They use an external card processor which stores your details. They only store my card details there. No address, no name, nothing.

They don't access to your card details. Just an API integration, that's all.

If a company takes legal action against you or other users, they will subpoena the card processor, too; the fact that the first company doesn't hold your personal details is irrelevant.