his CC processor's privacy policy. I would say that you would be "OK" if when you get to the CC info entry page (or popup) that the domain in the address bar reflects the CC processor (rather than charlesbot.com).
There's a lot more, but this is already turning into a tl;dr
*Disclaimer: This is not an endorsement of charlesbot.com, just a clarification of CC regs that vendors/processors must adhere to
*Source: Me. 15+ years IT Security/IT Audit (CISSP/CISA/CRISC/former PCI-QSA)