PCI-DSS requires you to be compliant if you store, transmit, or process credit cards. Although you are not storing them in full, does the full credit card number ever reside (even temporarily) on your site? If so, you are subject to the SAQ-D.
The only level (singular) you potentially qualify for is the SAQ-A which deals with merchants who have ecommerce or mail/telephone order transactions.
- Your company handles only card-not-present (e-commerce or mail/telephone-order) transactions;
- Your company does not store, process, or transmit any cardholder data on your systems or
premises, but relies entirely on third party service provider(s) to handle all these functions;
- Your company has confirmed that the third party(s) handling storage, processing, and/or
transmission of cardholder data is PCI DSS compliant;
- Your company retains only paper reports or receipts with cardholder data, and these documents are not received electronically; and
- Your company does not store any cardholder data in electronic format.
SAQ-B is for merchants who use card-reading devices.
SAQ-C is basically for businesses that use Point-of-Sale computing systems or virtual terminals.
SAQ-D is for everyone else.
It sounds like card details are entering your system. Even though your intentions are to use a third party processor, this is not the intention of SAQ-A. SAQ-A is meant for third-party processing such that the card details NEVER enter your system (think Paypal).