Storing a customer’s card number in a PCI-compliant payment processing system is legal. It is NEVER legal to store a customer’s CVV code in any way.