Would using an input field for billing data but not storing or posting any of that data be legal?

Question

We're building a web application embedded in a desktop application (via CefSharp) so that we can use client-side C# methods based on front-end JS on the website. For example, there is a billing data portal in which users can enter in their billing data (cardholder name, cvv, exp. date, street address, etc.) - now, the input fields for this are online, on the web app, but all of the data is stored locally on the end user's computer. When they click the submit button, the C# desktop app running locally on their computer recognizes it and encrypts then saves the billing data in JSON to a file in their local AppData folder.

This is a "sneaker bot", if you're familiar, that is essentially half-cloud based and half-local, but there does need billing data to be stored in this fashion so that it can be sent to other merchants upon client request, and so we can't use Stripe or Square, for processing transactions, because we aren't processing anything. Also, when this data is sent to other merchants, it is via local scripts, and that data is not transmitted online through our servers.

In short, would using input fields on a live web app to enter in credit card information and billing/shipping information okay if we do not do a post request, store it online, or save it, have billing-related, cookies, and that sort of thing? Would we still need to register as a PCI merchant and do the scans and all of that? Would this count as "handling" data?

Thanks. We know it's a bit of a weird situation. And yes, before you ask, sneaker botting is completely legal, at least in this fashion, although it usually involves somewhat obscure development strategies to weave around the potential necessity for storing card data and things of that nature.

Answer 1

There will be questions about handling of keys and potential client side attacks, etc. The only person who can give you a solid answer is a PCI-DSS QSA who understands enough implementation details to understand the data flows. I'm not a QSA but I've done enough PCI work to have an informed opinion.

My guess is that it does not count as 'handling cardholder data' from the perspective of your infrastructure, since in reality your servers don't see the data encrypted or otherwise (pls correct me if I understood incorrectly).

Also, in my personal view, it's unlikely this would be illegal, but it will have significant ramifications into PCI scoping, depending on how it ends up being implemented.