I don’t know your shop. Everywhere I’ve worked when an order is placed there is an order ID and fulfillment ID and shipping label created automatically, so the order status can be tracked both internally and externally.
At any scale without these you’ll never be able up identify errors in the process.
Data gathering/brokering and payment information security are not really connected. PCI compliance standards are well standardized and fairly strict.
I would trust Google to handle payment information securely over any ‘media’ company.
If personal data was regulated at even the fraction of what payment data goes through we would all be better off.