We're building a web application embedded in a desktop application (via CefSharp) so that we can use client-side C# methods based on front-end JS on the website. For example, there is a billing data portal in which users can enter in their billing data (cardholder name, cvv, exp. date, street address, etc.) - now, the input fields for this are online, on the web app, but all of the data is stored locally on the end user's computer. When they click the submit button, the C# desktop app running locally on their computer recognizes it and encrypts then saves the billing data in JSON to a file in their local AppData folder.
This is a "sneaker bot", if you're familiar, that is essentially half-cloud based and half-local, but there does need billing data to be stored in this fashion so that it can be sent to other merchants upon client request, and so we can't use Stripe or Square, for processing transactions, because we aren't processing anything. Also, when this data is sent to other merchants, it is via local scripts, and that data is not transmitted online through our servers.
In short, would using input fields on a live web app to enter in credit card information and billing/shipping information okay if we do not do a post request, store it online, or save it, have billing-related, cookies, and that sort of thing? Would we still need to register as a PCI merchant and do the scans and all of that? Would this count as "handling" data?
Thanks. We know it's a bit of a weird situation. And yes, before you ask, sneaker botting is completely legal, at least in this fashion, although it usually involves somewhat obscure development strategies to weave around the potential necessity for storing card data and things of that nature.