Just to clarify, SHA256 is a one way hash, not encryption. Once it is hashed, it cannot be recovered.
You are correct to be concerned that a password you created (not auto-generated by the site) was emailed to you. That being said, I disagree with your statement:
"If they can, that means that my sensitive information are stored in plain text too."
Just because they do one thing wrong, doesn't mean they are doing other things wrong too. Similarly, just because another site does password storage correctly, doesn't mean they aren't making other mistakes. In other words, you can never truly trust any site unless you know exactly how it works behind the scenes.
Really the only thing you know for sure, is that they are emailing you the password you created when you registered. That is bad practice, but it doesn't necessarily mean anything more than that. It's entirely possible that they are sending the email at the moment you register, then hashing your password with SHA256 as they claim, and perhaps using proper methods of storage for payment information too (or not storing payment information at all on their servers).
The first thing I recommend would be to change your password on that site. It's possible that the email you received containing your password only happens when you first register. They might not send you an email every time you change your password, and if not, and if you believe they are truthful that they are hashing your password, then you're probably fine from then on.
As an extra precaution, if the password you initially used is also used by accounts you have on other websites, then I would recommend changing those as well. (This is why it is good practice to use a different password on every site you use.)
Edit: as a side note, I would recommend you contact the site and let them know you are concerned about them emailing you the password you entered. Perhaps even link them directly to this question as a good reference. Let's hope you can get them to change their process.