Mostly they don't. The payment provider stores this and provides that and the truncated PAN (the card number with digits masked by asterisks).

One of the things you pay payment providers for is for taking on the risk of the higher levels of PCI compliance.