Card details are encrypted in the browser and never touch our servers in plaintext.
Email or phone, whichever the customer gives you. Both is fine, one is enough.
The customer may be asked to verify this payment with their bank (3D Secure) before it completes.